UK pricing guide
Penetration testing cost UK
Written and reviewed by the Cost of Compliance editorial teamLast reviewed: October 2026
A focused UK penetration test might cost £2,000 to £8,000 before VAT. A broader application and infrastructure engagement can cost £10,000 to £25,000 or more. The number of testing days matters more than the name of the test.
Typical UK day rates and test budgets
Published UK provider pricing suggests an indicative rate of about £800 to £1,500 per tester day. A quote may also cover planning, a written report and a retest. Compare what is included rather than multiplying a day rate alone.
| Test | Indicative days | Indicative cost before VAT |
|---|---|---|
| Focused web application | 3 to 6 | £2,500 to £9,000 |
| External infrastructure | 2 to 5 | £1,600 to £7,500 |
| Internal infrastructure | 5 to 10 | £4,000 to £15,000 |
These are planning ranges, not fixed tariffs. Multiple environments, unusual access controls, complex networks or an urgent deadline can take the price beyond the table. Confirm whether the quote includes report writing and one verification of fixes.
How scope drives the bill
A web application with one login and a few user roles takes fewer days than a platform with several roles, tenant boundaries, payment flows and APIs. Give the tester a list of applications, roles and important workflows. Ask whether the quote includes testing business logic as well as common technical weaknesses.
An external infrastructure test examines internet facing systems such as VPNs, servers and remote access. The number of addresses matters less than what is actually exposed. An internal test starts from a position inside your network and may examine identity permissions, access between systems and whether a compromise can spread. A larger estate needs more time.
What CREST accreditation changes
CREST accredits testing companies against standards for how they manage and deliver security testing. If your buyer or tender asks for a CREST accredited provider, confirm the firm holds the relevant accreditation for the service being quoted. It does not guarantee that every finding will be discovered, and CREST does not set a universal price.
Accredited providers may cost more, but the quote still depends on scope and tester time. Ask about the named testers, methodology, report format and retest terms. A cheap automated scan is not the same as a manual penetration test.
Worked budget for a small SaaS company
Suppose a small SaaS team wants its customer web application, two user roles and a limited public cloud perimeter tested. Allow four to six tester days for the application and one to three for the external perimeter. At £800 to £1,500 per day, that is roughly £4,000 to £13,500 before VAT for five to nine days. If a retest is billed separately, allow another £800 to £1,500 for one day. The resulting planning range is about £4,800 to £15,000 before VAT, or £5,760 to £18,000 with 20 percent VAT.
This example does not include an internal network test, major fixes or your engineers' time. Share the same written scope with several providers so their quotes are comparable. UK prices here are researched in pounds, not converted from the penetration testing calculator, which models a different market in dollars.
Is Cyber Essentials Plus a substitute?
No. The Plus assessment checks a sample of devices against the Cyber Essentials controls. A penetration test explores a defined application or network for weaknesses. Some buyers ask for both. Use the Cyber Essentials Plus cost calculator to estimate that separate UK certification budget.
Sources: Precursor Security pricing guide and CREST accreditation. Ranges are indicative and quotes vary by scope.