Types of Penetration Testing: 9 Tests and When You Need Each

Quick answer: The main types of penetration testing are external network, internal network, web application, API, mobile application, cloud, wireless, social engineering and physical testing. Each one targets a different part of your attack surface. Tests can also be run as black box, gray box or white box, depending on how much information the testers receive in advance.

"We need a pen test" is rarely specific enough to get an accurate quote or a useful result. A test of your public website tells you nothing about what happens if an employee laptop is compromised, and a network test will not find a broken authorization check in your customer portal. Choosing among the types of penetration testing is how you make sure the test matches your real risk.

This guide explains the common types of penetration testing, what each one covers, when you need it and how to choose. For help scoping the right mix, see Privaxi's penetration testing services.

Types of Penetration Testing at a Glance

1. External Network Penetration Testing

External testing looks at everything an attacker on the internet can reach: public IP addresses, firewalls, VPN gateways, email servers, remote desktop services and exposed admin panels. It is often the first test organizations run because the perimeter is where most attacks begin. Read more in external penetration testing.

2. Internal Network Penetration Testing

Internal testing assumes the attacker already has a foothold, for example through a phishing email or a stolen password. Testers try to move laterally, escalate privileges and reach sensitive systems such as domain controllers, file servers and databases. It also checks whether network segmentation actually works. See internal penetration testing.

3. Web Application Penetration Testing

Among all the types of penetration testing, web application testing is usually the most important for software and SaaS companies. Testers examine authentication, session handling, access control, input handling and business logic, often using the OWASP Top 10 as a reference. Authenticated testing with accounts for each user role is essential, because most serious flaws hide behind the login. Read web application penetration testing and SaaS penetration testing.

4. API Penetration Testing

APIs power mobile apps, partner integrations and single-page applications, and attackers often call them directly to bypass the user interface. API testing checks authentication, object-level and function-level authorization, rate limiting, data exposure and input validation, guided by the OWASP API Security Top 10.

5. Mobile Application Penetration Testing

Mobile testing reviews how an iOS or Android app stores data on the device, how it communicates with backend APIs, whether it can be tampered with and how it handles authentication. The OWASP Mobile Application Security Verification Standard (MASVS) is the common reference. Backend APIs are usually tested alongside the app.

Read our full guide to mobile application penetration testing for the process, standards and common findings.

6. Cloud Penetration Testing

Cloud testing focuses on what you control under the shared responsibility model: identity and access management, storage permissions, network exposure, secrets, logging and serverless functions. Each provider publishes its own testing policy. See AWS penetration testing for a detailed example.

7. Wireless Penetration Testing

Wireless testing checks Wi-Fi encryption and authentication, guest network isolation, rogue or unauthorized access points and whether someone in the parking lot could get onto the corporate network. It requires testers on site or a device placed at the location.

8. Social Engineering Testing

People are often the easiest way in. Social engineering tests include phishing campaigns, phone-based pretexting (vishing) and SMS lures, run within agreed limits and with leadership approval. Results help target security awareness training.

9. Physical Penetration Testing

Physical testing checks whether someone can enter offices or server rooms by tailgating, cloning badges or bypassing locks, and then plug a device into the network. It is less common but important for organizations with sensitive on-site systems.

Testing Approaches: Black Box, Gray Box and White Box

Separate from the types of penetration testing, the approach describes how much the testers know in advance:

Gray box testing is the most common choice because it gives testers enough context to reach deep functionality without wasting time on discovery. Our article on penetration testing methodology explains how these approaches fit into recognized frameworks such as PTES, OWASP and NIST.

Curious what testers actually use for each type? See our overview of penetration testing tools.

Specialized Types of Penetration Testing

• Segmentation testing. Verifies that sensitive networks, such as a cardholder data environment, are isolated. Required by PCI DSS. See PCI DSS 11.4 penetration testing.

• IoT and OT testing. Covers connected devices, industrial control systems and medical devices, with strict safety limits.

• Red team engagements. Goal-based, stealthy exercises that also test detection and response. See red team vs penetration testing.

• Continuous testing. Recurring testing delivered through a platform, known as penetration testing as a service.

Which Types of Penetration Testing Do You Need?

Follow your data and your exposure. These common situations show where to start:

Most organizations need more than one of these types of penetration testing over a year. A practical approach is to combine an annual deeper test with recurring external testing. Our guide to whether you need a penetration test helps you prioritize, and penetration testing scope explains how to define each test.

How the Type of Test Affects Cost and Duration

Different types of penetration testing take different amounts of effort. A small external test may take a few days, while a complex application or internal network can take several weeks. Social engineering and physical tests add planning and approvals. For budgeting, read how much penetration testing costs, and for vendor selection see choosing a penetration testing company.

For timelines by test type, read how long does a penetration test take, and for recurring coverage across several types, see PTaaS.

Types of Penetration Testing by Industry

Different industries face different threats and regulations, so the right mix of tests varies. The table below shows common starting points.

These are starting points, not rules. A risk assessment of your own systems should decide which types of penetration testing matter most. See financial services penetration testing and HIPAA penetration testing for sector-specific detail.

How Often Should Each Type Be Performed?

Most organizations test at least annually and after significant changes. Frequency can vary by test type:

• External network: annually and after major perimeter changes such as new firewalls or exposed services.

• Internal network: annually, and after mergers, network redesigns or Active Directory changes.

• Web application and API: before major releases and at least annually; fast-moving teams test continuously.

• Cloud: after significant architecture changes and at least annually.

• Social engineering: once or twice a year to measure awareness over time.

• Segmentation: as often as your compliance framework requires, which can be every six months for some environments.

Combining several types of penetration testing into one engagement can reduce overhead, since scoping, kickoff and reporting happen once.

Penetration Testing vs Vulnerability Scanning vs Red Teaming

People often confuse these activities. Vulnerability scanning is automated and broad, finding known issues quickly but with false positives. Penetration testing adds human testers who validate issues, chain weaknesses and show real impact within a defined scope. Red teaming is a longer, objective-based exercise that tests detection and response as well as prevention. All three have a place, and the types of penetration testing described above sit in the middle of that spectrum. Read why a scan won't save you for more on the difference.

Building a Multi-Year Testing Roadmap

1. Year one: start with external network and your most important web applications and APIs, because these face the internet.

2. Year two: add internal network and cloud testing, and begin social engineering exercises.

3. Year three: add segmentation, mobile and specialized tests, and consider continuous testing for high-change applications.

A roadmap spreads cost over time and builds maturity step by step. It also gives leadership a clear view of which types of penetration testing are covered today and what comes next. For ongoing coverage between scheduled tests, many teams use penetration testing as a service.

What to Include in Your Request for a Quote

• The specific test types you need and why.

• Asset counts: IP addresses, applications, API endpoints, cloud accounts.

• Number of user roles for application testing.

• Compliance frameworks the report must support.

• Preferred testing windows and any production restrictions.

• Whether retesting should be included.

Clear requests lead to accurate quotes and fewer surprises. Our penetration testing cost guide explains how each factor affects price.

Frequently Asked Questions About Types of Penetration Testing

What are the main types of penetration testing?

The main types of penetration testing are external network, internal network, web application, API, mobile application, cloud, wireless, social engineering and physical testing.

What is the most common type of penetration test?

External network and web application tests are the most common, because they cover the systems attackers can reach directly from the internet.

What is the difference between black box, gray box and white box testing?

They describe how much information testers receive. Black box testers start with almost nothing, gray box testers get some access such as user accounts, and white box testers get full documentation and sometimes source code.

Which type of penetration testing do I need for compliance?

It depends on the framework. PCI DSS requires internal, external and segmentation testing, while SOC 2 and ISO 27001 auditors commonly expect testing of the systems in scope, often external and application testing.

How often should each type of penetration test be done?

Most organizations test at least annually and after significant changes. Fast-changing environments add recurring external and application testing between annual engagements.

Can one penetration test cover everything?

One engagement can include several types of penetration testing, but each type needs its own scope and effort. Combining them in one project is common and often more efficient.

Final Thoughts

Understanding the types of penetration testing turns a vague request into a precise plan. Match each test to a real risk, start with what is most exposed and valuable, and build toward broader coverage over time.

Not sure which mix fits your environment? Privaxi's penetration testing services team can recommend a scope based on your systems, compliance needs and budget.