Independent comparison
Best penetration testing companies in the UK
UK penetration testing providers, ordered by the number of accreditations we found on public records for each, never by who paid. Check each firm's profile for its sources.
How this list is compiled
There is no single “best” pentest firm — the right provider depends on your scope, sector, and compliance drivers. So rather than invent a ranking, we order this list by the number of accreditations we could find on public records (CREST Marketplace, the NCSC CHECK list, and certification registers).
Ordering is never influenced by payment. Featured placements, when they exist, are always labelled and sit outside the editorial order. Use the filters in the full directory to narrow by service, accreditation, and size.
PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.
52 companies
Claranet Cyber Security
Large (201–1000)
Cyber security division of Claranet providing CREST-accredited penetration testing, application testing and managed security services.
Pen Test Partners
Size not stated
UK consultancy offering CREST-accredited penetration testing across web, mobile, infrastructure and specialist areas such as maritime, automotive and aviation.
Cyberfort Limited
Large (201–1000)
UK cyber security group offering CREST-accredited penetration testing, incident response and secure hosting.
Cyberis Reply Ltd
Small (11–50)
UK consultancy (part of Reply) offering CREST-accredited penetration testing and financial-sector threat-led testing (STAR-FS).
Dionach Ltd
Mid-size (51–200)
UK consultancy offering CREST-accredited penetration testing, incident response and information security auditing.
MDSec Consulting Ltd
Mid-size (51–200)
UK consultancy specialising in CREST-accredited penetration testing and financial-sector threat-led testing (CBEST, GBEST, TIBER-EU).
Prism Infosec Ltd
Cheltenham · Small (11–50)
Cheltenham-based consultancy offering CREST-accredited penetration testing and financial-sector threat-led testing (STAR-FS).
SecQuest Information Security Ltd
Small (11–50)
UK information security consultancy providing CREST-accredited penetration testing and Cyber Essentials certification.
AmberWolf
Small (11–50)
UK offensive security firm offering CREST-accredited penetration testing and financial-sector threat-led testing (STAR-FS).
Avord Ltd
Small (11–50)
UK provider delivering CREST-accredited penetration testing through an online security-testing platform.
Bridewell
Large (201–1000)
UK cyber security consultancy offering CREST-accredited penetration testing, threat-led testing, managed detection and response.
Citation Cyber
Small (11–50)
UK cyber security provider offering CREST-accredited penetration testing and compliance services.
Closed Door Security Ltd
Small (11–50)
UK-based cyber security firm (with UAE and US offices) offering CREST-accredited penetration testing.
CNS Group (now part of Six Degrees)
Large (201–1000)
UK cyber security provider, now trading as CNS at Six Degrees, listed on the CREST Marketplace for penetration testing and on the NCSC CHECK register as 6 Degrees Holdings Ltd.
Cognisys Group Ltd
Mid-size (51–200)
UK cyber security firm offering CREST-accredited penetration testing including web and mobile application testing.
D2 Network Associates Ltd
Small (11–50)
UK IT and cyber security firm offering CREST-accredited penetration testing and managed security services.
IOActive Inc
Seattle · Large (201–1000)
Research-led security firm with a UK CREST-accredited entity offering penetration testing and hardware/embedded security assessment.
JUMPSEC Ltd
Small (11–50)
UK cyber security consultancy offering CREST-accredited penetration testing, threat-led testing and managed detection services.
NCC Group
Manchester · Enterprise (1000+)
UK-headquartered global cyber security firm providing CREST-accredited penetration testing, threat-led testing, incident response and threat intelligence.
ProCheckUp Ltd
Small (11–50)
Long-established UK consultancy offering CREST-accredited penetration testing, vulnerability assessment and incident response.
Rootshell Security Ltd
Mid-size (51–200)
UK firm providing CREST-accredited penetration testing alongside the Rootshell vulnerability-management platform.
Salus Digital Security Ltd (SalusCyber)
Cheltenham · Small (11–50)
Cheltenham-based cyber security firm offering CREST-accredited penetration testing.
Secarma Ltd
Small (11–50)
UK cyber security consultancy offering CREST-accredited penetration testing and vulnerability assessment.
UK Cyber Defence Ltd
Cambridge · Small (11–50)
Cambridge-based cyber security firm offering CREST-accredited penetration testing and managed security services.
2-sec Consulting
London · Small (11–50)
London-based consultancy offering CREST-accredited penetration testing, incident response and PCI compliance.
4ARMED Ltd
Boutique (1–10)
UK penetration testing firm holding CREST accreditation, known for cloud and application security testing.
Arcanum Cyber
Mid-size (51–200)
UK cyber security consultancy offering CREST-accredited penetration testing and security consultancy.
CovertSwarm
Mid-size (51–200)
UK offensive security firm offering CREST-accredited continuous red teaming and penetration testing on a subscription model.
CyberCrowd
Small (11–50)
UK information risk and cyber security provider offering CREST-accredited penetration testing.
Cyphere
Boutique (1–10)
UK penetration testing firm offering CREST-accredited infrastructure and web application testing and Cyber Essentials certification.
edgescan (BCC Risk Advisory Ltd)
Large (201–1000)
Ireland-based provider (serving the UK) delivering CREST-accredited penetration testing and continuous vulnerability management via a PTaaS platform.
Exosec Ltd
Boutique (1–10)
UK penetration testing firm holding CREST accreditation and Cyber Essentials Plus.
Fortbridge
Boutique (1–10)
UK boutique penetration testing firm holding CREST accreditation and Cyber Essentials Plus.
Intruder
Mid-size (51–200)
UK vulnerability-management and attack-surface monitoring platform with CREST-accredited vulnerability assessment and PTaaS offering.
Leo CybSec
Boutique (1–10)
UK cyber security consultancy holding CREST accreditation for penetration testing.
ONSecurity Technology Limited
Mid-size (51–200)
UK provider delivering CREST-accredited penetration testing through a subscription-based online platform.
Orange Cyberdefense
Large (201–1000)
UK arm of the international Orange Cyberdefense group offering CREST-accredited penetration testing and managed security.
Pentest Cyber
Boutique (1–10)
UK penetration testing firm holding CREST accreditation and Cyber Essentials Plus.
Reversec
Large (201–1000)
UK offensive security consultancy (formerly WithSecure Consulting) offering CREST-accredited penetration testing and threat-led testing (CBEST, GBEST, TIBER-EU).
Ruptura InfoSecurity
Small (11–50)
UK penetration testing provider holding CREST accreditation for penetration testing services.
The SecOps Group
Boutique (1–10)
UK security firm offering CREST-accredited penetration testing and security certification training.
Thomas Murray Cyber Limited
Small (11–50)
Cyber division of Thomas Murray offering CREST-accredited penetration testing and incident response.
Truststream Cybersecurity Limited
Large (201–1000)
Penetration testing firm listed on the CREST Marketplace as Truststream Cybersecurity Limited, part of SysGroup. CREST links to the SysGroup website.
WorkNest Secure (formerly Pentest People)
Size not stated
Penetration testing provider that traded as Pentest People until 2025 and is now part of WorkNest, listed under WorkNest on the NCSC CHECK register and the CREST Marketplace.
Blackfoot UK Ltd
Small (11–50)
UK cyber security and data protection consultancy holding CREST accreditation for penetration testing.
Cynance Consulting Ltd
Boutique (1–10)
UK consultancy offering CREST-accredited penetration testing and security risk management.
Foregenix Ltd
Large (201–1000)
UK-headquartered global firm offering CREST-accredited penetration testing, digital forensics and PCI compliance services.
Illume
Boutique (1–10)
UK cyber security specialist offering CREST-accredited penetration testing, social engineering, cloud reviews and wireless auditing.
Laneden Ltd
Boutique (1–10)
UK boutique security firm holding CREST accreditation for penetration testing.
Liora Security Solutions Limited
Boutique (1–10)
UK security firm holding CREST accreditation for penetration testing.
Mobius Binary Limited
Small (11–50)
UK security firm holding CREST accreditation for penetration testing.
Securious Limited
Exeter · Small (11–50)
Exeter-based cyber security firm holding CREST accreditation for penetration testing.
Frequently asked questions
- How do you decide which companies are "best"?
- We order firms by the accreditations we can verify against public records — CREST, NCSC CHECK, ISO 27001, and Cyber Essentials Plus — because those are the objective quality signals a buyer can check. We do not sell ranking positions, and we do not publish an opinion score for a firm we have not independently reviewed.
- What accreditation matters most for a UK penetration test?
- CREST accreditation is the most widely recognised mark of a competent UK testing provider, because member firms are assessed on methodology and quality assurance, and their testers hold individual certifications. If you are testing public-sector systems, look for NCSC CHECK status as well.
- Are these companies affiliated with PenTesting.org?
- No. We are an independent directory. We compile listings from public sources and are not affiliated with any of the firms listed, nor with CREST, the NCSC, or any accreditation body.
- How much does a penetration test cost?
- A typical UK penetration test ranges from a few thousand pounds for a focused web-application or external network test to tens of thousands for a large, multi-workstream engagement or red team. Cost is driven by scope, complexity, and the seniority of the testers.