A firm's Chief Executive Officer (CEO) is concerned that its IT staff lacks the knowledge to identify complex vulnerabilities that may exist in the payment system being internally developed. The…

Using the internal security assurance and development team does not address the CEO's explicit concern that the IT staff lacks sufficient knowledge to identify complex vulnerabilities in the payment system.

A large consulting firm exposes the proprietary code to a larger number of personnel, significantly increasing confidentiality risk; black box testing is also less thorough than grey box and is more likely to miss complex internal vulnerabilities.

Using internal teams for black box testing fails to resolve the knowledge gap concern and provides less thorough coverage than grey box, since testers have no visibility into internal architecture or design decisions.

Grey box testing - where testers have partial knowledge of internal architecture - is more thorough than black box testing because testers can target known high-risk components and uncover complex internal vulnerabilities that purely external testing would miss, directly addressing the CEO's concern about staff knowledge limitations. An NDA with a small consulting firm protects code base confidentiality by minimizing the number of people who gain access to proprietary source code, reducing competitive exposure risk. This combination satisfies the dual requirements of deep technical testing and strict intellectual property protection.