A firm's Chief Executive Officer (CEO) is concerned that its IT staff lacks the knowledge to identify complex vulnerabilities that may exist in the payment system being internally developed. The…

Internal staff performing grey box testing means testers may have cognitive bias toward their own code and likely lack the depth of specialized security expertise needed to uncover complex payment-system vulnerabilities.

Black box testing yields less thorough coverage than grey box because testers have no system knowledge to guide probing of complex internal paths; a large consulting firm also exposes the proprietary code base to a greater number of individuals, increasing confidentiality risk.

Black box testing by the internal team is the least thorough combination because it pairs a lack of specialized external expertise with testers who receive no system context, making discovery of complex internal vulnerabilities unlikely.

Grey box testing grants testers partial knowledge of the system architecture, enabling them to probe complex internal code paths and find vulnerabilities that a purely black box approach would miss. An external consulting firm brings specialized security expertise the internal team lacks, directly satisfying the CEO's concern about identifying complex payment-system vulnerabilities. Restricting engagement to a small firm under NDA limits the number of individuals exposed to the proprietary code base, satisfying the confidentiality requirement.