If you’ve spent the last few weeks emailing your usual penetration testing provider, only to be told their calendar is full until January, you’re in very good company. Every autumn, many UK organisations realise at roughly the same time that their annual pen test still hasn’t happened, and they all start looking for a tester at once.
This article explains why Q4 gets so congested, why you may well get a better price by booking at a different time of year, and, perhaps most importantly, what you can realistically do if you need a pen test right now.
Why Everyone Wants Their Pen Test at the End of the Year
Most organisations commission penetration testing for one of two reasons. The first is proactive security, where you want to find and fix weaknesses before an attacker does, and the second is compliance, where an auditor, a certification body or a customer expects to see an annual pen test report.
That second group creates the Q4 rush, because frameworks such as ISO 27001, Cyber Essentials Plus and PCI DSS, along with supplier due diligence questionnaires from larger clients, typically ask for evidence of testing within a given year.
For many businesses, that year lines up with the calendar year, and pen testing tends to drift down the to-do list until the deadline suddenly looms. Our guide to which compliance standards require penetration testing explains what each framework actually expects.
Budgets play a part too, as some teams have money left in this year’s budget that needs to be committed before it disappears, so they add a pen test to the list in October or November. As a result, a huge volume of demand lands on testing providers in a fairly narrow window.
Why Your Provider Can’t Just Squeeze You In
From the outside, it can be frustrating to hear “we’re fully booked” from a supplier you’ve worked with for years. The reality is that penetration testing is delivered by skilled people, and there are only so many of them.
A typical engagement needs to be scoped, scheduled, tested and written up, which is why most reputable providers work to lead times of around four to six weeks. That means a request made in late November is already competing for December slots that were filled weeks ago, and December itself is shortened by the Christmas break. By the time many organisations start asking, the capacity simply isn’t there.
The Less Obvious Benefit of Booking Earlier
Interestingly, there’s a side to this that most buyers never consider. When a pen testing company has a calendar full of customers who need testing before the end of the year and are happy to pay full price, there’s little reason for that company to offer a discount. If you ask for a lower price in November, most providers will understandably say no.
Book your test during a quieter period, such as the summer months when calendars often have gaps, and the picture changes completely. Providers are far more likely to be flexible on price, because they would rather fill that time than leave a tester idle.
Crucially, this isn’t about haggling or cutting corners on the quality of the testing. It’s simply supply and demand, meaning that the same test, delivered by the same people, can cost less when fewer organisations are competing for it.
Booking earlier brings other advantages as well:
- You get to choose your dates, instead of taking whatever slot is left.
- You have time to fix the issues the test uncovers before your audit, instead of presenting your auditor with a fresh list of unresolved findings.
- You have room to think properly about scope, which often matters more than the timing itself.
When a test is rushed through in December, the scope tends to default to whatever was tested last year, which is usually an external and internal infrastructure test. We’ve written before about the Pentest Trap, where organisations end up testing the same things every year and never look at the areas that actually carry the most risk.
Booking early gives you the breathing space to ask whether a Microsoft 365 assessment, a stolen laptop assessment or a social engineering test would reduce your risk more than another run of the same infrastructure test. You can see our full range of assessments for more ideas.
What to Do If You Need a Pen Test Right Now
Knowing that next year could be easier is useful, but it doesn’t help much if your deadline is weeks away. If that’s where you are, there are several practical steps you can take.
Look beyond your current supplier
Many organisations chose their pen testing provider years ago and have never needed to look elsewhere, so finding a new one can feel daunting. If your incumbent says they can’t help, that doesn’t mean nobody can. Different penetration testing providers have different workloads, and smaller, more flexible teams can sometimes find space where larger firms can’t.
The most reliable starting point is to look for providers accredited by CREST or assured under the NCSC’s CHECK scheme. Both publish directories, which are the CREST Marketplace and the NCSC’s list of assured CHECK providers, giving you a shortlist of penetration testing companies in the UK that have been independently assessed, so you aren’t simply taking a stranger’s word for their competence. Our guides to CREST-accredited penetration testing and CREST vs CHECK explain the difference between the two.
Be clear about what you actually need
Before you approach anyone, take a moment to work out exactly what the test is for. If it’s for an audit, find out what your auditor needs to see. If it’s for a customer questionnaire, check the wording they’ve used. This matters because a good provider can sometimes be creative once they understand the real requirement.
For example, if your requirement is that testing takes place within the current year, it may be possible to begin the engagement in the final days of December and complete the remaining work in January. The report will reflect the actual dates testing took place, and whether that satisfies your requirement is up to your auditor.
Notably, it’s always better to ask them directly than to assume, because their answer may open up options you hadn’t considered. Our guide to what auditors want to see in a penetration test report covers what they usually look for.
Any reputable provider will be transparent about when testing happened and what was covered. If a supplier offers to misrepresent dates or results to help you meet a deadline, treat that as a serious warning sign.
Ask about out-of-hours testing
If getting the test done matters more than keeping costs down, ask if your provider can do some of the work outside normal office hours, such as evenings or weekends. This usually costs more, which fairly reflects the extra effort involved, but for some organisations the cost of missing an audit deadline or losing a contract is far higher.
Be cautious about AI pen testing as a quick fix
You’ve probably noticed a growing number of automated and AI-driven pen testing products, and it’s tempting to see them as a way around the capacity problem. They can be a useful, cost-effective addition to a wider testing programme, but if you’re testing for compliance, check with your auditor before relying on one.
PCI DSS, for instance, requires a qualified person to perform penetration testing, while other frameworks such as ISO 27001 are more open to interpretation. It would be frustrating to pay for an AI-led test only to have your auditor reject it. We look at this in more detail in which compliance standards will accept an AI pentest and automated vs manual penetration testing.
Planning Ahead for Next Year
Once your immediate deadline has passed, put a date in the diary for next year’s test straight away. Choosing a quieter period gives you better availability, more time to remediate findings and a much better chance of some flexibility on price.
Even pencilling in a provisional slot and getting an early pen test quote is likely to save you the same stressful search this time next year, and may even save you some money.
Our guides to annual penetration testing and how much a penetration test costs cover how to plan the cycle and what drives the price, and if your last test left findings you couldn’t fix in time, our guide on what to do if you can’t fix everything explains how to handle them before your next one.
How Fortifi Helps When You’re Stuck
Over the years, Fortifi has built a reputation for helping organisations when they’re stuck. Some of our longest-standing customers first came to us in exactly this situation, where their existing provider couldn’t help, and they needed a test delivered against a tight deadline.
One client came to us needing around 20 days of testing in December, having flagged the requirement only that month, and we found a way to make it work.
We approach these situations the same way we’d approach a problem in our own business. If you tell us you need a test completed by a certain date, we’ll look at every option available to us to make that happen, whether that’s reworking our schedule, bringing extra senior resource onto the engagement or exploring out-of-hours testing.
We can’t promise that every deadline is achievable, and we’ll always be honest with you about what is and isn’t possible, but we’ll do everything we can to get your test over the line.
If your current supplier has told you they’re full, book a call with our team. Even if we can’t fit you in this year, we’ll help you decide the best next step, and we’ll happily discuss booking next year’s test at a time that suits you better.
Booking a Pen Test FAQs
How far in advance should I book a penetration test?
Most reputable providers work to lead times of around four to six weeks, but that can stretch considerably in Q4. Booking two to three months ahead gives you the best choice of dates and leaves time to fix findings before any audit or renewal deadline.
When is the best time of year to book a pen test?
Quieter periods, such as the summer months, usually offer the best availability and the most flexibility on price. Avoiding the autumn rush also gives you time to remediate findings and think properly about scope.
Can a pen test that starts in December and finishes in January count for this year?
Possibly, but it depends on your auditor. The report will show the actual dates testing took place, so ask your auditor directly how they’ll treat a test that spans the year-end before you commit to that approach.
Should we switch to one of the other pen testing companies in the UK?
If your current provider can’t meet your deadline, or you’ve been receiving near-identical reports every year, it can be. Look for a CREST-accredited provider, and use the change as a chance to revisit your scope so the test reflects your current risks.