How Much Does a Penetration Test Cost in the UK? What Drives the Price

“How much does a pen test cost?” is one of the first questions most organisations ask, and one of the hardest to answer in a single number. Two quotes for what sounds like the same test can differ by thousands of pounds, and it isn’t always obvious why.

The honest answer is that penetration testing cost depends almost entirely on scope, meaning what’s being tested, how deeply and by whom. This guide explains how penetration test pricing works in the UK, what drives prices up or down, what published market rates look like, and how to compare quotes so you get a test that’s worth paying for.

The Short Answer

Most UK providers price penetration testing by the tester day. The total cost is the number of days needed to test your scope properly, multiplied by the provider’s day rate, plus anything extra such as retesting or specialist reporting.

As a reference point, Stingrai’s UK pricing analysis puts the median published UK day rate at around £1,000, with most rates falling between £800 and £1,200, based on public-sector rate cards on the government’s G-Cloud 14 framework. Qualysec’s CREST penetration testing cost guide, published in October 2026, gives a wider range of roughly £700 to £1,500 per day, depending on the provider and the type of testing.

In practice, that means a small, focused test might cost a few thousand pounds, while a large engagement covering several applications, networks and cloud environments can run well into five figures.

How Penetration Test Pricing Works

Even when a provider gives you a fixed price, it’s almost always built on an estimate of tester days. During scoping, the provider works out how long it will take to test your systems thoroughly, based on things like the number of IP addresses, the size and complexity of your applications, and the number of user roles that need testing.

This is why scoping matters so much, because a provider that quotes without asking detailed questions is either guessing, which means the price may change later, or planning to test less thoroughly than you might expect. Speaking to an experienced tester during scoping, instead of a salesperson, is the best way to get an accurate quote, which is one of the main benefits of consultant-led penetration testing.

What Drives Penetration Testing Cost

The size and complexity of the scope

The biggest factor by far is how much there is to test. An external test of a handful of internet-facing IP addresses is a relatively small job. A large web application with dozens of features, an API, several user roles and integrations with other systems takes much longer, because each part needs to be tested properly. Bespoke systems and unusual technologies usually take longer than common, well-understood platforms.

The type of test

Different types of test need different amounts of time and expertise. An external infrastructure test is usually one of the smaller engagements, while internal network testing, cloud assessments and web application penetration testing typically take longer. At the top end, red teaming exercises run over several weeks and involve planning, stealth and multiple attack paths, so they cost considerably more. Our guide to external vs internal penetration testing explains what each one covers.

The depth of testing and level of access

How much information and access the testers are given affects both the cost and the value of the test. In a black-box test, testers start with almost nothing, which is realistic but means a lot of time is spent on discovery. In a grey-box test, they’re given accounts and some background information, which lets them spend more of their time finding real vulnerabilities. Testing several user roles, such as customers, staff and administrators, adds time but is often where the most serious issues are found.

Accreditation and expertise

CREST-accredited providers and highly qualified testers often charge more than unaccredited providers, because accreditation involves ongoing assessment, quality processes and experienced staff. Specialist work, such as operational technology or schemes like CHECK for government systems, usually costs more again. We explain what accreditation gets you in our guides to CREST-accredited penetration testing and CREST vs CHECK.

Reporting and compliance requirements

A report written for a PCI DSS assessor, an ISO 27001 auditor or a SOC 2 audit may need specific sections, evidence and attestation letters, which can add a little time. Most good providers include clear reporting as standard, but check what you’ll actually receive before you sign.

Retesting

Retesting confirms that the vulnerabilities you’ve fixed are actually closed, and it’s increasingly expected by auditors and insurers. Some providers include a retest in the price, while others charge for it separately, so this is one of the most important things to check when comparing quotes. We explain why it matters in our post on retesting after fixing vulnerabilities.

Timing and logistics

Testing outside business hours to avoid disruption, tight deadlines that need several testers working at once, and on-site work for internal or physical testing can all affect the price.

What Published UK Penetration Testing Pricing Looks Like

Published price ranges vary a lot depending on who’s publishing them and how they define each type of test. Here’s how two UK-focused providers describe typical engagement costs in 2026:

Interestingly, the gap between these two sets of figures says more about scope than about price. One set describes relatively contained tests for smaller organisations, while the other assumes larger environments with more systems, roles and integrations. Neither is wrong, but neither can tell you what your test will cost. Treat them as rough benchmarks, and rely on a properly scoped quote for your own figure.

Why the Cheapest Pen Testing Cost Can Be Expensive

It’s tempting to pick the lowest quote, especially when the work is driven by a compliance requirement. But a very cheap penetration test is often cheap for a reason.

Some low-cost tests are largely automated scans with a report attached. They may satisfy a box on a form, but they’ll miss the issues that matter most, such as broken access controls and business logic flaws, and auditors and insurers can often tell the difference. Our guide to automated vs manual penetration testing explains why. Other cheap quotes simply allow too few days to test the scope properly, which means parts of your environment get a quick look instead of a thorough one.

Perhaps most importantly, a test that doesn’t find the real problems can leave you with false confidence, which is worse than knowing you have gaps. That’s the heart of the Pentest Trap, where organisations pay for a test every year without ever learning much from it.

How to Get More Value for the Same Budget

Getting good value isn’t the same as paying less. These are the steps that make the biggest difference:

• Focus the scope on your real risks: A cyber security risk assessment helps you spend testing days where they matter most, instead of spreading them thinly across everything.
• Be ready before testing starts: Having test accounts, access and the right contacts ready on day one avoids paying for days spent waiting.
• Plan over several years: Rotating the focus of your testing over two or three years, instead of testing the same things every year, lets you cover more of your environment without increasing your annual spend. Our guide to annual penetration testing covers how to plan the cycle.
• Fix the basics first: Patching, MFA and secure configuration are cheap to fix, and getting them right means your testers can spend their time on the harder problems.

And if budget is tight, remember that any pen test beats no pen test. A smaller, well-targeted test of your most important systems is far better than putting testing off until you can afford to test everything.

Penetration Testing Cost by Sector

The same pricing principles apply everywhere, but the systems involved and the regulations that apply vary by sector, and both affect what a sensible test costs.

Schools, colleges and academy trusts

Education budgets are tight, so the priority is getting the most from a limited number of testing days. Academy trusts can often keep costs down by testing a representative selection of schools alongside central systems, which we cover in what schools are actually paying for and on our education sector cyber security page.

Financial services

Financial firms tend to have larger scopes and stricter reporting needs, such as PCI DSS penetration testing for payment systems and testing that will satisfy the FCA or DORA. Our guide to what the FCA and DORA expect explains where testing fits.

Law firms and professional services

Testing usually focuses on email, document management, client portals and remote access. Most practices have fairly contained environments, although bespoke case management systems can add days, as we explain in penetration testing for law firms.

Healthcare

Healthcare organisations often rely on clinical systems that are hard to patch, so testing needs careful planning and findings sometimes need creative, affordable fixes. Our medical sector case study shows how this works in practice.

Manufacturing and operational technology

Operational technology testing usually costs more per day, because it needs specialist skills and careful planning to avoid disrupting live production. Our guides to OT penetration testing and manufacturing sector cyber security explain what’s involved.

SaaS and technology companies

For software companies, the product itself is the main focus, meaning web applications, APIs and cloud environments with several user roles, which typically take longer to test than infrastructure. If you’re preparing for SOC 2, timing matters too, as we cover in “Does SOC 2 require penetration testing?“

How to Compare Pen Test Quotes

When you have more than one pen test quote in front of you, these questions will help you compare them fairly:

• How many tester days does each quote include, and how were they calculated?
• What exactly is in scope, and is anything you expected missing?
• Is the testing mainly manual, and who will actually carry it out?
• Is a retest included, and what will the report contain?

If one quote is much cheaper than the others, the answer is almost always in one of those four areas.

Getting a Clear Quote from Fortifi

Fortifi is a CREST-accredited penetration testing company, and our UK penetration testing services cover networks, web applications, APIs, cloud environments, AI systems and red teaming. We focus on helping organisations get more from their testing budget, and we offer multi-year options for organisations that want to plan their testing over time.

Because we don’t do sales calls, you’ll speak directly to a cyber security expert who will scope the work properly and explain exactly what you’re paying for. Book a call with our team to get a quote.

Penetration Testing Cost FAQs

How much does a penetration test cost in the UK?

Most UK penetration tests are priced by the tester day, with published day rates typically falling between around £700 and £1,500. A small, focused test may cost a few thousand pounds, while larger engagements covering several applications or networks can cost tens of thousands. The only reliable way to know your cost is a properly scoped quote.

Why do pen testing cost quotes vary so much?

Quotes vary because providers estimate different numbers of tester days, define scope differently, and may or may not include manual testing, retesting and detailed reporting. Comparing what each quote actually includes usually explains the difference.

Is retesting included in the price?

It depends on the provider. Some include a retest of the vulnerabilities you’ve fixed as standard, while others charge for it separately. Since auditors and insurers often want evidence that fixes have been confirmed, check before you sign.

How long does a penetration test take?

Small tests can take a day or two of testing, while larger web application, internal network or cloud assessments often take a week or more. Red team exercises run over several weeks. Reporting is usually delivered shortly after testing ends.