Part 2 of 4 in the "Security Testing Landscape" series
Every company eventually asks: "are we actually hackable?" There's an entire industry of ways to answer that question, and they form a ladder of realism and cost. This post climbs it rung by rung.
Rung 1: VA — Vulnerability Assessment
An automated scanner sweeps your servers, VMs, and network for known CVEs and misconfigurations. It's breadth over depth: it finds and lists problems, but never exploits them. Think of it as a metal detector — it beeps, it doesn't dig.
Tools: Nessus, Qualys, OpenVAS, Rapid7 InsightVM
Box: Usually grey (the scanner gets network access or credentials); can run uncredentialed as black box.
Rung 2: PT — Penetration Testing
Now a human takes the scanner's findings and actually exploits them — chaining vulnerabilities, escalating privileges, reaching real data — to prove genuine business impact. Depth over breadth, scoped and time-boxed.
Tools: Burp Suite, Metasploit, Nmap, SQLMap, BloodHound, Cobalt Strike
This is where the black/grey/white box terminology originates:
- Black box: the tester gets nothing but a URL or IP — simulates an external attacker.
- Grey box: the tester gets a normal user account and basic docs — simulates an insider or a compromised user. This is the most common flavor in practice, and the best value.
- White box: the tester gets source code, architecture diagrams, and admin credentials — maximum coverage per paid day.
Rung 3: VAPT — The Compliance Staple
VAPT is simply VA + PT packaged together: scan everything automatically, then let a human manually exploit the interesting bits. This is the standard annual engagement companies buy for compliance, and the term you'll see on every audit checklist in this part of the world.
Rung 4: Red Teaming
A red team gets a goal, not a scope: "reach the HR database without being detected." Weeks long, stealthy, no holds barred — phishing, physical entry, custom malware, whatever works. Crucially, it tests your defenders and detection capability, not just your systems. The blue team usually isn't told it's happening.
Tools: Cobalt Strike, Sliver, Mythic, GoPhish
Box: Black by design.
Rung 5: Purple Teaming
Red and blue sit at the same table. Red runs an attack technique, blue immediately checks "did our SIEM catch that?", they tune the detection, and repeat. Collaborative rather than adversarial — the fastest way to actually improve detection coverage.
Tools: MITRE ATT&CK framework, Atomic Red Team, VECTR
Box: White — full transparency is the point.
Rung 6: BAS — Breach & Attack Simulation
Software that continuously and automatically replays known attack techniques inside your environment to verify your controls (EDR, SIEM, WAF) still detect them — an always-on mini red team that never sleeps or invoices per day.
Tools: AttackIQ, SafeBreach, Cymulate, Picus
Box: Grey/white — agents installed inside, techniques known.
Rung 7: Bug Bounty
Open the doors and invite researchers worldwide to attack your production app, paying per valid bug instead of per day. Continuous coverage, pay-for-results economics.
Platforms: HackerOne, Bugcrowd, Intigriti
Box: Black — researchers get exactly what the public gets.
The Human-Focused Rungs
Three assessments attack things other than servers:
- Social Engineering / Phishing Simulation targets your people — fake phishing emails, phone pretexting (vishing), USB drops — measuring click and credential-submission rates. Tools: GoPhish, KnowBe4, Microsoft Attack Simulator.
- Wireless Assessment targets your airwaves — rogue access points, WPA2 handshake cracking, evil-twin attacks. Tools: Aircrack-ng, Kismet, WiFi Pineapple.
- Physical Security Testing targets your building — tailgating, badge cloning, lock picking, plugging into exposed ports. Tools: Proxmark, LAN Turtle.
All three are black box: the targets don't know.
The Ladder, One Line
VA (scanner lists bugs) → PT (human proves bugs) → VAPT (both — the compliance staple) → Red Team (full attack, tests your people and detection) → Purple (red and blue learn together) → BAS (automate it forever) → Bug Bounty (outsource it to the world).
Each rung up costs more and simulates reality more faithfully. Most organizations start with VAPT and grow upward.
Next in the series: the quiet group that never attacks anything — reviews, audits, and threat modeling.
Top comments (0)