Penetration testing cost calculator
Get a rough planning range for what a penetration test might cost in the UK before you talk to a firm. Choose the type of test, its scope, your organisation size and any compliance driver, and you will get a £ range with the assumptions behind it. All figures are estimates. Everything runs in your browser, so nothing you enter leaves this page.
Describe the engagement
Pick what best matches your test. The estimate updates as you go — nothing is sent anywhere.
What drives the cost of a penetration test
Pentest pricing looks opaque from the outside, but it comes down to a small number of factors. Understanding them helps you read a quote and spot when one firm has scoped the work differently from another.
Type of test
A short external network scan and a full red team engagement are worlds apart in effort. Web apps, APIs, mobile apps, internal networks, cloud reviews and adversary simulations each have their own typical length.
Scope and complexity
The number of hosts, applications, user roles, endpoints and integrations drives the day count more than anything else. In our estimates, a single brochure site is a couple of days and a multi-role platform with third-party integrations is a week or more.
Day rate and seniority
The calculator assumes a day rate of £600–£1,200. That band is our own planning assumption, not a surveyed or published rate. In general, senior specialists and accredited consultancies charge more than smaller or newer firms, so ask each firm for its rate.
Compliance and reporting
A test tied to PCI DSS, ISO 27001, SOC 2 or Cyber Essentials Plus usually needs a more formal report and evidence pack, which adds time on top of the hands-on testing.
Retesting and remediation checks
Many firms include a retest to confirm fixes, and some charge for it separately. It is worth asking what is included when you compare quotes.
Estimated day rate and engagement length
The calculator uses an estimated day rate of £600–£1,200 and the estimated engagement lengths below. Both are our own planning assumptions, not surveyed or published figures. Check them against real quotes.
| Test type | Typical length |
|---|---|
| Web application | 2–12 days |
| External network | 2–10 days |
| Internal network | 3–15 days |
| Mobile application | 3–12 days |
| API | 2–11 days |
| Cloud configuration review | 2–10 days |
| Wireless | 2–8 days |
| Red team | 8–30 days |
| Social engineering | 2–12 days |
Our own estimates of effort, spanning small to large scope, not measured engagement lengths. Compliance-driven engagements add roughly 0.5–2 days of reporting and evidence work in the model.
Penetration testing cost questions, answered
How much does a penetration test cost in the UK?
It depends entirely on the type of test and the scope. The calculator above gives a rough planning range from an estimated day rate and effort, based on the choices you make. A real quote always depends on the specifics, so ask firms for written quotes against the same scope.
How is the estimate calculated?
It multiplies an assumed day rate (£600–£1,200 per day, our own planning assumption) by an estimated number of testing days for the type and scope you choose, then adds a little for organisation size and any compliance-driven reporting. The result is shown as a deliberately wide range because real engagements vary. Both the day rate and the day counts are estimates, and the result is not a quote.
Why is the range so wide?
Because real costs vary widely. Two engagements described the same way can differ by several days once a firm sees the real scope, so the calculator shows the plausible low and high ends so you know what to expect before you talk to a firm.
What makes a penetration test more expensive?
Effort is the main driver: more hosts, more applications, more user roles and more integrations all mean more days. Beyond that, higher-seniority or CREST-accredited testers charge more, and compliance-driven tests (PCI DSS, ISO 27001, SOC 2) add reporting overhead. Red team and social engineering engagements are typically the most expensive because they run over weeks.
Is a cheaper penetration test worse?
Not necessarily, but be careful what you are comparing. A low price can mean a smaller scope, fewer testing days, a more junior tester, or an automated scan dressed up as a manual test. When you compare quotes, look at the number of days, the seniority and accreditation of the testers, and whether a retest is included — not just the headline figure.
How to use the range when you ask for quotes
- Use it to set a budget line, then ask each firm for a written quote against the same scope. The range is an estimate, not a quote.
- Compare days, not just price. Two quotes for the same total can hide very different amounts of hands-on testing.
- If a quote is far outside the range, ask what is different: scope, tester seniority, retest, or reporting for a compliance driver.
The scope you describe is what moves the number most. The list of what to send for a quote shows what firms need, and the penetration testing cost guide covers pricing in more depth.
Related tools and guides
Ready to get real quotes?
A rough range helps you plan. Only a written quote tells you what it will actually cost. Browse UK penetration testing companies in our directory, then contact the firms you like.
Browse firms