Types of Penetration Testing: Which Test Fits Which Risk

The types of penetration testing are named after what they attack: your networks, applications, cloud, devices or people. There are 12 in common use, and each finds a different kind of weakness, so the right test depends on where an attacker could get in and what you need to prove. The table below compares all 12; the sections after it show how to choose, and which assessments are often mistaken for pen tests.

Every type follows the same core process of scoping, reconnaissance, exploitation, reporting and retest. What changes is the target and the techniques. If you are new to the subject, our guide to what penetration testing is explains that process first.

What are the different types of penetration testing?

Which type of penetration test do I need?

Start from two questions: what can an attacker reach, and what do you need to prove, and to whom? This table maps common situations to a starting point:

ISO/IEC 27001:2022 names no test type: Annex A control 8.8 requires technical vulnerabilities to be managed, 8.29 covers security testing in development and acceptance, and your risk assessment decides which tests provide the evidence. Customer contracts and security questionnaires often name the systems they expect to be tested, so check them before you scope.

What types of network penetration test are there?

There are three: external, internal and segmentation testing. An external test attacks you from the internet, the way any outsider can; an internal test starts from inside, modelling a phished employee or compromised laptop, and usually focuses on Active Directory attack paths because that is where intrusions escalate. Segmentation testing, which PCI DSS Requirement 11.4.5 requires if you use segmentation to reduce scope, checks that out-of-scope networks cannot reach the cardholder data environment. Our network penetration testing service covers all three.

What types of application penetration test are there?

Application tests look at software rather than infrastructure, and their most serious findings are often flaws a scanner cannot recognise, such as one user reaching another user’s data:

• Web application testing follows the OWASP Web Security Testing Guide and focuses on access control, authentication and business logic. See web application penetration testing, or website penetration testing for WordPress, Shopify and Magento sites.
• API testing checks whether every endpoint enforces who may see and do what, using the OWASP API Security Top 10 as its checklist of risks. See API penetration testing.
• Mobile app testing covers the app on the device and the API behind it, following the OWASP Mobile Application Security Testing Guide (MASTG). Our mobile app security testing checklist lists what each test should cover.
• AI and LLM testing treats the model as an untrusted component, testing prompt injection, data exposure and what an agent’s tools allow. See AI and LLM penetration testing.

Source code review sits alongside these. It reads the code instead of attacking the running application, so it can find flaws that testing from the outside is unlikely to reach.

What do cloud, wireless and hardware tests cover?

These tests follow your systems beyond the traditional network. A cloud penetration test reviews identities, permissions and exposed services within the provider’s published testing rules, because in the cloud, configuration decides much of what an attacker can reach. Wireless testing checks that Wi-Fi authentication is strong and that guest networks are kept apart from internal ones. Hardware and IoT testing opens the device itself: firmware, debug interfaces, stored keys and update mechanisms.

Where do social engineering and red teaming fit?

Social engineering tests the human layer, through phishing campaigns, phone pretexts and attempts to talk past reception. Red teaming combines technical, human and sometimes physical routes into a covert, objective-led attack that also tests whether your defenders notice. A penetration test finds as many weaknesses as possible in a defined scope; a red team tests detection and response. Our comparison of red teaming vs penetration testing explains when each fits. Purple teaming, where testers and defenders work together openly to improve detection, is an exercise rather than a type of penetration test. Every type on this page is carried out by authorised testers, often called ethical hackers, working to a written scope.

Which assessments are often confused with penetration tests?

Two assessments are often bought alongside a pen test but are different work:

Both feed a test well: a clean rule base and a recent scan let the tester spend their days on what tools cannot find. Providers that sell scanning and testing together usually call it VAPT services (vulnerability assessment and penetration testing).

How else are penetration tests classified?

Beyond the target, types of pen testing are also labelled in four other ways:

• By knowledge: black box, grey box or white box, depending on how much the tester is told. Our guide to black box vs white box penetration testing covers this.
• By position: from the internet (external) or from inside the network (internal).
• By access: unauthenticated, or with test accounts for each user role. Authenticated testing reaches the parts of an application that only logged-in users see.
• By delivery: a one-off engagement, or continuous testing delivered as a service.

Can you combine test types in one engagement?

Yes, and it usually saves time. A web application and its API, or external and internal tests with segmentation testing, share reconnaissance and reporting. One scope, one report and one retest also give auditors a single piece of evidence.

Whatever the mix, scope it with the right people in the room. The NCSC’s penetration testing guidance advises involving risk owners and technical staff in scoping, and sharing a current vulnerability assessment with the testers so the test can check how complete it is.

Why Sovereign Secure

• Every test type in the table: web applications, APIs, networks, cloud, mobile apps, hardware and IoT including POS and PIN devices, wireless, social engineering, red team, source code review and AI/LLM applications, plus vulnerability scanning and firewall review.
• A PCI SSC Qualified Security Assessor (QSA) company, also a Qualified PIN Assessor and Card Production Security Assessor, so tests are scoped to the evidence your assessor will check.
• ISO 27001 certified, so your scope, data and findings are handled under a certified information security management system.

Next step

Tell us what you need tested through our penetration testing quote form and we will recommend the right mix of tests with a fixed price, or call +44 161 523 5276.