What is a known environment?
A known environment is the penetration test setup in which the client hands the testers everything it knows about the target before work begins. Older material calls this white box testing, and some vendors say clear box. The label describes the testers' starting knowledge, not their technique: exploitation and reporting work the same way in any engagement, but here no time is spent rediscovering facts the organization could simply share.
What testers receive
- Network diagrams, IP ranges and an inventory of the in-scope systems
- Application source code, API documentation and architecture notes
- Configuration files, firewall rule sets and build standards
- Accounts at several privilege levels, from an ordinary user to an administrator
- Named engineers who can answer questions while the test runs
Why choose a known environment
The main benefit is coverage per hour. A two-week engagement can spend nearly all of its time on logic and configuration instead of mapping. With code in hand, testers can trace how input moves through an application, find an authorization check missing from one function, or confirm that a firewall rule allows more than its owner intended. That suits a new application before release, a high-value system after a major change, or any review whose goal is to find as many weaknesses as possible.
The cost is realism. Outside attackers rarely start with diagrams and admin accounts, so the results say little about how hard the organization is to break into from the internet. A known environment test answers the question of what is wrong with this system, not how far a stranger could get.
Example scenario
A bank is about to launch a mobile payments API. It gives the test firm the source repository, the API specification, a test account for each customer role and read access to the cloud configuration. Within days the testers find an endpoint that validates the session but never checks whether the requested account number belongs to that customer, a flaw that would be slow to find blind. Developers fix it before launch.
Known vs. partially known vs. unknown environment
| Environment | Older name | Starting knowledge |
|---|---|---|
| Known | White box | Full documentation, code and accounts |
| Partially known | Gray box | Some details, such as one user account |
| Unknown | Black box | Organization name and scope only |
The choice changes what the testers know, never what they are allowed to do. All three still need written authorization and rules of engagement.
Known environment on the CompTIA Security+ exam
SY0-801 objective 5.5, which covers audits and assessments, sorts penetration tests by how much the testers are told, and known environment is the full-information option. Scenario clues include testers who receive source code, network diagrams or administrator credentials, or a brief that asks for the most thorough review possible in limited time. The distractors are partially known, where testers get only some details such as one standard account, and unknown, where they start with little more than a company name. White box may appear as the older name for the same thing.