Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the application and I am allowed to hand it over to the hired experts.
Are there any good reasons to prefer a blackbox penetration test over a security source code review? In my opinion a source code audit identifies critical vulnerabilities much faster and more efficient than a blackbox penetration test. Why should I let a security expert hammer at my application in the dark, when i can provide him with internal informations like system configuration and the source code to help him directing his efforts better.
To avoid confusion - when I talk about a security source code review, I assume that I will allow the security experts to perform tests on the application as well, to validate their findings and try different attacks. The goal of the audit is to identify weaknesses and improve the security of the application afterwards.