The Chief Information Security Officer (CISO) of a new company is looking for a comprehensive assessment of the company's application services. Which of the following would provide the MOST accurate…

In a white-box penetration test, the tester is provided complete access to source code, architecture diagrams, API specifications, and internal documentation, allowing identification of the maximum number of weaknesses including business logic flaws, custom code vulnerabilities, and architectural design issues that automated scanning or black-box approaches cannot reach. This depth of access produces the most accurate and exhaustive count of application weaknesses.

Internal vulnerability scanning relies on automated tools that match against known CVE databases and cannot identify custom code vulnerabilities, business logic flaws, or architectural weaknesses requiring code-level analysis.

An internal controls audit evaluates whether security policies and controls exist and are functioning but does not perform technical exploitation or in-depth code analysis to enumerate specific application vulnerabilities.

A third-party red-team engagement simulates realistic adversarial attack chains and is valuable for testing detection and response capabilities, but it prioritizes impact over exhaustive vulnerability enumeration and is less comprehensive than white-box testing.