UK directory
API penetration testing companies
API penetration testing targets the authentication, authorisation, and data-handling of the APIs behind modern applications, mapped to the OWASP API Security Top 10. The providers below explicitly offer dedicated API testing — a narrower field than general web testing.
How this list is compiled
These firms are listed as providing api penetration testing based on public sources, such as their own websites. Check each firm's scope before you ask for a quote. Each listing links its sources. Use the full directory to combine this with accreditation and size filters.
PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.
5 companies
Claranet Cyber Security
Large (201–1000)
Cyber security division of Claranet providing CREST-accredited penetration testing, application testing and managed security services.
Cognisys Group Ltd
Mid-size (51–200)
UK cyber security firm offering CREST-accredited penetration testing including web and mobile application testing.
edgescan (BCC Risk Advisory Ltd)
Large (201–1000)
Ireland-based provider (serving the UK) delivering CREST-accredited penetration testing and continuous vulnerability management via a PTaaS platform.
Pen Test Partners
Size not stated
UK consultancy offering CREST-accredited penetration testing across web, mobile, infrastructure and specialist areas such as maritime, automotive and aviation.
WorkNest Secure (formerly Pentest People)
Size not stated
Penetration testing provider that traded as Pentest People until 2025 and is now part of WorkNest, listed under WorkNest on the NCSC CHECK register and the CREST Marketplace.
Frequently asked questions
- How is API penetration testing different from web testing?
- API penetration testing focuses on the machine-to-machine interfaces behind an application — REST, GraphQL, and similar — testing authentication, authorisation, and data exposure against the OWASP API Security Top 10, which differs from the browser-facing focus of general web testing.