Three to six weeks is the normal wait for a named consultant on a defined scope, and it stretches considerably in the months before common audit deadlines. Booking is not the same as being ready, so the practical answer is to reserve time early and finalise scope later. The NCSC’s guidance on engaging a testing provider makes the same point about planning the engagement rather than treating it as a purchase.
Why the calendar bunches
Testing demand is seasonal because compliance deadlines are. Certification cycles, financial year ends and customer audit rounds push large numbers of organisations to book in the same weeks, and the effect is worse in the run-up to March and to the end of the calendar year. Add the fact that most firms want testing finished before a release freeze and you get a pattern where the same fortnight is oversubscribed everywhere. Booking outside those windows costs nothing and gets you a better choice of consultant.
See also: Lifelike Artificial Flowers: The Ultimate Guide to Artificial Floral Décor for Corporate Spaces
What actually delays a start
Rarely the supplier. The common causes sit on the client side: test accounts that were promised and never created, an environment that is not finished, a third-party host whose permission has not been requested, or a scope that changes twice in the week before the work begins. Each of these costs days. A short readiness checklist agreed at booking removes most of them, covering credentials for every role, an allowlist entry for the tester’s addresses, a named technical contact and confirmation that the environment reflects production.
“The clients who get the most from us are the ones who book a slot in January for work in April and use the intervening time to get ready. The ones who ring us needing a test to start on Monday because a customer asked for one usually get a junior consultant somewhere or a rushed scope, and neither produces the report they wanted.”
William Fieldhouse, Director, Aardwolf Security Ltd
Building a programme rather than a purchase
Annual programmes solve the lead time problem. Agree the year’s testing in advance, with dates blocked in both diaries and scope confirmed a fortnight before each engagement. That gives you continuity of consultant, which improves the work because the tester already understands your environment, and it usually improves the price because the supplier can plan resource well ahead of time. It also removes the panic that follows a customer asking for a current test report when your last one is fourteen months old.
When you genuinely need something quickly
Emergencies happen, and suppliers keep some capacity for them. If a customer contract or an incident forces a short timeline, say so directly and be flexible about which consultant runs the work. Be ready to compromise on scope rather than depth, since testing a smaller area properly is worth more than a shallow pass across everything. Get in touch for a testing quote as soon as the requirement appears rather than once the paperwork is complete, because a good penetration testing company can usually hold a provisional slot while the details are agreed.
Frequently asked questions about booking testing
These questions come up when a testing programme is being planned for the year.
Can you book before the environment is ready?
Yes, and agree a readiness date a week before the start so there is room to move if development slips. Suppliers would far rather reschedule with notice than send a consultant to an environment that does not work.
How far ahead should a retest be booked?
At the same time as the original engagement, allowing a realistic remediation window. Booking a retest for three weeks after a report lands is optimistic in most development teams.
