What changes with the level of information given to the auditor
The three terms describe one thing only: what the auditor knows about your system before starting.
- Black box: no information. The auditor puts themselves in the shoes of an external attacker who only knows your domain name.
- Gray box: a user account, sometimes an architecture diagram. The auditor tests what a malicious client, employee, or contractor could do.
- White box: full access. Source code, server configuration, administrator accounts, documentation.
The more the auditor knows, the less time they waste guessing. They spend their days looking for vulnerabilities, not mapping.
Black box: the attacker's perspective
This is the right choice to see what a stranger sees of you from the Internet: exposed sites, forgotten services, vulnerable versions, accounts and passwords already published.
Its limitation is time. Much of the mission is spent discovering your perimeter. A hidden vulnerability behind a connection may remain out of reach.
This mode suits an SME that has never been audited and wants a first assessment of its public exposure.
Gray box: the best value for most SMEs
With a customer account and an employee account, the auditor tests real business risks: a user reading another's data, an invoice accessible by changing a number in the URL, a role escalating privileges.
These are frequent flaws in web applications, and black box testing often misses them. For a site with a customer area, a business application, or an online store, this is our default recommendation.
Our web pentest guide for business leaders details what is tested in this case.
White box: when full access is justified
We open everything in three situations: a custom-built application with critical code, a tight deadline (fundraising, audit for a major client, cyber insurance), or a budget that needs to find the maximum number of vulnerabilities in the minimum time.
The auditor reviews the code and configurations. They find defects that no external test can reach: secrets left in the repository, missing access control on a route, incorrectly applied encryption.
Trade-off: you need to prepare access, mobilize a developer to answer questions, and sign a precise scope on what is shared.
Price and duration: what we display
On our IT security audit page, updated 13/11/2026, the Pentest Starter covers 1 site and its hosting in 3 to 5 days, for €3,499 ex. VAT from the catalog. The Pentest Premium covers up to 3 sites or applications and network infrastructure in 7 to 10 days, for €7,999 ex. VAT from the catalog, with a roadmap over 6 to 12 months.
The page specifies that the audit is performed in black box, gray box, or white box depending on the scope. Active Directory, cloud, and Red Team are quoted separately. Current rates and current offers are those on the page: verify them before deciding.
What the report must contain, regardless of level
The box level doesn't change what you have the right to expect at the end. A useful report for a business leader contains four things.
- A summary readable without technical training: what is serious, what isn't, and why.
- Each vulnerability classified by severity, with proof: screenshot, request, steps to reproduce.
- A prioritized remediation plan: what to fix this week, this month, this quarter.
- Verification after remediation, to confirm that the vulnerabilities are properly closed.
Our audit page indicates a re-audit after remediation included in all offers. Ask the same from any service provider: a report without verification doesn't prove that the risk has disappeared.
How to choose in three questions
Ask your team these questions before calling the service provider.
- Does your site or application have a login area? If yes, aim for at least gray box.
- Is someone waiting for a report by a specific date (client, investor, insurer)? If yes, white box reduces the risk of a poor report.
- Have you never done anything? Start with black box on public exposure, then move to the next level after remediation.
A good service provider helps you decide on the scope; they don't sell you the most expensive level.
Black box to see what the outside sees, gray box to test user permissions, white box to dig deeper. Most SMEs benefit from starting with gray box on their main application.
Describe your perimeter in a few lines: we'll tell you which level to choose, with a written quote, with no commitment.
Frequently asked questions
What's the difference between a white box audit and a pentest?
A pentest is an intrusion test that simulates an attack. It can be done in black box, gray box, or white box. White box describes the level of information provided, not the type of engagement.
Does a white box audit cost more?
It requires preparation, but the auditor wastes less time searching. The price depends on the scope and working days, not just the box color. It's set based on a quote.
Should I give my source code to an auditor?
Only in white box, and within a signed framework: scope, confidentiality, data retention period. Without a written scope, don't share anything.
Which level should I choose before fundraising?
Investors often request a recent report on the main application. Gray box or white box provides a richer report than black box alone.
Request a security audit
Read more