How long does a full VAPT engagement take?
Key takeaways
- A single-application VAPT runs 5 to 10 working days, and an internal network or Active Directory test runs 10 to 20 working days.
- Preparation, written authorisation and rules of engagement add 3 to 5 working days before any testing begins.
- The retest after remediation adds 2 to 4 working days, and at AAVETech it is included as standard rather than billed separately.
- A complete web application assessed and reported within 48 hours is a scan, not a manual penetration test.
- Scoping itself takes 1 to 2 working days, and the same window is enough to get a fixed price and a delivery date.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
How is the timeline broken down?
Five phases, each with its own duration. Scoping takes 1 to 2 working days and produces the written scope, the rules of engagement and the fixed price. Authorisation and access setup take 1 to 3 working days, because test accounts, whitelisted source IPs and cloud read-only roles have to be provisioned by someone on your side, and that is the most commonly underestimated phase. Active testing takes 3 to 12 working days depending on the estate. Reporting takes 2 to 3 working days, producing a technical report and a one-page executive summary. Retest takes 2 to 4 working days after your fixes go live, and lists every finding as closed, partial or open.
Why does a 48-hour web application test not exist?
Because the work required is not linear in the number of tools. An unauthenticated sweep of endpoints takes a day. Establishing a base of test accounts for six roles, logging in as each, testing every object each role should not reach, then testing business logic such as payment flow, coupon abuse and refund manipulation, takes at least three days on a moderate application, and that is before the reporting. A 48-hour report on a complete application is a scanner output with a cover page. The useful test is the one that logs in, chains the small findings, and tells you which two of them together make a full compromise.
What makes an engagement take longer than quoted?
Three things, and you can prevent all of them. First, late access. If test accounts, API keys or whitelisted source IPs are not ready on day one, testing idles and the calendar slips, so agree an access date in the scope and treat it as a milestone. Second, expanding scope, which happens when the tester finds an interesting path into a system you did not list. Handling that properly means a written scope change with a price and a date, not a quiet extension. Third, slow remediation on your side, which does not extend the test but does extend the time before the retest and before you can close the finding. Most Indian firms see the whole cycle, test through report through retest, take two to three weeks.
Is a longer engagement automatically better?
No. A ten-day test on the right assets beats a thirty-day test spread over everything you own, because a broad engagement dilutes the tester days across low-value systems and leaves the crown-jewel application under-tested. Scope depth beats duration in almost every case. A useful rule for buyers is to fix the number of tester-days rather than the number of weeks, then let the tester propose the split. If the quote says ten days but does not say which application gets six of them, ask. And if the same firm quotes a longer timeline for a larger organisation, the variable driving the price is usually the number of roles and endpoints, not the size of the company.
| Phase | Duration | Owner | Output |
|---|---|---|---|
| Scoping and fixed-price quote | 1-2 working days | Both sides | Signed scope and rules of engagement |
| Authorisation and access provisioning | 1-3 working days | Client | Test accounts, source IPs, cloud roles |
| External and unauthenticated testing | 2-4 working days | Test team | Attack surface and exposure list |
| Authenticated and manual testing | 3-8 working days | Test team | Exploitable findings with repro steps |
| Reporting and executive summary | 2-3 working days | Test team | Technical report and one-page summary |
| Remediation by your team | Varies, often 1-3 weeks | Client | Fixes deployed to production |
| Retest of remediated findings | 2-4 working days | Test team | Closed, partial or open status per finding |
What are the frequently asked questions?
Get a straight answer on this
Send your application list, the number of user roles and your deadline, and we will confirm the tester-days, the delivery date and whether a compressed window is possible.
Send us the details See pricing