Penetration Testing
Most people buying a penetration test haven’t bought one before. The government’s Cyber Security Breaches Survey 2025/26 found 13% of UK businesses had done any pen testing in the past year. The rest find out how it works when a customer’s security questionnaire, an insurer or a tender asks for one, usually with a deadline attached.
These are the questions people ask us at that point. I’ve answered them as straight as I can, including where the answer doesn’t favour us. (If what you’ve been asked for is Cyber Essentials Plus, that’s a different thing: CE Plus isn’t a pen test explains why.)
How much does a penetration test cost in the UK?
A pen test is priced as a day rate times a number of days. In our experience, UK day rates mostly fall between £700 and £1,100, and ours is in the middle of that. Our days include writing the report, which some firms bill separately.
The days matter more than the rate. These are typical ranges, based on our own jobs and what we see across the industry, and what each costs with us:
| Test | Typical days | Typical cost with us |
|---|---|---|
| External infrastructure | 1 to 5 | £900 to £4,500 |
| Web application or API | 2 to 8 | £1,800 to £7,200 |
| Internal network | 3 to 10 | £2,700 to £9,000 |
| Build or configuration review (a laptop image, a cloud tenant) | 1 to 3 | £900 to £2,700 |
| Web app, API and mobile app together | 9 to 13 | £8,100 to £11,700 |
A small external test of one or two IP addresses sits at the bottom of its range. A web app with six user roles and an API sits near the top.
What moves the number is how much there is to test: how many user roles an app has, how many IP addresses are live, whether there’s an API behind the front end, and whether you want a retest. A day rate on its own tells you very little.
Why do quotes for the same job vary so much?
Because firms scope the days differently. One firm quotes four days for your web app because it assumed two user roles. Another quotes ten because it assumed six roles and an API. Neither is necessarily wrong, but you can’t compare them until you know what each one assumed.
The NCSC’s guidance on penetration testing says the scoping document should state the effort “usually given in terms of resource days”. Divide each quote by its day rate. If the day counts are far apart, ask each firm what the days are for. A firm that can’t explain its own day count probably didn’t scope it with any care.
How do I know I’m getting a real pen test and not a scan?
This is the fear we hear most, and it’s a fair one. A vulnerability scan is a tool checking for known issues. A pen test is a person trying to get further than the tool can: logging in as one customer and reading another’s records, or turning one weak password into control of the network.
Before you sign, ask about:
- The day count, and what a person does by hand on those days.
- A sample report, anonymised. The report is what you’re paying for, so see one before you buy.
- Who scoped the job: a certified pen tester who looked at what you need tested and set the days, or a salesperson working from a price list.
A day rate well under £500 is a warning sign. So is a report that lands the same afternoon testing ends, or findings that read like a list of scanner plugin names.
Does my pen test company need to be CREST accredited?
No law says so. CREST accredits companies, and you can check whether a firm is a member on CREST’s member list.
The person doing your test matters at least as much as the badge on the company. Good UK testers usually hold exams from one of two bodies. With CREST: CREST Registered Penetration Tester (CRT), then CREST Certified Tester in Infrastructure (CCT INF) or Application (CCT APP) for senior testers. With The Cyber Scheme: Cyber Scheme Team Member (CSTM), then Cyber Scheme Team Leader in Infrastructure (CSTL INF) or Web Application (CSTL Web App). The most senior testers may also be Chartered Cyber Security Professionals (ChCSP), registered with the UK Cyber Security Council in Security Testing. All of these belong to the person, not the firm, so ask who’s doing the testing and what they hold.
Public sector work is different. The NCSC runs the CHECK scheme for government and its guidance for buyers says: “If your organisation is not public sector, penetration testing does not need to be conducted by a CHECK service provider.”
What matters is what you’ve been asked for. If a customer contract or tender names CREST, you need a CREST member company, so check the wording before you buy anything. If it just says “an independent pen test”, it doesn’t.
How long does a pen test take, start to finish?
The testing days are only part of it, and the wait to start is often the longest bit. Two to four weeks from sign-off to the first day of testing is common. Ours runs like this:
- Scoping call, then a proposal within 24 hours.
- Testing starts within 7 days of you approving it.
- Testing takes the days in the quote, so 1 to 13 from the table above.
- The report arrives within 5 working days of testing ending.
- You fix what it found, then we retest. A retest within 30 days of the report is included.
- You get an updated report or a retest letter to send to whoever asked.
So for a single web app, plan on about three weeks from first call to report with us, and longer if you need the retest letter. If you’re up against a contract deadline, we can start a pen test within 24 hours.
What should the report include, and what will my customer want to see?
The NCSC says a report should include the security issues found, the level of risk each one poses, and “a method of resolving each issue found”. Ours opens with a plain-English summary for whoever signs off the budget, then each finding with its rating, the evidence and the fix.
If you want proof a person did the testing, look at whether the report joins findings up. Here’s an example in our report layout. It’s made up for this post, not taken from a client.
A scanner would list those as three separate findings, rated low to high. A tester notices that together they hand over every customer’s invoices, so the report rates them as one critical problem and says which fix breaks the chain.
Your customer probably doesn’t want the full report, which lists your weaknesses in detail. Most will take the executive summary, or a letter confirming what was tested, when, and that the serious findings were fixed and retested. Ask them which before the test starts, so the report is written with that in mind.
If you’d like to see a full redacted sample report, ask us for one.
Got a quote you’re not sure about?
Send us what your customer or insurer asked for, and the quote if you have one. We’ll tell you what we think the days should be, even if you don’t book with us.
