Types of Penetration Testing
Penetration testing can be scoped in several ways depending on the systems in scope, the level of access, and the objectives. The categories below are the ones we perform most often. See cost guidance for typical ranges by type, web application change detection for visibility between tests, or contact us to discuss scope.
Network Penetration Testing (External / Internal)
Firewall configuration and bypass testing, IPS evasion, DNS (including zone transfer), port scanning, service testing, and more. External from public IP space; internal from inside the network or via VPN. See network cost ranges.
Web Application Penetration Testing
Coverage aligned with the full OWASP Testing Guide (not just the Top 10). Manual + automated. Handles complex authenticated apps, APIs, and business logic. See web application cost ranges.
Wireless Penetration Testing
Weak protocols, rogue APs, default/weak credentials, mis-association and dis-association attacks, client station issues. Typically performed as part of internal engagements. See wireless cost ranges.
Social Engineering
Remote (spear-phishing, electronic) and physical (media drops, impersonation, etc.). Carefully controlled to manage morale and third-party risk. See social engineering cost ranges.
Other Testing
We also support AI integration, mobile applications, API-focused scopes, IoT/OT where relevant, OSINT, SIEM analysis and other specialized engagements. See other testing cost ranges.
Frequently Asked Questions
What types of penetration testing does High Bit perform?
Network (external and internal), web application, wireless, social engineering, and specialized scopes such as API, mobile, and OSINT.
Is web application testing limited to the OWASP Top 10?
No. Web application testing covers the full OWASP Testing Guide, not only the Top 10.
Can change detection be added to any type?
Change detection is primarily for web applications and is part of High Bit’s PTaaS work. It can be scoped when the primary need is visibility between tests. See the change detection page.