How Long Does a Penetration Test Take? Phases, Timelines and the Numbers That Matter
A penetration test does not have a fixed duration, because the work happens in stages. The active testing phase usually runs 3 to 15 working days, and the full engagement, including scoping, reporting, remediation and a retest, typically lands in 2 to 4 weeks for most external tests. Cobalt's 2026 State of Pentesting report measured the half-life of high-risk findings at 10 days for top performers and 249 days for laggards across 16,500 pentests [1]. Clone Systems penetration testing packages start at $1,995, with authenticated web application tests from $2,495.
You ask a vendor for a quote and they answer with a number of days. Three days. Five days. Two weeks. You write it down, but the number describes only part of the work. A "5-day penetration test" is the active testing phase, not the engagement. Scoping, reporting, your team's remediation, and the retest that proves the fix held all happen around it, and that is where most schedules quietly break.
In our scoping calls, the most common surprise is that clients have budgeted the test days and not the rest of the engagement. They expect a result in a week and discover the report lands in a month, not because the tester was slow, but because the fix cycle around the test takes its own time. This post answers the question we get every week, how long does a penetration test take, and it gives you a phase-by-phase timeline you can drop into a project plan.
What are the phases of a penetration test, and how long does each one take?
The work splits into five phases, and only the middle one is the "testing" most people picture. Scoping and reporting are short; active testing is the variable; remediation and retest are where the calendar stretches. Here is the typical range for each phase.
| Phase | What happens | Typical duration |
|---|---|---|
| Scoping and rules of engagement | Targets, test accounts, out-of-scope items, safe-testing agreement | 3 to 7 days |
| Active testing | Enumeration, exploitation, privilege escalation, validation | 3 to 15 working days |
| Reporting | Findings written up, evidence attached, severity assigned | 3 to 5 working days |
| Remediation | Your team fixes or accepts the findings | Days to weeks, set by your patch cycle |
| Retest | Tester re-runs the scoped tests to confirm the fix held | 1 to 3 working days |
The phases are the standard structure a structured test follows, and the durations above are what we see across engagements. The one number that surprises buyers is that the test itself, the active phase, is usually the shortest part once you add the fix cycle to the plan.
How long does an external penetration test take compared with an internal one?
An external test usually takes less active time than an internal one, because the attack surface is the public perimeter and it is bounded. An internal test starts from inside the network, so the tester has to move laterally across systems, and that expands the work.
In our engagements, an external network test most often lands at 3 to 5 working days of active testing, while an internal test runs 5 to 10. The gap is not skill or effort, it is surface area. An external tester works against your DNS, your public IP space and your exposed services. An internal tester is handed a foothold and asked to reach the systems that hold the data, which is the work described in internal penetration testing.
Access level moves the number too. A gray box test with a test account usually finishes faster than a black box one on the same target, because the tester is not spending time on access the account already provides. The difference is covered in authenticated versus unauthenticated penetration testing.
What drives the length of the active testing phase?
Three things drive active testing time, and all of them live in your scope, not in the vendor's calendar.
The first is the count of in-scope assets: the number of external IP ranges and domains, the internal subnets or host count, and the web application or API endpoint count. More targets means more enumeration and more validation. The second is the access level. As noted above, black box, gray box and white box each change how much the tester has to do, and that trade-off is set out in choosing the test model. The third is environment complexity: cloud accounts, multi-tenant applications and legacy systems that cannot be taken offline all add time.
If you are deciding what to include in the scope, the cost drivers and the scope decisions that move them are in our penetration testing cost guide.
How long does the report and the retest take, and where does the timeline break?
Reporting usually takes 3 to 5 working days after active testing ends, and the retest takes 1 to 3 working days after your fixes land. The retest is not a formality. Under PCI DSS 11.4.4 it is the step that proves the fix held, and it is the step most programs skip.
This is where the timeline breaks, and it is a measured gap. Cobalt's 2026 State of Pentesting report found that the half-life of a high-risk finding, the time for half of them to be remediated, was 10 days for top-performing teams and 249 days for the bottom tier, a 25 times difference [1]. The same report found that programmatic teams resolve 4.5 times as many critical findings in three days or fewer as compliance-driven teams, across data from 16,500 pentests [1]. In other words, the test takes a fixed number of days, but the time from finding to fix is where organizations differ by an order of magnitude.
CISA's Known Exploited Vulnerabilities catalog now lists 1,769 vulnerabilities that are actively exploited in the wild, and under BOD 26-04 each federal entry carries a patch deadline [2][3]. Private organizations are not bound by BOD 26-04, but the clock it describes is the same clock your attacker operates on. A test that finishes in five days does not help if the finding it surfaces sits open for nine months.
The 6-Point Pen Test Timeline Estimator
Run these six points against your next engagement to get a number you can put in a project plan:
- Count the scope. External IP ranges and domains, internal subnets or host count, and web application or API endpoint count.
- Set the access level per target. Black box, gray box with a test account, or white box with documentation.
- Count the environments. Production, staging, cloud accounts, and whether each one is in scope.
- Book remediation from your patch cycle, not from the vendor quote. This is the step that stretches the calendar.
- Reserve a retest window after fixes land. If you skip it, the report describes a network that no longer exists.
- Add 20 to 30 percent calendar buffer for scope changes that surface mid-test.
Most of the time, points 4 and 5 are the ones nobody budgets for, and they are the reason a "5-day test" becomes a month-long program. If you want the report to survive assessor review, the bar for what counts as a valid report is in how to read a penetration test report, and the cadence question of how often to re-test is in how often you should penetration test.
Build the timeline against the price
The calendar you plan is the same calendar you budget against. Clone Systems penetration testing packages start at $1,995 for automated tests, with authenticated web application tests from $2,495, and manual tests scoped to your environment. If you are comparing quotes, the five drivers that move the number are in our cost guide.
How long does a penetration test take for compliance, under PCI DSS 11.4?
PCI DSS 11.4 does not set a duration; it sets a frequency and a retest obligation. That means the "how long" is yours to plan, but the "how often" is fixed.
| Requirement | What it requires | Timing you plan around |
|---|---|---|
| 11.4.2 | Internal penetration testing | At least annually |
| 11.4.3 | External penetration testing | At least annually |
| 11.4.4 | Retest after fixes to validate remediation | After each remediation cycle |
| 11.4.5 | Segmentation testing for critical assets | At least annually, and after changes |
Two practical notes. First, 11.4.4 is the line that turns a one-week test into a multi-week program, because the retest only happens after your team fixes the findings. Second, 11.4.5 segmentation testing is a separate workstream from 11.4.2, and it needs access on both sides of the boundary. The full requirement breakdown and what an assessor looks for is in our PCI DSS 11.4 penetration testing guide.
How Clone Systems Can Help
Clone Systems runs external, internal, web application and API penetration tests as part of managed penetration testing, so the timeline is shaped to your scope rather than forced into a fixed package. We give you the phase breakdown in writing before a price is quoted, which means the days you are billed for are the days you can plan around.
If you are weighing providers, our head-to-heads with Intruder and Rapid7 show how the approaches differ, and our buyer's guide walks through the evaluation step by step. For the broader picture of where testing fits against scanning, our penetration testing versus vulnerability scanning post draws the line.
Next steps:
- Tell us the scope: IP ranges and domains, subnets or host count, and web app or API URLs.
- Set the access level per target, black box, gray box or white box.
- Get the phase-by-phase timeline and a retest window in writing, before you book.
Frequently Asked Questions
How long does an external penetration test take? An external penetration test usually runs 3 to 5 working days of active testing, plus a few days of scoping and reporting. The full engagement from kickoff to final report most often lands in 2 to 4 weeks.
How long does an internal penetration test take? An internal penetration test typically takes 5 to 10 working days of active testing, because the tester has to move laterally across systems. It runs longer than an external test for the same reason: the attack surface is much larger.
How long does a web application penetration test take? A web application test usually takes 3 to 7 working days depending on the number of features, API endpoints and business flows in scope. Adding API coverage or authenticated user roles extends the active testing window.
How long does a penetration test retest take? A retest usually takes 1 to 3 working days, because the tester only re-runs the scoped tests that had findings. It is scheduled after your team has applied the fixes, so it can land days or weeks after the original report.
How long does a penetration test take from start to finish? From kickoff to a retest that confirms the fixes held, plan on 4 to 8 weeks for a standard external test. The active testing itself is only 3 to 15 working days; scoping, reporting, remediation and the retest make up the rest.
Does a penetration test slow down my network or affect production? A well-scoped test is designed to avoid disruptive load, so it should not meaningfully slow production services. The rules of engagement and safe-testing boundaries, agreed before the test starts, are what keep it from degrading the systems under test.
Conclusion
A penetration test does not have a fixed duration, because the test is one phase inside a longer program. Active testing runs 3 to 15 working days; scoping, reporting, remediation and the retest make up the rest, and that is where 2 to 4 weeks becomes a month. The number you care about is not how long the tester works, but how fast your finding closes, and that is a 10-day versus 249-day gap in the data [1]. Plan the full timeline with the 6-Point Pen Test Timeline Estimator, budget the retest, and the test becomes a program instead of a report you file.
Start with a scoping conversation: schedule a demo or contact Clone Systems.
References
[1] Cobalt, State of Pentesting Report 2026. 2026. https://resource.cobalt.io/state-of-pentesting-2026 [2] CISA, Known Exploited Vulnerabilities Catalog. 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog [3] CISA, BOD 26-04 Prioritizing Security Updates Based on Risk. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk [4] Clone Systems, Internal Penetration Testing: The 80% of Your Servers Your External Test Never Sees. https://www.clone-systems.com/blog/internal-penetration-testing-the-80-of-your-servers-your-external-test-never-sees [5] Clone Systems, Authenticated vs Unauthenticated Penetration Testing. https://www.clone-systems.com/blog/authenticated-vs-unauthenticated-penetration-testing-what-the-login-actually-buys-you [6] Clone Systems, Black Box vs Gray Box vs White Box Penetration Testing. https://www.clone-systems.com/blog/black-box-vs-gray-box-vs-white-box-penetration-testing [7] Clone Systems, Penetration Test Cost: What Moves the Number. https://www.clone-systems.com/blog/penetration-test-cost-what-moves-the-number [8] Clone Systems, How to Read a Penetration Test Report. https://www.clone-systems.com/blog/how-to-read-a-penetration-test-report-the-6-questions-that-actually-matter [9] Clone Systems, How Often Should You Penetration Test? https://www.clone-systems.com/blog/how-often-should-you-penetration-test-frequency-scans-and-the-retest-nobody-books [10] Clone Systems, PCI DSS Penetration Test Requirement 11.4. https://www.clone-systems.com/pci-dss-penetration-test-requirement-11-4 [11] Clone Systems, Managed Penetration Testing Services. https://www.clone-systems.com/managed-penetration-testing-services/