There are different types of pen testing methods that are used by ethical hackers. The depth of the test may be dictated by your budget, scope, or regulatory considerations. It comes down to what is being targeted and what is asked for. Applying a risk based approach when considering what to target can be helpful. For example, an increase in attack surface due to the addition of a new product or change in the network architecture may be a good time for a pen test. Knowing a bit about the different approaches to pen testing may help in determining how deep a test to request: Black Box – The pen tester has no knowledge of the system and goes in blind. This type of testing can be very time consuming and is like a trial and error approach. This type of pen test is typical for SOC 2 or other audits. White box – The pen tester has full knowledge of the system and can gain more access because instead of guessing where to look for vulnerabilities, they can go straight to an app or area of a network. This is usually an internal pen test Gray box – The pen tester has some knowledge of the system and uses this to gain more and more access. This test is also typical for a SOC 2.