Whilst all web app penetration tests have the same goal of uncovering security weaknesses, there are different areas to consider:
Authenticated tests analyze the security of your web app from a privileged user perspective.
Unauthenticated tests mean that our penetration testers hunt for security weaknesses without access to user credentials.
API tests are a vital component to include if your web application has an API. Penetration testing a web app’s API uses slightly different tools, and techniques. It is often covered separately from the scope of a web app test.
We usually recommend a blend of all three testing types to get the most value from your penetration testing engagement and understand all of the possible risks to your web application.