Black box vs gray box: why access changes the bill

It surprises people that giving testers more access can lower the bill. Surely less work means less money? But penetration testing is priced in tester-days, and the level of access you grant changes how those days are spent. Understanding the mechanics helps you buy a better test for less.

Where the days go

In a black-box engagement, testers start from nothing and spend a significant share of their days on discovery, mapping your system from the outside, guessing at structure, working around defenses just to reach the interesting surface. In a gray-box engagement, they start with accounts and some context, so those discovery days convert into testing days. As Cobalt lays out, gray box is the more efficient approach: testers skip the reconnaissance and go straight at the high-risk areas, so more of the engagement goes to testing the application instead of breaking into it.

The two ways access moves the price

• Cost per finding: black box spends days on reconnaissance that gray box skips, so each real finding costs more tester time to reach.
• Total days: to reach the same depth behind a login, a black-box test often needs more days than a gray-box one, raising the total quote for equivalent coverage.

Black box does not just risk a shallower test. For the same depth, it usually costs more, because you are paying experts to spend days breaking in that an account would have skipped.

When black box is worth the premium

There is a legitimate case for paying that premium: if the specific question you are asking is how much an external attacker with zero knowledge can achieve against your perimeter, black box answers it directly. But that is a narrow question, and for most teams the more valuable one is whether the application is secure behind the login, where gray box is both cheaper and deeper.

We make the full argument for leaning toward more access in how much access should you give a pentester, and break down the overall price in how much does a penetration test cost. Uvy takes the access you can authorize and spends the engagement finding real issues, not getting in. See how it works.