How much does a penetration test cost?
What a penetration test costs in the UK, what moves the price up or down, and how to compare quotes without getting caught out. Use the free estimator below for a rough planning range, then ask matched firms for a quote.
Estimate your cost
The calculator below gives a rough planning range. The £600 to £1,200 day rate and the day counts are our own planning assumptions, not surveyed or published figures. Use it to sense-check a budget, not as a price. Real prices depend on the specifics of your scope.
Describe the engagement
Pick what best matches your test. The estimate updates as you go — nothing is sent anywhere.
What drives the price
Four things move a penetration testing quote more than anything else:
- Scope — the number of applications, external IPs, internal hosts, or user roles in the test. This is the dominant factor.
- Test type — a focused web-app test is quicker than a full internal network assessment or a red-team engagement.
- Depth — a light, largely automated scan costs far less than a manual, exploitation-led test, and buys far less assurance.
- Compliance — PCI DSS, ISO 27001, SOC 2, or Cyber Essentials Plus reporting adds documentation time.
Scope is set by what you need tested. A web application is usually priced on its user roles and functions; an external or internal test on the hosts and ranges in play; a cloud test on the accounts and services; and a mobile app test on the platforms and the API behind it.
How to compare quotes fairly
The most common mistake is comparing prices before comparing scopes. Ask every firm to state, in writing, exactly what is in and out of scope, how many days they have allocated, whether testing is manual or automated, who will do the work and what they are accredited to, and what the deliverable looks like. Two quotes are only comparable once those are equal.
For a test that an auditor or a customer will scrutinise, the firm's accreditation (for example CREST) and the clarity of the final report often matter more than the day rate. A cheap report that fails an audit is the most expensive option of all.
CREST’s buyer’s guide separates vulnerability assessment from penetration testing, and the difference shows up in price: a quote that is mostly automated scanning will be cheaper, and buys less. For public sector systems, the NCSC’s CHECK guidance explains when a CHECK provider is needed, which narrows the field.
Get quotes you can compare
The NCSC’s penetration testing guidance describes a typical engagement as scoping, testing, reporting and follow-up. Put all four in your request: what to test, how, what the report must contain and whether a retest is included. The free scoping template and RFQ template do this for you, so every firm quotes for the same job, and what to send for a quote explains each detail a firm asks for.
Next steps
Sources
Frequently asked
How much does a penetration test cost in the UK?
Penetration tests are commonly priced on a day rate. The rate varies with the firm, the seniority of the tester and accreditations such as CREST. Our calculator uses an estimated £600 to £1,200 a day and estimated day counts; both are our own planning assumptions, not surveyed or published figures. A small, focused test takes fewer days than a large network or red-team engagement, and the only reliable price is a written quote for your scope.
Why do quotes vary so much?
The biggest driver is scope — the number of applications, IP ranges, user roles, or endpoints in play — followed by the depth of testing and any compliance reporting required. Two quotes can differ widely simply because they assume different scopes, which is why a clear scope is the single most important thing to agree before comparing prices.
Is the cheapest quote the best value?
Not usually. A very low quote often reflects a lighter, more automated test or a smaller assumed scope. For a test that has to satisfy an auditor or a customer, the accreditation of the firm and the quality of the report matter more than the headline price.
Does compliance make it more expensive?
A little. Frameworks such as PCI DSS, ISO 27001, and SOC 2 add reporting and evidence-mapping work, which typically adds a small amount of time to an engagement. The testing itself is much the same; the overhead is in documenting it to the standard.
Find firms that fit your test
Answer a few questions about what needs testing and why, and see matched firms with a link to each one’s contact page.
Match with firms