What is a partially known environment?
A partially known environment is a penetration test setup in which the testers begin with limited inside information: enough to skip some discovery, not enough to see the whole design. The older name is gray box testing, also spelled grey box. Exactly what the testers receive is agreed during planning and recorded with the scope, so everyone knows which starting point the results reflect.
Typical starting information
- A standard employee account, or a customer account for a web application
- A list of in-scope subnets, hostnames or URLs
- A short description of the application's purpose and main parts
- Sometimes a laptop built from the company's standard image
What they usually do not get is source code, complete diagrams or privileged credentials.
Why it is the common choice
Many organizations pick this option because it balances time against realism. Testers spend less of the engagement on mapping, and the starting point matches threats the organization really faces. An ordinary account stands in for an employee whose password was phished, a contractor with normal access, or an insider with bad intentions. The test then answers a practical question: from a foothold like that, what can someone reach?
The weakness is that results depend on the information chosen. A test that starts from one sales user's account may never exercise the paths open to a developer or a help desk technician, so the report should explain why that starting point was picked.
Example scenario
A retailer wants to know what happens if a store employee's credentials are stolen. It gives testers one store-level account and the list of internal ranges, nothing else. The testers find that the account can read a file share holding a service account password, and that the password also works on a payment server. The report traces the path from ordinary access to a sensitive system and lists the fixes in order.
Partially known vs. known vs. unknown environment
A known environment gives testers full information, including code and admin accounts, for maximum depth. An unknown environment gives only the organization's name and scope, for a realistic outsider view. A partially known environment sits between the two. In each case the amount of information is a planning decision, and written authorization is still required before anything is touched.
Partially known environment on the CompTIA Security+ exam
Under SY0-801 objective 5.5, partially known is the middle of the three penetration test environments, which are defined by how much the testers know at the start. Scenario clues: testers receive a regular user account, a list of IP ranges or limited application details, but no code, diagrams or admin access; or the goal is to model a phished employee or an insider. Distractors are known environment (full documentation), unknown environment (name and scope only) and integrated testing, which describes red and blue cooperation rather than starting knowledge. Gray box is the older name you may see in answer choices.