My day to day activities consist primarily of penetration testing (white/grey/black). Throughout my engagements, I try to educate my clients on the differences of testing types. E.g., credentialed test from an internal perspective (low level user) versus a complete "zero knowledge" plug and play test. For anyone with experience in either performing the tests, engaging a pentester, what has been the best value in terms of security intelligence.
I opine, and try to sway my clients to engage in low level credentialed tests. These tests often cover zero knowledge, as I can demonstrate exploitation, and escalation with privileges, as well as without privileges. This type of testing can cover the insider threat, as well as a threat actor performing a client side (compromising) an employee's access.
Often times, I find from the results perspective, attackers are leveraging the common low hanging fruit but only after they've "client sided" an employee. "Zero knowledge" external attacks have been highly minimized, and many clients dislike web application testing as they feel it will "bring the house down" and often serves no purpose as many organizations moved their infrastructure to the cloud.
What, from a design/security/network/systems perspective, would you feel is the best value if you were engaging in these types of tests?