The Short Answer: Scope Determines Timeline
A penetration test is not a fixed-duration activity. The timeline depends on the number and complexity of systems in scope, the type of testing (black-box, grey-box, or red team), the depth of manual testing versus automated tooling, and how quickly your team can provide necessary access, credentials, and documentation during the engagement.
For planning purposes, most standard penetration testing engagements at Cyronix run 5–15 business days from kick-off to final report delivery. Red team engagements run 3–6 weeks. The free re-test phase adds 2–3 days after your remediation window. Total time from initial contact to re-test completion: typically 3–10 weeks depending on engagement type.
Phase 1: Scoping and Planning (1–3 Days)
Before any active testing begins, we conduct a scoping call (30–60 minutes) to agree the target systems, rules of engagement, testing window, out-of-scope boundaries, and emergency contacts. After the call, Cyronix provides a written Statement of Work with a fixed price, defined deliverables, and a testing calendar. Lead time from signature to test start: typically 5–10 business days.
What slows Phase 1: indecision about scope, needing legal or procurement approval for the SoW, or being unable to define which systems are in scope. Having a clear asset inventory before the scoping call cuts this phase to a single day.
Phase 2: Active Testing — Reconnaissance Through Exploitation
The active testing phase is where most of the engagement time is spent. For a standard web application penetration test (1–3 applications), this phase runs 3–5 business days. For a network penetration test covering an internal environment, 5–10 business days is typical. For cloud infrastructure assessments (AWS, Azure, GCP), 3–5 days for a focused review.
Day 1–2: Reconnaissance and automated scanning — mapping the attack surface, identifying entry points, running authenticated and unauthenticated scans. Day 3 onward: Manual exploitation — our testers attempt to exploit validated findings using real attacker techniques, chain multiple findings into high-impact attack paths, and test for logic flaws that scanners miss.
- Web app VAPT (1–3 apps): 3–5 business days active testing
- API penetration test: 2–4 business days
- Internal network penetration test: 5–10 business days
- Cloud security assessment: 3–5 business days
- Mobile app penetration test: 3–5 business days
- Red team engagement: 3–6 weeks
Phase 3: Report Writing and Delivery (2–3 Days)
After active testing concludes, 2–3 days are spent writing the final report. Every finding is documented with a CVSS 3.1 score, description, attack vector, step-by-step proof of exploitation with screenshots and logs, business impact assessment, and a remediation guide written for your development or operations team.
Deliverables include an executive summary (2–4 pages for CISOs and boards) and a full technical report (30–80 pages). A 60-minute debrief call is included. Reports are formatted for direct submission to NESA, DFSA, ISO 27001, PCI DSS auditors, and cyber insurers without modification.
Phase 4: Free Re-Test After Remediation
After report delivery, your team begins remediation. Cyronix is available during the remediation window to answer technical questions about specific findings at no additional charge. Once remediation is complete, we conduct a full re-test — re-verifying every finding using the same exploitation methods used during the original test. Findings confirmed closed receive a verified remediation certificate.
Re-test timeline: 1–3 business days. We typically schedule the re-test 2–4 weeks after the original report delivery to give your team time to complete remediation. The re-test certificate can be submitted to compliance auditors as evidence that vulnerabilities were identified AND remediated.
Total Timeline by Engagement Type
From initial contact to re-test completion, here are typical total timelines. All assume client responsiveness during scoping and access provision — delays in providing credentials, VPN access, or documentation extend timelines.
- Web app VAPT (1–3 apps): 3–5 weeks total
- API penetration test: 2–4 weeks total
- Internal network penetration test: 4–7 weeks total
- Cloud security assessment: 3–5 weeks total
- Full-scope VAPT (web + network + cloud): 6–10 weeks total
- Red team engagement: 8–14 weeks total including debrief and re-test
Related Services
Get a Timeline for Your Specific Engagement
Book a free 30-minute scoping call. We will give you a realistic timeline and fixed-price proposal for your specific environment within 24 hours.
Book Free Consultation