Q: What's the average length of an external and internal penetration test?

A: The average external test is about 16-24 man hours, while the average internal test is 24-40 man hours. Factors that influence the external testing includes number of Internet-facing devices, the number of IP domains owned by the client and whether there is wireless or dial-in testing to be performed. Factors influencing the internal testing includes the number of servers, network users and remote locations.