How Much Does Penetration Testing Cost in the UK?

How UK pen testing is priced

Almost every UK provider prices in consultant days. A scoping call establishes the number of applications, user roles, IP ranges, cloud accounts or physical sites in scope, and that converts into a day count. Retesting after remediation is sometimes included and sometimes billed separately — always confirm.

Typical engagements start around two to three days for a small web application and rise to ten days or more for a complex platform with multiple roles, integrations and a large external estate. Red team engagements are longer still because they simulate a real, goal-oriented adversary over weeks.

Typical scopes and what they include

The scope you choose should follow your risk, not your budget. These are the engagements UK organisations buy most often.

• Web application test — authenticated testing per user role against the OWASP Top 10 and business logic flaws.
• External infrastructure test — internet-facing IP ranges, exposed services, VPN and mail gateways.
• Internal network test — assumed-breach testing of lateral movement, privilege escalation and Active Directory.
• Cloud configuration review — AWS, Azure or Google Cloud identity, storage and network posture.
• Mobile and API testing — iOS and Android clients plus the APIs behind them.
• Red team — objective-based, multi-vector simulation including phishing and physical access.

What pushes the price up

Cost is driven by attack surface and by how much human reasoning the target demands. A single-role brochure site is quick. A multi-tenant SaaS platform with role hierarchies, payment flows and third-party integrations is not.

• Number of distinct user roles and permission boundaries to test.
• Business logic complexity — payments, workflows, tenancy isolation.
• Size of external IP ranges and number of live services.
• Compliance-driven requirements such as CREST or CHECK-equivalent methodology and evidence.
• Out-of-hours or production-window testing.
• Retest and remediation support after the fixes are deployed.

Penetration test vs vulnerability scan

A vulnerability scan is automated, cheap and useful for continuous hygiene — it finds known missing patches and misconfigurations. A penetration test is manual, chains findings together and proves exploitability. Buyers who pay pen test prices for a scan report are the most common form of wasted security spend in the UK market.

A mature programme uses both: continuous scanning for coverage, and an annual or release-driven manual test for depth.

How to buy well

Treat the scoping call as part of the assessment. A provider who asks about your business logic, your tenancy model and your riskiest workflow is going to test better than one who asks only for a URL count.

• Ask for a redacted sample report and check whether findings include business impact, not just CVSS scores.
• Confirm who tests — the named consultant, their certifications and their experience with your stack.
• Confirm free retesting of remediated findings and how long the window lasts.
• Agree a debrief session for engineering, not just a PDF handover.
• Check whether the report is suitable for client, insurer or ISO 27001 evidence.

How often should you test?

Annual testing is the common baseline and is expected by most compliance frameworks. Test additionally after major architectural change, a new authentication model, a significant integration, or a migration to a new cloud provider. High-change SaaS teams increasingly move to a per-release or continuous testing model.

Frequently asked questions