# Choosing an Assessment Method {#choosing-an-assessment-method}

When you create an assessment in Takumi, you choose one of three assessment methods: graybox assessment, whitebox assessment or blackbox assessment. This page explains which method to choose depending on what you can provide, and how the methods differ.

## Recommended Method {#recommendation}

:::tip[Recommended method]
If you can provide both the source code and a running environment, choose a **graybox assessment**.
:::

A graybox assessment analyzes the source code to find candidate vulnerabilities efficiently, and reports only the ones it reproduces against the running application. Because it combines efficient discovery with accurate findings, it is the method Takumi recommends most.

## How to Choose {#flowchart}

The diagram below shows which method to choose depending on what you can provide. First check whether you can provide the source code, then whether you can provide a running environment.

```mermaid
flowchart TD
    Q1{Can you provide<br/>the source code?}
    Q1 -->|Yes| Q2{Can you provide a<br/>running environment?}
    Q1 -->|No| BB[Blackbox assessment]
    Q2 -->|Yes| GB[Graybox assessment]
    Q2 -->|No| WB[Whitebox assessment]
    GB -.->|Carry over results| PT[Penetration test]
    BB -.->|Carry over results| PT
```

Note that after a graybox or blackbox assessment, we recommend running a [penetration test that carries over its results](/docs/t/assessment/features/pentest.md#follow-up). It can look for vulnerabilities the assessment did not find and check whether the findings can be chained into more serious damage. A whitebox assessment does not use a running environment, so you cannot start a penetration test that carries over its results.

## Comparison {#comparison}

The table below summarizes how the three methods differ. For details on each method, see [Graybox Assessment](/docs/t/assessment/features/graybox-assessment.md), [Whitebox Assessment](/docs/t/assessment/features/whitebox-assessment.md) and [Blackbox Assessment](/docs/t/assessment/features/blackbox-assessment.md).

|                                  | Graybox assessment                               | Whitebox assessment                    | Blackbox assessment                          |
| -------------------------------- | ------------------------------------------------ | -------------------------------------- | -------------------------------------------- |
| What you provide                 | Source code and a running environment            | Source code                            | A running environment                        |
| How vulnerabilities are found    | Analyzing the source code                        | Analyzing the source code              | Simulated attacks on the running application |
| Reported findings                | Only those reproduced in the running environment | Those detected by source code analysis | Those detected by simulated attacks          |
| Impact on the target environment | Yes                                              | None                                   | Yes                                          |
| Follow-up penetration test       | Available                                        | Not available                          | Available                                    |