UK directory
API penetration testing companies
API penetration testing targets the authentication, authorisation, and data-handling of the APIs behind modern applications, mapped to the OWASP API Security Top 10. The providers below explicitly offer dedicated API testing — a narrower field than general web testing.
How this list is compiled
Every firm below explicitly offers api penetration testing and is listed from public records with its accreditations linked. Use the full directory to combine this with accreditation and size filters.
PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.
5 companies
Claranet Cyber Security
Large (201–1000)
Cyber security division of Claranet providing CREST-accredited penetration testing, application testing and managed security services.
Cognisys Group Ltd
Mid-size (51–200)
UK cyber security firm offering CREST-accredited penetration testing including web and mobile application testing.
edgescan (BCC Risk Advisory Ltd)
Large (201–1000)
Ireland-based provider (serving the UK) delivering CREST-accredited penetration testing and continuous vulnerability management via a PTaaS platform.
Pen Test Partners
Size not stated
UK consultancy offering CREST-accredited penetration testing across web, mobile, infrastructure and specialist areas such as maritime, automotive and aviation.
Pentest People
Leeds · Size not stated
Leeds-based consultancy delivering NCSC CHECK-assured penetration testing through its SecurePortal platform.
Frequently asked questions
- How is API penetration testing different from web testing?
- API penetration testing focuses on the machine-to-machine interfaces behind an application — REST, GraphQL, and similar — testing authentication, authorisation, and data exposure against the OWASP API Security Top 10, which differs from the browser-facing focus of general web testing.