On this page
The four phases
- Scoping. Assets, roles, environments and rules of engagement are agreed under NDA. Clear scope is the biggest factor in speed.
- Testing. Experts test the application, API, network or cloud.
- Reporting. Findings are verified, written up with evidence and given fixes.
- Retest. Fixed findings are tested again and the report is updated.
Typical testing time by scope
- Web application
- About three to ten working days, depending on roles, tenants and complexity.
- API
- Three to ten working days depending on the number of endpoints and authorisation models.
- Mobile app
- Static and dynamic analysis plus the backend: usually longer than a web app of similar size.
- External network
- A few days for a small perimeter, longer for large estates.
- Internal network and Active Directory
- One to several weeks.
- Cloud configuration review
- A few days per account, depending on size.
- Red team
- Weeks, because the goal is stealth and persistence.
What speeds a test up
- Written scope with URLs, API specs and environments ready
- Test accounts for every role and at least two tenants
- A stable staging environment that matches production
- A named contact who can answer questions the same day
- No major releases during the test window
The 48-hour report
For a clearly scoped web application or API, Summit delivers the report in 48 hours, and retests fixes as part of the engagement. The speed comes from preparation and a team that tests every day, not from skipping steps. Findings are still verified by an expert; see what makes a VAPT report worth paying for. For types of tests, read types of penetration testing.
Have a deadline?
Tell us the audit or deal date and we will plan backwards from it. Request a quote.
Frequently asked questions
How long does a penetration test take?
A single web application or API typically needs three to ten working days of testing, a network a few days to several weeks, and a combined assessment longer. Reporting and retesting add time after testing ends.
Can a penetration test report be delivered in 48 hours?
For a clearly scoped web application or API, yes. Summit delivers an expert-verified VAPT report in 48 hours for scoped engagements, with a retest of fixes included. Larger scopes take longer.
What makes a pentest take longer?
More roles and tenants, larger API surface, complex business logic, mobile and backend together, internal networks, slow access to credentials and late scope changes.
How long does a retest take?
Usually one to three days, depending on how many findings were fixed.
Faisal Khan is a Director at Summit, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
