Penetration testing services: what you are buying
A guide to penetration testing in the UK — the main test types and what each covers, what to expect, what it costs, and how to find an accredited firm. Start with a guide, or jump straight to the directory.
Types of test
Web application penetration testing
Testing your website, portal or web app, and how to scope it.
Network penetration testing
Infrastructure, servers and firewalls, internal and external.
External penetration testing
Your internet-facing perimeter, from an outsider’s view.
Internal penetration testing
How far an attacker could get from inside your network.
Cloud penetration testing
Testing what you run on AWS, Azure or Google Cloud.
Mobile app penetration testing
Testing iOS and Android apps and the services behind them.
Vulnerability assessment vs penetration test
Which one you need, and why most organisations use both.
Compliance and certification
Cyber Essentials Plus
What the assessment checks, how to prepare and who can certify you.
PCI DSS penetration testing
What the card-data standard requires, and how often.
ISO 27001 penetration testing
Where a pen test fits in an ISO 27001 programme.
SOC 2 penetration testing
How a pen test supports a SOC 2 examination.
Cyber insurance and pen testing
What insurers ask about your security, and how testing helps.
Buying a test
How much does a pen test cost?
What drives the price, and how to compare quotes.
Cyber Essentials or a pen test?
Which one your customer, contract or insurer asked for.
How to choose a pen testing company
What to check, in order, before you pick a firm.
What to send a firm for a quote
The details a firm needs to quote accurately.
The penetration testing report
What good looks like, plus a free template.
Choosing a provider
The NCSC’s penetration testing guidance describes a good engagement as scoping, testing, reporting with severity ratings, and follow-up. Ask every firm how it handles each stage. CREST’s guide to penetration testing suggests looking for accreditation, since accredited firms have signed up to an independent code of conduct and had their processes vetted. Public sector buyers should also read the NCSC’s CHECK guidance.
Find a firm
Ready to compare? The UK penetration testing companies directory lists firms with each listing linked to its public source:
Full directory
Filter every listed UK firm by service and accreditation.
Best UK companies
The most-accredited firms, ranked from public records.
CREST-accredited
Firms with CREST accreditation on their public profile.
Web application testing firms
Firms offering web-app penetration testing.
API testing firms
Firms offering API penetration testing.
Free tools
Practitioner and buyer tools that run entirely in your browser — including a cost estimator, a CVSS 4.0 calculator, and more in the tools library. The buyer toolkit has free scoping and request-for-quote templates, a report checklist and the questions to ask each firm.
Sources
Frequently asked
What are the main types of penetration testing?
The common types are network (external and internal), web application, API, mobile application, cloud, and wireless testing, plus red teaming and social engineering. Which you need depends on what you build and run and what you must protect.
Which penetration test do I need?
Start from what you are protecting and why. A public web app points to web-application testing; internet-facing infrastructure points to external network testing; a compliance obligation (PCI DSS, ISO 27001, SOC 2, Cyber Essentials Plus) often dictates the scope. Many organisations combine several.
How do I choose a firm?
Compare firms on relevant accreditation (such as CREST), demonstrable methodology, report quality, and experience with your type of environment and any compliance driver. Our directory lets you filter UK firms by service and accreditation from public records.
Compare UK penetration testing companies
Filter firms by service and accreditation, then contact the ones you like.
Browse the directory