A traditional penetration test takes about two to six weeks from signed contract to final report. Schellman puts a small external test at about two weeks and an average scope at four to five weeks, and Triaxiom Security describes a typical project as four to six weeks, of which active testing is one to two. Most of that time is scheduling and report writing, not testing. CodeAnt AI delivers a full pentest report within 48 hours, with every critical finding confirmed by a security researcher, so the time left on your calendar is the time your team needs to fix and retest. It fits security and engineering leads who owe an auditor, an enterprise customer or an investor a pentest report by a fixed date.
CodeAnt AI has run 12,000 pentests and is trusted by more than 1,000 companies, including Fortune 500 companies like NRG, cybersecurity leaders like Commvault, and fast-growing companies like 11x and Sanas.
Buyers rarely ask how many hours of testing they are buying. They ask whether the report will be ready before the audit, the customer review or the funding round closes. This guide answers that: how long each phase takes, what published turnarounds from six providers actually measure, and how to plan backward from your deadline.
How Long Does Each Phase of a Penetration Test take?
NIST's guide to security testing (SP 800-115) splits a penetration test into four phases: planning, discovery, attack and reporting, with reporting running alongside the other three. NIST also calls penetration testing labor-intensive work that requires great expertise, which is why a traditional engagement is booked in weeks. Here is where the calendar time goes, with published figures for a traditional engagement next to an AI-led pentest.
Phase | Traditional engagement (published figures) | AI-led pentest at CodeAnt AI | What sets the pace |
|---|---|---|---|
Scoping and scheduling | 2 to 3 weeks: contract, deposit, scheduling testers, rules of engagement (Triaxiom) | Scope agreed and access confirmed; a black box test needs only your domain | How fast contracts are signed, and whether test accounts and login access are ready |
Active testing | 1 to 2 weeks (Triaxiom); about 1 week for roughly 20 external hosts (Schellman) | Testing and full report within 48 hours | Number of apps, APIs, networks and user roles in scope |
Report writing and QA | About 1 week (Schellman; Triaxiom) | Delivered inside the same 48 hours | The vendor's review process |
Fixes | Your engineers | Your engineers | How many findings, how severe, and your release process |
Retest and final report | Set by each contract | The same attack rerun after every fix | How quickly fixes ship |
The first three rows are the vendor's time. The last two are yours, and no vendor can shorten them for you. For a team that fixes quickly, the fix and retest loop can be the shortest part of the project; for a team in a release freeze or a holiday week, it is often the longest.
How Long Do Pentest Providers Say a Test Takes?
Providers quote different clocks. Some time the start of testing, some the testing window, some the report. The table shows what each one publishes and what that number covers.
Provider | Model | Published timing | What the timing covers | Retests | Best for | Main tradeoff |
|---|---|---|---|---|---|---|
AI-led pentest that proves what is exploitable; researchers confirm every critical finding; black, grey and white box across web apps, APIs, cloud, Kubernetes, Active Directory and networks | Full report within 48 hours | Testing and the full report | The same attack rerun after every fix | Teams with an audit, customer or investor date | Grey and white box tests need test accounts or code access ready before the start | |
On-demand white-box web application pentest | Same-day report; no lead times | The report for one test | Unlimited retesting | One web application with its code repository connected | Covers white-box web applications only | |
Autonomous testing directed and supervised by Cobalt pentesters | Delivered in 24 hours; launch in minutes | The complete autonomous pentest | Not stated for this tier | Fast coverage between human-led tests | Does not produce compliance attestation reports, by Cobalt's own statement | |
Human-led pentest bought with credits (1 credit = 8 hours of testing) | Starts in 3, 2 or 1 business days, by tier | The start of testing; testing and report length not published | Unlimited on-demand retesting during the contract | Teams that want human-led tests with a fast start | No published testing or report duration to plan against | |
Human-led pentest delivered on a platform | Launch in 24 to 48 hours; testing takes a few days to a couple of weeks | The start, then the testing window; report time not stated | One free manual retest | Human-led testing that can start quickly | 24 to 48 hours is the start, not the report | |
Sara pentest (coverage tier), plus SynackST and longer tiers | Sara: 4 to 5 business day window; SynackST: 5 day window | The assessment window | Patch verification listed on every tier; retest requests tied to the separately sold platform | Teams that want Synack's researcher community | Sara's report is a "comprehensive report"; the compliance-ready report starts with SynackST (from $10,283) | |
Schellman | Human-led testing firm | About 2 weeks for a small external scope; 4 to 5 weeks for an average scope; up to 15 weeks for large ones | Testing plus about a week of report writing and QA | Not stated on the page cited | Large or multi-part scopes such as apps, networks and phishing together | Weeks, not days |
Provider terms checked on each provider's own site on November 6, 2026. Prices and terms change; confirm them before you buy.
For a side-by-side of report times, prices and compliance mapping, see our comparison of pentesting vendors with 48-hour delivery.
What Makes a Penetration Test Take Longer?
Testing hours are rarely what pushes a pentest past a deadline. These are:
Access that is not ready. A black box test needs only your domain, because the tester discovers your exposed surface the way an attacker would. A grey box test needs working test accounts, ideally at the lowest privilege level, and a way past MFA or SSO. A white box test needs access to your code repository or cloud account. A login step the tester cannot pass delays the start.
Scope. More applications, APIs, networks and user roles mean more to test. Schellman notes that its longest engagements combine several services, such as web apps, mobile apps and internal and external networks.
Production windows. If your systems scale down at weekends or you want testing outside business hours, agree the window before the start date.
Authorization. Every system in scope needs written permission, including assets hosted by a third party. Our pentest authorization letter template covers what to include.
Fixes. Remediation is your team's time, and a release freeze or a holiday week can double it.
The vendor's queue. Traditional firms schedule testers weeks ahead. Triaxiom's planning phase alone is two to three weeks.
Not sure which test type you need? See black box vs grey box vs white box penetration testing.
How Do You Fit a Pentest Before a SOC 2 Audit or Customer Deadline?
Plan backward from the date someone else needs your report:
Find the date. Ask your auditor, customer or investor when they need the report, which version they want (many ask only for the executive summary), and, for an audit, which period the test must fall in.
Subtract your fix time. Ask your engineers how long they need to fix high and critical findings, then add a buffer for release freezes and holidays.
Subtract test and report time. That is 48 hours at CodeAnt AI, or two to six weeks for a traditional engagement once scheduling and report writing are included.
Subtract setup. Agree the scope, sign the authorization, and have test accounts and login access ready on the first day.
Worked example: your auditor needs the final report on the 1st of the month, and your engineers need ten working days to fix what a test finds. With a 48-hour AI-led pentest, start about three weeks before the deadline: two days for the test and report, two weeks of fixes, and a few days of buffer for the retest and setup. With a traditional engagement of four to six weeks plus the same two weeks of fixes, you would need to sign roughly two months ahead.
If you test before every audit anyway, a continuous program removes most of this planning. See continuous vs annual pentesting and how compliance automation and penetration testing fit together for SOC 2.
Does a Faster Pentest Mean a Shallower One?
Not if the speed comes from removing waiting rather than removing testing. In a traditional engagement, much of the calendar is the queue before testers start and the week of report writing after they finish. In an AI-led pentest, agents work the attack surface continuously, chain issues into attack paths and prove what an attacker could actually reach, and security researchers confirm the critical findings before they reach you.
What speed does not change:
Your fix time. A faster report gets findings to your engineers sooner; it does not fix them.
Very large or unusual scopes. Red team exercises and multi-part engagements still run for weeks with any provider.
What your reviewer accepts. Ask your auditor or customer which report they need before you buy, and check the provider's own terms. Cobalt states its Autonomous Pentest does not produce compliance attestation reports; Synack's compliance-ready report starts with its SynackST tier. CodeAnt AI's report is ready for SOC 2 and ISO 27001.
For what auditors look for in a pentest, see our guide to SOC 2 penetration testing requirements.
How Does CodeAnt AI Deliver a Pentest in 48 Hours?
CodeAnt AI runs AI-led penetration tests and delivers the full report within 48 hours. CodeAnt AI has run 12,000 pentests and is trusted by more than 1,000 companies, including Fortune 500 companies like NRG, cybersecurity leaders like Commvault, and fast-growing companies like 11x and Sanas.
Scope: black, grey and white box testing for web apps, APIs, cloud, Kubernetes, Active Directory, and internal and external networks.
Testing: AI agents map your attack surface, chain issues into attack paths and prove what is exploitable. Security researchers confirm every critical finding before it reaches you.
Report: a SOC 2 and ISO 27001-ready report within 48 hours, with evidence and steps your engineers can rerun.
After the report: CodeAnt AI reruns the same attack after every fix, so you know the fix held.
Track record: SOC 2 Type II, named a Gartner Cool Vendor in 2026, CERT-In empanelled, and more than 100 published CVEs as a VulnCheck CNA partner, including CVE-2026-29000 in pac4j-jwt (CVSS 10.0) and CVE-2026-28292 in simple-git (CVSS 9.8).
Pricing: CodeAnt prices each pentest on the attack surface you have, and gives very generous pricing to fast-growing companies.
The tradeoff to plan for: a black box test needs only your domain, but grey and white box tests need test accounts or code access, and any MFA or SSO step must work for the tester before the 48 hours begin.
To book a test, go to codeant.ai/pentesting.
