A longstanding debate in Web application security, heck all of application security, is which software testing methodology is the best — that is — the best at finding the most vulnerabilities. Is it black box (aka: vulnerability assessment, dynamic testing, run-time analysis) or white box (aka: source code review, static analysis)

Read the original here:
Black Box vs White Box. You are doing it wrong.