What is the lead time for a pentest?

The duration of a pentest can vary based on several key factors. These include:

1. Project Scope: The size and complexity of the network or system being tested. Smaller web applications can be tested more quickly than extensive corporate networks with multiple applications and servers.
2. Type of Pentest: There are various types of pentests, including black box (where the tester has no prior knowledge of the infrastructure), white box (where the tester has full knowledge of the infrastructure), and grey box (where the tester has partial knowledge). Black box tests may take longer as the tester needs first to understand the infrastructure.
3. Depth of the Test: The thoroughness required for the test. A quick, superficial scan can be completed rapidly, while a detailed analysis of an application's or network's security will take significantly longer.
4. Number of Systems Involved: The number of servers, workstations, applications, and other devices that need testing.
5. Availability of Resources: The accessibility of internal and external resources, such as documentation and personnel, available to provide answers or support.
6. Complexity of the Environment: The sophistication of the security measures and the overall complexity of the IT environment. More complex environments demand more time for thorough testing.

Typically, a pentest can take from a few days to several weeks. For smaller projects, a turnaround time of 1-2 weeks is common, while larger and more complex projects may require 4-6 weeks or more.