Hiring guide
Penetration test lead time, and how to shorten it
Penetration test lead time is everything between sending a brief and the first day of testing. Buyers often plan for the testing window and forget this part. However, it is usually the longer of the two.
- Signed scope before testing
- Fixed price agreed in writing
- OWASP and PTES methods
What fills penetration test lead time
Several steps happen before testing: the reply to your brief, the scope, the contract, internal approvals and authorization. Each one is quick on its own. Together they add up.
So map them early. Then you can see which ones run in parallel and which ones wait.
A typical penetration test lead time
On the firm's side, the brief, scope and quote can take a few days. On your side, approvals and purchase orders often take longer.
Then authorization is signed, and testing can start. Because that signature is the trigger, everything else should be ready first.
| Step | Usual owner | What slows it |
|---|---|---|
| Reply to brief | Firm | An unclear brief |
| Scope and quote | Firm | Open questions |
| Contract review | Your legal team | Starting late |
| Purchase order | Your procurement | Long internal cycles |
| Authorization | System owners | Owners not told in advance |
Penetration test lead time plan
Tick what has already started.
Your result appears here as you tick, so you can see what is still open.
Shortening penetration test lead time
Send a clear brief with a deadline. Start the contract review as soon as you have a draft. Tell system owners in week one that they will need to sign.
In addition, ask procurement about purchase order lead times on day one. As a result, the slowest step starts first.
Third parties and lead time
Some hosting and cloud providers publish their own testing rules. If a provider needs notice, that notice period becomes part of your lead time.
So check each provider while the scope is drafted, not after it is signed.
When penetration test lead time cannot shrink
Sometimes a deadline is closer than the process allows. In that case, narrow the scope rather than skip steps. A smaller, signed test is better than a larger, unauthorized one.
Then plan the rest as a second engagement.
Our timing
Day 0 is the scope brief, day 1 the fixed quote and day 2 the signed authorization. Testing begins within 48 hours of authorization, and the report and debrief follow.
Full engagements run from $35,000 to $120,000, and the floor is $25,000. The bounded Focused Exposure Review starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. One fixed number is agreed after the scoping brief, and it never moves during the project. The method follows the Penetration Testing Execution Standard.
Penetration test lead time questions
What is a normal penetration test lead time?
It varies with your internal approvals. The firm's part can take only days.
What slows penetration test lead time most?
Late contract reviews and owners who were not told they must sign.
Can testing start before authorization?
No. The owner's signature is what makes testing lawful.
How do we cut penetration test lead time?
Start the slowest steps first and run the rest in parallel.
Related guides
Shorten your penetration test lead time
Send a brief with your deadline. We reply with a written scope and one fixed number, usually within one business day.
Get a fixed price