The time taken to conduct a thorough VAPT is dependent on the nature of the systems that need to be assessed and tested, their complexities and the number of assets that must be tested.