If your company engages a third party pentester to do vulnerability scanning, do you

  1. whitelist the pentester so that they can thoroughly scan the machines on the internet, or
  2. do not whitelist them so that you have a better gauge of the effectiveness of your countermeasures?
  • 2
    It all depends of if you are doing a white-box, grey-box, or black-box test.
    – schroeder
    Commented Sep 14, 2015 at 2:34
  • 1
    If you're scanning for PCI compliance, then you must whitelist the scanner, the standard mandates this.
    – paj28
    Commented Sep 14, 2015 at 8:51

2 Answers 2


If you are getting your network assessed for the first time I would suggest giving the pentesters complete access.

You will get a report that is comprehensive which would include all the vulnerabilities that exists in your assets.

This will give you the complete understanding to plan upgrading the security of your network.

Moreover, during a pentest, the testers attempt a large number of attacks within a very short time. Please remember that in practice, an attacker might try these attacks slowly, over a longer period of time, and slip beneath the radar. To enable the testers to test efficiently, white-listing the testers is a essential.


It depends on your real world threat model.

If you are afraid of the internal employees threat, then you should give the pentester great levels of access - perhaps even sysadmin or general network access.

If however, you're more afraid of Internet-borne threats, then a black box engagement would be more appropriate.

I personally like doing both - maybe alternate every year.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .