This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
There's a debate that comes up every now and then in my conversations with other security professionals… The usefulness of blackbox testing.
Back in the day, when organizations had little control over the security of their infrastructure, this kind of test let them discover just how easy it could be to dig up information and use it to attack the organization. Now that organizations have gained some maturity when it comes to security, a blackbox penetration test is a way of telling them what they already know… Essentially, checking whether the obscurity of their systems is enough to protect them. Wasn't it Kerckhoffs who said: « It must not require secrecy, and it must be able to fall into the hands of the enemy without inconvenience »?
I believe it pays off more for everyone to replace the blackbox component with an "architecture review", which basically means looking at how the systems fit together and spotting weaknesses that could expose them to security problems. In one hour, you can uncover more problems than in two days of blackbox "discoveries". Everybody wins, since the practitioner can produce a juicy report and the client has more information at hand to improve its security posture.
Nothing being absolute, there are still plenty of people and organizations that need awareness, and the blackbox approach has undeniable awareness benefits. Just look at those large organizations that, in many people's minds, were well aware of the importance of protecting their infrastructure, and that suffered major breaches in 2011.