Black, grey and white box say one thing only: how much the tester knows before starting. The PCI SSC guide states that penetration tests are usually done as white or grey box, because they give more accurate results than a pure black box. Act No. 264/2025 Coll. and Decrees 409 and 410 use none of these three terms, so you choose the type of test. Before you pick one, work out what you are asking. And watch out for one trap: every document uses these words slightly differently.
- Black, grey and white box say how much the tester knows before starting.
- The law and Decrees 409 and 410 prescribe no type.
- NIST and PCI SSC use the same words differently, have the interpretation written into the scope.
- When the same people test from outside and inside, start from outside (NIST).
What the tester gets and what follows from it
The definitions come from the PCI SSC guide. The British NCSC and the American NIST add to them.
| Type | What the tester gets | What the test shows | Weak spot |
|---|---|---|---|
| Black box | Nothing. According to NIST only IP addresses or their ranges. | How you look to an attacker who knows nothing about you (NCSC). | Some vulnerabilities stay undiscovered because the test has limited time (NCSC). According to PCI SSC it can take more time, money and work. |
| Grey box | Some details. According to NIST, for example, what an ordinary employee would know. | What someone who already has one account can do, say after phishing. | The depth depends on what you give the tester. |
| White box | Full details of the network and applications (PCI SSC). | Whether your handling of weaknesses works: it finds known vulnerabilities and wrongly configured services (NCSC). | It does not show what an outside attacker would find. |
NCSC adds quality: according to it, the result of a test is closely tied to how good the people doing it are. The term "black box" says nothing about that.
The trap: the same words, two meanings
In Appendix C, NIST SP 800-115 calls white box an analysis of a program's source code. Black box there is a test of the finished program without knowing the code. Grey box is a mix of both. NIST adds that for custom software white box is often more efficient and cheaper for finding defects, but it will not find defects between the parts of a program or those that arise at installation or configuration. Also, for many websites black box makes no sense in terms of code according to NIST, because there is no compiled program there.
The PCI SSC guide and NCSC use the words differently: by how much information about the target the tester gets. Both are common in practice. So ask the supplier what the word means to them and have it written into the scope. One sentence is enough: "The tester gets a customer account and an administrator account, no source code."
Three questions, not one
The box says how much the tester knows. Two more decisions complete the picture, and they are independent.
- Where the tester attacks from. From outside, or from inside the network. Decree No. 409/2025 Coll. in § 24(5) requires penetration testing from the internal and the external network. The difference is covered in the article on web and internal network tests.
- Who knows about the test. NIST distinguishes an overt test that IT knows about and a covert one that only management knows about. According to NIST the covert one is time-consuming and expensive because the tester has to stay hidden, and it mainly shows how far an attacker gets and how IT reacts. The overt one is cheaper, less risky and more common. How to prepare it is described in the article on preparation.
How to choose
- Do you want to know what an outside attacker finds out about you? Black box. NCSC states that exactly such an attacker, unconnected to the firm, is its model.
- Do you want to find as many defects as possible in your own software? Grey or white box. NIST writes that code analysis is efficient on custom software but does not replace testing the finished program. That is why NIST speaks of a mix of both.
- Are you testing because of PCI DSS? PCI SSC writes that white or grey box is usually chosen. Check what your bank or payment partner requires.
- Do you want both, from outside and from inside? NIST advises starting from outside. When the same people do both tests, they do not get inside details beforehand that an outside attacker would not have.
Decree 409/2025 Coll. requires a provider in the higher-obligations regime to record the date of the test and the names of the people who did it. It is silent on the type of test.
- Want the view of an outside attacker?an attacker unconnected to the firm (NCSC)Black box
- Looking for defects in your own software?code and the finished programGrey or white box
- Testing because of PCI DSS?PCI SSC: usually white or greyGrey or white box
- Want a test from outside and inside?the same people do both testsOutside first
- Not sure what to pick?start with what you are asking
What this does to the price
The price is set by work. NCSC writes that the scope of a test is usually given in person-days. More information at the start does not have to mean a dearer test: PCI SSC says the opposite, that a black box can need more time, money and work to meet PCI DSS requirements. The supplier Lumenax states on its page that a smaller website usually takes 3 to 5 days of testing and larger systems longer. What else raises the price is covered in the article on the price of a penetration test.
What a firm of twenty people does
You have a web shop, an internal system and one IT administrator. Proceed like this:
- Write in one sentence what you are asking. "Can an outsider reach the orders?" is a different question from "What can a customer with one account do?"
- Decide what you give the tester. A customer account and an administrator account mean grey box. Nothing means black box.
- Have the supplier write down how it uses the words and what exactly it gets. Source code and network diagrams are a separate item.
- If you order a test from outside and from inside, agree the order. From outside first.
- You will find the course of the whole test in the article on how a penetration test runs.
Mistakes that keep repeating
- Black box as the best choice. It is closest to the attacker, but NCSC points out that in the given time something may stay undiscovered.
- The term is not pinned down. The supplier means code analysis, you mean a user account. The test then turns out differently from what you expected.
- Grey box without prepared accounts. NCSC wants the accounts for testers to be created before the day of the test.
- The price is derived from the type, not from the scope. NCSC counts in person-days.
Common questions
Which type of test does the law require?
None. Act No. 264/2025 Coll. and Decrees 409/2025 Coll. and 410/2025 Coll. do not contain the terms black, grey and white box. Decree 409/2025 Coll. requires a penetration test from the internal and external network and a record of it.
Is grey box always the best?
Not always. PCI SSC writes that PCI DSS tests tend to be white or grey box. For a test meant to show the view of an outside attacker, black box is more accurate according to NCSC.
Is white box dearer than black box?
The sources do not say so. PCI SSC says a black box can need more time, money and work. NIST writes that code analysis is more efficient and cheaper than black box for custom software. The price is set by the scope and the tester's time.
Does white box mean the tester reads source code?
According to NIST, yes. According to the PCI SSC guide, white box means full details of the network and applications, and code is not in the definition. That is why you should have the interpretation confirmed in the scope.
Can I combine the types?
Yes. NIST calls the combination of code analysis and testing the finished program grey box, and NCSC writes that the amount of information about the target can differ even within one cycle of tests.
Sources
- PCI SSC, Information Supplement: Penetration Testing Guidance, version 1.1, September 2017, sections 1.3, 2.1 and 2.2: https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf
- NCSC, Penetration testing, published 8 August 2017, reviewed 10 January 2022: https://www.ncsc.gov.uk/guidance/penetration-testing
- NIST Special Publication 800-115, September 2008, sections 2.4, 5.2.2 and Appendix C: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
- Act No. 264/2025 Coll., Decree No. 409/2025 Coll. and Decree No. 410/2025 Coll., versions effective from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-264, https://www.zakonyprolidi.cz/cs/2025-409, https://www.zakonyprolidi.cz/cs/2025-410
- Lumenax, Penetration tests, viewed 25 October 2026: https://www.lumenax.cz/penetracni-testy
How to prepare for a penetration test: rules, consents and material
Retest after a penetration test: when it is mandatory and what it checks
Web penetration test vs. internal network test: what is the difference and which one you need
