Black Box Penetration Testing

Black box penetration testing is an authorised test that imitates an external hacking or cyber warfare attack launched by an outsider against an organisation's computer systems. It is used to find out how well the organisation's outward-facing defences hold up against someone attacking from outside.

The tester is given no internal details about the target system's credentials or network layout. They do not receive staff usernames, passwords or a map of the network. Instead, they must find weaknesses from the outside in the same way an external attacker would, starting only with what any outsider could discover.

Even though the tester has been given no internal details, the test is authorised. The organisation has given permission for the tester to try to break in. This is what separates black box penetration testing from a criminal attack: the work is agreed in advance and is done to improve security, not to cause harm.

What the test shows

Black box testing shows what harm an outsider with no internal details could cause. Because the tester can only use outside access, anything they can reach shows what an external attacker might also reach. The organisation can then see where its external defences are weak and fix them before a real attacker finds them.

For example, a small cinema chain hires a black box tester and gives them only the company's public website address. The tester has no staff logins and no network map, so they probe only what an outsider could see. If they can reach the booking system's admin area, the chain has learned that an outsider might do the same, and it can strengthen that defence before a real attacker finds it.