How Long Does a Penetration Test Take?

The Short Answer

Most penetration test engagements — from initial scoping to final report delivery — take between two and four weeks. The active testing phase itself typically runs one to two weeks, depending on scope.

Factors That Affect Timeline

• Scope size — Number of IP addresses, hosts, or applications in scope is the primary driver
• Test type — External tests are often faster than internal tests
• Environment complexity — Complex segmentation or large application codebases require more time
• Combined engagements — Combined network and web app or social engineering testing extends the timeline

Typical Timeline Breakdown

1. Scoping and SOW (1–3 days) — After you submit your quote, Grid32 reviews and issues a Statement of Work
2. Pre-test coordination (2–5 days) — Confirming scope, authorizations, and technical prerequisites
3. Active testing (5–10 business days) — Our engineers conduct the engagement
4. Report writing and QA (3–5 business days) — All findings documented, severity-rated, and reviewed
5. Report delivery and debrief — Full report package delivered with walkthrough available

Rush Engagements

If you have a compliance deadline or other time-sensitive requirement, contact us to discuss expedited scheduling.