How Long Does a Pentest Take? Timelines by Test Type

By the Guardian team Updated November 2026 5 min read

Quick answer. From kickoff, most single-scope pentests take 1 to 4 weeks of testing and 1 to 7 business days of reporting (Fortbridge, Zensec). Allow 4 to 8 weeks from first contact to final report, then a retest.

Watch: How Long Does a Pentest Take? Timelines by Test Type 1:22

Video transcript

Most pentests take one to four weeks of testing. Plan four to eight weeks from first contact to final report, then a retest.

Testing is usually the short part. Scoping, scheduling, reporting and the retest fill most of the calendar.

Scoping takes one to two weeks, scheduling one to three, and active testing one to four. Reporting adds one to seven business days, then the retest.

Scope sets where you land. Fortbridge lists five to twenty days for a web app, three to five for an API, and up to fourteen weeks for a red team.

Much of the lead time sits with you. Have credentials, a staging environment, API docs, third-party permissions and signed rules of engagement ready.

Threat-led tests run longer. Under TIBER EU, active testing alone takes a minimum of twelve weeks.

Fortbridge advises starting at least eight to ten weeks before a compliance deadline. Plan scoping, scheduling, testing, the report, then fixes and retest.

Book the retest when you book the test. Every Guardian pentest is closed out with a retest.

Read the full article for every range, or book a system review at guardian.security with a Guardian engineer.

Pentests get booked against a date: a launch, a bank partner's review or an auditor's deadline.

The testing is usually the short part. Scoping, scheduling, reporting and the retest fill most of the calendar.

Below are the timelines vendors and standards publish, each one attributed. For prices, see our Web3 pentest cost guide.

The Timeline at a Glance

NIST SP 800-115 names four phases: planning, discovery, attack and reporting, with reporting running alongside the other three.

Two vendors put calendar time on each stage:

Stage	Published time	Source
Inquiry and scoping	1 to 2 weeks	Zensec, Fortbridge
Scheduling	1 to 3 weeks	Zensec
Active testing	1 to 4 weeks, depending on scope	Fortbridge
Reporting	1 to 3 business days; 3 to 7 business days	Fortbridge; Zensec
Debrief call	Typically within a week of the report	Fortbridge
First contact to final report	4 to 8 weeks	Fortbridge, Zensec

The retest comes after that, once your fixes ship. New to the phases? Start with what penetration testing is.

Lead Time Before Testing

Lead time ranges from a day to six weeks, depending on the model:

Fortbridge: allow 4 to 6 weeks from first inquiry to the start of testing.
Zensec: one to two weeks of scoping, then one to three weeks of scheduling.
Cobalt: "No six-week lead time. Active testing starts the next day," on its financial services page.

Much of the lead time sits with you. Astra counts its 10 to 15 working days from when its engineers "receive all required information."

Have these ready before the first call:

Test credentials for every role.
A staging environment that matches production.
API documentation and the repository, if testing from source.
Written permission from custodians, cloud and other third parties.
Signed rules of engagement, with windows and blackout dates.

Our rules of engagement template lists every clause.

Testing Days by Test Type

Two vendors publish testing days by type. Neither range includes scoping, reporting or the retest.

Test type	Fortbridge	Zensec
Web application	5 to 20 days	2 to 3 days (simple); 10+ days (complex)
API	3 to 5 days	Not listed separately
Mobile app	5 to 10 days (iOS and Android)	3 to 5 days
Internal network	5 to 10 days	3 to 5 days (mid-sized)
External network	3 to 5 days	1 to 3 days (small); 4 to 5+ (larger)
Cloud configuration review	3 to 5 days	Not listed
Red team	2 to 14 weeks	2 to 6 weeks, sometimes longer

Overall, Fortbridge says "a typical penetration test takes between 5 and 15 working days."

Scope sets where you land in each range: roles, endpoints, environments and whether testers read the source.

Plan for the top of the web app range if your app has wallet login, withdrawals, admin roles or a signing flow. Each needs its own test cases.

Red team and threat-led tests

Threat-led red teaming runs on a longer clock. The ECB's TIBER-EU framework (January 2025) sets out these phases:

Preparation: notification to scoping, charted across months 0 to 6.
Threat intelligence: indicative 4 to 6 weeks.
Red team test plan: indicative 2 to 3 weeks.
Active testing: "a minimum of 12 weeks."
Closure: up to 10 weeks for reports and replay, then a review, then up to 8 weeks.

TIBER-EU adds that closure may run longer than 18 weeks. EU financial entities should read our DORA penetration testing guide.

Reporting Time

Fortbridge: 1 to 3 business days after testing.
Zensec: 3 to 7 business days, with a draft "within a few days."
Zensec's rule of thumb: "roughly one day for every day of testing."
Cobalt: autonomous pentest findings in 24 hours; a structured report at engagement close.

Do not wait for the final report on a Critical. Agree in the rules of engagement that it reaches you the day it is found.

Retest Windows

The retest starts once your fixes are live. Fortbridge advises leaving developers time to fix, and testers time to verify.

Published retest timing varies:

Zensec: a retest takes "a fraction of the time of the original engagement."
Fortbridge: a separate engagement, timed for when your team is ready.
Cobalt: free retests with a seven-day SLA.
Software Secured: rounds spread over 12 months.

If a launch or an auditor needs a clean report, the retest date matters more than the test length.

Planning Around Launches and Audits

Fortbridge advises starting at least 8 to 10 weeks before a compliance deadline. Work back from the date your report must show fixes retested.

Here is an illustrative 10-week plan, built from the ranges above.

Weeks 1 to 2: scope, credentials and rules of engagement.
Weeks 3 to 4: scheduling and environment setup.
Weeks 5 to 6: active testing, with Criticals shared live.
Week 7: report and debrief.
Weeks 8 to 10: fixes and retest.

Three habits keep that plan intact.

Freeze the build under test. Code that changes mid-test was not tested.
Put launches, listings and upgrades in the blackout dates.
Book the retest when you book the test.

How Guardian Runs the Timeline

Guardian scopes each offchain engagement by what it tests. A web app is scoped by what a user can do, an API by endpoint count and roles, and cloud by the accounts and platforms in play.

For USDT0, Guardian ran an offchain review of the Gasolina DVN signer and an API security review together over two weeks.

On the Avantis V2 backend, both Critical findings were fixed while the review was still running. A remediation round followed the main review.

Every Guardian pentest is closed out with a retest.

Planning a test around a launch? Book a system review: an hour with a Guardian engineer, then a written summary of what a first ninety days would cover.

Frequently Asked Questions

How long does a penetration test take?

Fortbridge puts active testing at 1 to 4 weeks, depending on scope. Fortbridge and Zensec put reporting at 1 to 7 business days, and the whole process at 4 to 8 weeks from first contact to final report.

How long does a web application pentest take?

Fortbridge lists 5 to 20 days of testing. Zensec says a simple site can take two to three days and a complex app ten days or more. Astra quotes 10 to 15 working days from receiving all required information.

How long does a red team engagement take?

Fortbridge publishes 2 to 14 weeks and Zensec 2 to 6 weeks or longer. Under TIBER-EU, active testing alone takes at least 12 weeks, after threat intelligence and planning, and closure can run past 18 weeks.

How soon can a retest happen?

Once your fixes are live. Zensec says a retest takes a fraction of the original test's time, and Cobalt offers free retests with a seven-day SLA. Leave developers enough time to fix before the retest date.

Sources

Plan your next pentest around your launch

Guardian scopes each test from what you run, by roles, endpoints and accounts, and closes every pentest with a retest.

Talk to Guardian Book a system review