It is one of the first questions almost every business asks when planning a security assessment: how long does a penetration test take? The honest answer is that it depends, but that is not very helpful on its own. What you really want are realistic numbers and a clear understanding of what drives them, so you can plan your project, brief your board and book testing at the right moment.

The short version is that most penetration tests involve somewhere between two days and three weeks of active testing, with a typical engagement landing at around five to ten working days. The full journey from first enquiry to final signed-off report, however, usually spans three to six weeks once scoping, scheduling and reporting are taken into account. Below, we break down exactly what influences the timeline and how to work out how long your test is likely to take.

Why there is no single answer

A penetration test is not an off-the-shelf product with a fixed running time. It is a bespoke exercise, and the same phrase can describe anything from a half-week look at a simple website to a multi-week simulated attack against an entire organisation. Several factors combine to determine how long any given test will take, and understanding them helps you scope sensibly and avoid unwelcome surprises.

Scope and size

Scope is the single biggest driver of duration. The number of applications, IP addresses, user roles, servers, endpoints and pages of functionality all add time. A test covering ten IP addresses will finish far sooner than one covering five hundred, and an application with a single login type is quicker to assess than one with customers, administrators, partners and staff each holding different permissions that all need testing.

The type of test

Different assessments demand different levels of effort. A wireless test on a single site is usually quick, whereas a full red team exercise that simulates a determined, real-world attacker across people, processes and technology can run for several weeks. As a rule, the closer a test gets to imitating a genuine end-to-end attack, the longer it takes.

The testing approach

How much information you provide to the tester also affects the timeline. In a black box test, the tester starts with little or no inside knowledge, much like an external attacker, which means more time spent on reconnaissance. A white box test gives the tester full access to documentation, source code and credentials from the outset, which removes a lot of guesswork and can make the assessment more efficient. A grey box test sits in the middle and is the most common choice, balancing realism with practicality.

Complexity and custom functionality

Bespoke software, unusual technology, intricate business logic and heavy integration with other systems all slow things down, because there are no shortcuts for a tester who has to understand exactly how a one-of-a-kind system behaves. A standard content site is quick to assess; a custom-built trading platform or a complex booking engine is not.

Remediation and retesting

Testing does not always end when the tester downs tools. If serious issues are found, you will want to fix them and then have the tester confirm the fixes actually work. This retest is usually short, often a day or two, but it extends the overall project and should be built into your planning from the start.

The full timeline is more than the testing days

When people ask how long a penetration test takes, they are usually picturing the days a tester spends attacking their systems. In reality, a well-run engagement has several phases, and the calendar time from your first enquiry to a final report in your hands is considerably longer than the testing window alone.

1. Scoping and quotation

Before anything is tested, the provider needs to understand what you want assessed. This scoping conversation, sometimes supported by a short questionnaire, is what allows an accurate quote and an accurate time estimate. Expect this stage to take a few days, depending largely on how quickly information flows between both sides.

2. Scheduling and pre-engagement

Good testers are in demand, so there is often a lead time of one to three weeks between agreeing the work and the test actually beginning. This window is used to confirm scope, agree rules of engagement, arrange any access required and pick dates that suit your operations.

3. Active testing

This is the hands-on phase covered by the durations in the table above, typically anywhere from two days to three weeks depending on scope and type.

4. Reporting and quality assurance

After testing, the tester writes up their findings, and this is genuinely valuable work rather than an afterthought. A good report explains how each weakness was exploited, sets out the business impact and gives clear remediation advice, and it is usually quality checked by a second pair of eyes.

Allow around three to five working days for reporting on a standard engagement, and longer for large or red team assessments.

5. Debrief and remediation

Most providers will walk you through the findings on a debrief call so your team understands the priorities. You then fix the issues, and the time this takes is entirely down to you, your resources and the severity of what was found.

6. Retest

Finally, the tester verifies your fixes, typically in a short retest of a day or two, and confirms the issues are genuinely closed. Only then is the engagement truly complete.

How to work out how long your test will take

Because scope drives everything, the single best thing you can do is prepare the information a tester needs in order to size the work accurately. Before you request a quote, try to gather the following:

• What you want tested: specific applications, websites, network ranges, APIs or cloud environments
• The size of each target, such as the number of pages, IP addresses, endpoints or user roles
• Whether the systems are public facing, internal or both
• Any custom or unusual technology involved
• The reason for testing, for example compliance, a customer requirement or a product launch
• Any deadlines you are working towards

The clearer this picture, the more accurate your time estimate will be, and the less likely you are to face a mid-project scope change that pushes the timeline out.

Can you speed a penetration test up?

To an extent, yes, but it is important not to confuse speed with corner cutting. You can genuinely help an engagement run efficiently by responding quickly during scoping, providing credentials and access on time, giving the tester the documentation they ask for, and keeping the right people available to answer questions.

A white box or grey box approach can also make testing more efficient, because the tester spends less time working out how your systems are built and more time probing them for weaknesses.

What you should not do is compress the testing itself to save money. A penetration test is only as valuable as the time a skilled human has to think, explore and chain findings together. Rushing that phase produces a shallow assessment that misses exactly the kind of serious, real-world risks you commissioned the test to find. A good provider will tell you honestly how many days a proper job requires and will resist squeezing it artificially.

When should you schedule testing?

Timing matters as much as duration. Penetration testing is not a one-off event but part of an ongoing security programme. Most organisations should test at least once a year, and again after any significant change to their systems, such as a major release, an infrastructure migration or a new integration.

If you are subject to a standard such as PCI DSS, annual testing and testing after significant change are explicit requirements rather than nice-to-haves, so it pays to plan your assessment window well ahead of any audit date.

Planning your penetration test with confidence

So, how long does a penetration test take? Expect roughly a week of hands-on testing for a typical engagement, more for large or complex environments, and a total of three to six weeks from enquiry to final report once scoping, scheduling, reporting and retesting are included. The exact figure depends on your scope, the type of test and the complexity of your systems, which is precisely why an accurate estimate always starts with a proper scoping conversation.

If you would like a clear, realistic timeline for your own systems, CodeShield can help. As a CREST-accredited penetration testing provider, we scope every engagement carefully, tell you honestly how long a thorough job will take, and deliver testing that stands up to auditors, insurers and enterprise customers alike. Get in touch to discuss your requirements and book your assessment at the right time.