Black-box testing is security testing performed without access to source code, design documents, or internal system details. The tester interacts with the application the way an external user or attacker would: by sending requests, observing responses, and probing behavior.
This matters because many vulnerabilities only appear in real execution, such as broken authentication, input validation flaws, logic errors, or misconfigured access controls. Black-box testing is common in penetration tests, web application assessments, and bug bounty work, where the goal is to discover exploitable issues from the outside. It is also useful as a defense because it measures what an attacker can actually reach, not just what code review suggests may be present. However, it can miss hidden weaknesses in unreachable code paths or internal trust boundaries, so it is often paired with source-code review and other white-box methods for better coverage.