October 18, 2026
How long does a penetration test take?
Most penetration tests of a web app, mobile app or AI feature take between one and five days of testing. A marketing site with a contact form and an admin login is a one-day job. A SaaS app with a few user roles and an API is usually three to five, and a large multi-tenant platform with many integrations can take up to ten. Testing usually starts two to four weeks after you book, and the report follows the testing. Once you’ve fixed things, the retest is shorter, and free.
We charge by the day, so the number of days is also the price. A three-day test costs three times the day rate, which is why it’s worth knowing how we get to the number.
What decides the number of days
We work it out with you on a short scoping call. The first thing we ask is how much there is to test: screens, pages and API endpoints. An app with 15 screens and 20 endpoints is a different job from one with 100 of each. Rough counts are fine.
The second is how many user roles there are, and this one adds more days than screens do. Every role gets tested against every other. Can a normal user reach admin pages? Can one customer see another customer’s data? Each extra role means every screen is checked again as that role.
The third is what’s behind the app. A mobile app is tested together with the API it talks to, because that’s where most mobile problems are. An AI feature that can call tools or read user data takes longer than a chatbot that only answers from help docs.
The last is what you can give us. Test accounts for each role and a ten-minute walkthrough of the app make the first morning useful instead of spent guessing. We don’t need source code, but testing goes faster and deeper with it if you’re happy to share.
Here are the sizes we quote most often.
| What you’ve built | Days |
|---|---|
| Marketing site with a contact form and an admin login | 1 |
| Customer support chatbot answering from your help docs | 1 to 2 |
| Single-platform mobile app with around 10 screens and a simple API | 2 to 3 |
| SaaS app with a few user roles and a REST API | 3 to 5 |
| iOS and Android app with accounts, payments and an API | 4 to 6 |
| AI agent that can take actions across several systems | 5 to 8 |
| Multi-tenant platform with a large API and third-party integrations | 6 to 10 |
These are typical sizes. Your quote comes after the call.
What doesn’t change the number
The number of problems we find. The days are fixed before we start, so a test that turns up twenty issues costs the same as one that turns up two. You get the full report either way, and the report is usually what the customer or auditor asked for in the first place.
What slows a test down
Test accounts arriving late is the usual one. If logins for each role turn up on day two, day one went on the public parts only.
The environment going down is the second. We’ll test a staging copy if you’d rather we didn’t touch production, but whichever it is needs to stay up for the agreed dates.
The third is scope growing during the test. It happens. Someone remembers a second API, or the mobile app turns out to have an admin build. We stop and tell you before it costs anything, and you decide whether to add days or keep the original scope.
The whole timeline
- Scoping call. Free, about 30 minutes. We send a fixed quote afterwards.
- Lead time. Usually two to four weeks, depending on what’s already booked. If your customer or auditor has a deadline, say so on the call and we’ll tell you whether it works.
- Testing. The agreed days, on the agreed dates.
- Report and walkthrough. The report follows the testing, then a call to go through it with your team.
- Fixes and retest. You fix things at your own pace. We retest and issue an updated report at no charge.
If you’d like a number for your app, tell us what you’ve built and we’ll come back with one after a short call. The pricing page has the day rate and more examples.