How long does an ethical hacking engagement take in India?
Key takeaways
- A single web application penetration test takes 2 to 3 weeks from kickoff to final report, with 1 to 2 weeks for the retest after fixes.
- A full external and internal assessment takes 4 to 6 weeks, and a red team engagement 6 to 10 weeks because it is paced by objectives rather than by tester-days.
- The retest is part of the engagement and not an extra, and delaying it by a month does not delay the report, it only delays closure.
- A 48-hour report on a complete web application is not a fast test, it is a sign that no manual testing took place.
- CERT-In requires qualifying incidents to be reported within 6 hours, so an incident discovered during testing must be escalated the same day rather than held for the report.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is the realistic calendar for a penetration test?
Week 1 is scoping, rules of engagement and test account provisioning, which is 3 to 5 working days of the tester's calendar and 1 to 2 days of yours. Week 2 is the hands-on testing window, typically 3 to 5 tester-days for a single web application across the distinct user roles. Week 3 is reporting, with the draft delivered for your engineers to read and the retest scheduled against the fixes. Then 1 to 2 weeks for the retest once the fixes are actually deployed. The reason the retest sits after the fixes is obvious but worth stating: retesting an unfixed system proves nothing and only generates a second report describing the same problem.
How long do bigger engagements take in India?
It scales with estate size and depth. A single mobile application: 2 to 3 weeks. An API penetration test with several authentication schemes and business-logic abuse: 3 to 4 weeks. A full external and internal network assessment with credentialed internal testing: 4 to 6 weeks. A red team assessment: 6 to 10 weeks, because it is paced by objectives and by how long you give detection and response a chance to notice. A CERT-In aligned incident report after a live incident is different again: the 6-hour notification window applies first, and the written report follows within 1 to 2 weeks of containment, with the full forensic report taking 3 to 6 weeks for a large estate. Give the retest its own calendar slot, because it is the step that gets squeezed.
What actually makes a schedule slip?
Five things, in the order they usually happen. Scope creep, where a new application is added mid-engagement without a change request, which is why scope should be frozen in the signed rules-of-engagement document. Late test accounts, because a tester waiting for role-specific credentials has nothing to test against, and role coverage is where the interesting findings live. Unavailable staging environments, which pushes everything onto production and slows the pace because of the change windows. Slow developer turnaround on the draft report, because the retest cannot be booked until the fixes exist. And the last one, which is the most common: waiting for the retest to be scheduled after the fixes are actually deployed, which nobody owns internally.
How can you keep the timeline to plan?
Five things you control. Name a single technical contact who can answer scope questions within hours rather than days, and who can provision test accounts. Freeze the scope in the signed rules-of-engagement document, and treat any addition as a change request with a day-count impact. Give a calendar date for the testing window, and honour it, because testers schedule around confirmed windows. Agree the report template and severity definitions before the first test, so the draft is not a formatting negotiation. And book the retest slot at the same time as the report delivery, with a placeholder, because an unbooked retest is the most reliable cause of an engagement that never closes and findings that never get marked fixed.
| Engagement | Typical duration | Common cause of delay |
|---|---|---|
| Single web application penetration test | 2-3 weeks plus 1-2 week retest | Late delivery of role-specific test accounts |
| Mobile application test | 2-3 weeks plus retest | Delayed access to the backend API environment |
| API and business-logic testing | 3-4 weeks plus retest | Undocumented API roles and rate-limit behaviour |
| External and internal network assessment | 4-6 weeks plus retest | Change windows on production networks |
| Red team assessment | 6-10 weeks | Objectives and detection tuning agreed too late |
| Incident report after a live breach | 6-hour notification, 1-2 week written report | Evidence preservation gaps in the first hours |
What are the frequently asked questions?
Get a straight answer on this
Send us your application count, the number of user roles and the deadline you are working to, and we will return a dated plan with the retest slot included.
Send us the details See pricing