CREST Penetration Testing in the UK

CREST accredited penetration testing for UK organisations, from a provider you can verify in under a minute, delivered by the tester who writes the report.

If a UK contract, tender or insurance policy has told you to use a CREST accredited provider, this page explains what that actually requires, what the accreditation does and does not cover, how it relates to the NCSC CHECK scheme, and how to check that a provider holds the thing you have been asked for rather than something adjacent to it.

Solusec is a UK practice based in Shropshire, working with organisations across England, Scotland, Wales and Northern Ireland. We hold CREST accreditation at company level, the tester is CREST registered individually, and both are listed publicly on the CREST marketplace. We also hold the CREST AI-Enabled Penetration Testing accreditation. Scoping calls are free and the quote is fixed for the scope agreed.

What CREST actually is

CREST is a not-for-profit accreditation and certification body for the technical information security industry. It began in the UK and is where most UK commercial and public sector requirements point, though it now operates internationally, which is why checking the region and the legal entity matters when you verify a provider. It does two separate things that get conflated constantly, and the difference matters more than almost anything else on this page.

It accredits companies, by auditing how the organisation operates: its testing methodology, its reporting standards, how it handles your data, how engagements are managed, its insurance, and the competence of the people doing the work.

It certifies individuals, by examination, against a published syllabus at defined levels.

A requirement that says "CREST accredited" almost always means the first. A provider answering with the second has answered a different question.

The distinction almost every buyer misses

This is the single most useful thing to take from this page, so it gets stated plainly.

An individual can sit and pass a CREST examination while working for a company that holds no accreditation at all. That person is genuinely CREST qualified. Their employer is not CREST accredited. Both statements are true at once, and a proposal can be written so that a reader assumes the second from the first without the provider ever saying anything untrue.

The wording to watch for is the passive construction. "Our testing is carried out by CREST qualified consultants" tells you about people. "We are a CREST accredited company" tells you about the organisation, and is checkable. If a proposal only ever makes the first kind of claim, that is usually deliberate.

It cuts the other way too. A company can hold accreditation while the person assigned to your job holds a junior certification or none. Accreditation requires the company to manage competence, not to staff every engagement with its most qualified tester. Asking who specifically will do the work, and what they hold, is a fair question and a competent provider will answer it without fuss.

Book a free scoping call →

What a company accreditation actually audits

Company accreditation is not a certificate bought once and framed. It is an audit against the CREST Penetration Testing Accreditation Standard, repeated periodically, covering four broad areas:

• Organisational criteria. Legal standing, insurance, financial position, complaints handling, and a signed and enforceable Code of Conduct.
• The provider's own security. A testing company holds other people's vulnerabilities, credentials and network diagrams. How that data is stored, transmitted, retained and destroyed is examined, because a compromised tester is a route into every client they have.
• Discipline criteria. The documented testing methodology itself, and whether the work actually follows it.
• Engagement management. Scoping, authorisation, rules of engagement, reporting standards, and how findings are communicated and signed off.

That last point is worth dwelling on, because it is where most of the practical value sits. A great deal of what separates a good engagement from a bad one is process rather than technical skill: whether the scope was agreed in writing, whether authorisation was obtained from whoever actually owns the system, whether constraints were recorded rather than quietly worked around, and whether the report can be read by the person who asked for it.

The individual certification ladder

CREST certifies individuals by examination at three broad levels. Knowing the names is useful when you are reading a proposal.

• CREST Practitioner Security Analyst (CPSA). The entry-level examination, and a prerequisite for the next one.
• CREST Registered Penetration Tester (CRT). An intermediate, hands-on examination covering operating systems, common network services and web applications. CREST describes it as indicative of around three years of experience. It is scored in two sections, infrastructure and web application, and a candidate must pass both independently rather than averaging a weak section against a strong one.
• CREST Certified Tester, split by discipline. CCT INF for infrastructure and CCT APP for web applications. These are the senior examinations and are notably harder.

There are further certifications for simulated attack, incident response and threat intelligence, which are separate disciplines rather than steps on the same ladder.

What this means commercially: if a tender asks for a CREST Registered tester, CRT is the certification that answers it. If it asks for CREST Certified, that is a materially higher bar and a provider should not blur the two.

The CREST Defensible Penetration Test, and what your report should contain

CREST publishes a specification called the CREST Defensible Penetration Test, and it is the most useful document a buyer of testing can read. It exists because "we had a penetration test" is a claim that covers everything from a fortnight of expert work to a scan run overnight, and buyers had no shared definition to point at.

It sets minimum expectations across scoping, delivery and sign-off, and it is explicit that it does not certify an organisation as free of risk. Useful to know, because a certain amount of marketing implies otherwise.

On scoping

The buyer defines the goals and objectives, and those drive the scope rather than the other way round. A suitably skilled person maps the relevant attack surface, the two sides agree the scope together, and any expected deviations are documented up front. Scope can legitimately be broad or narrow. What it cannot be is undefined.

On delivery

The work follows the provider's accredited methodology, performed by a suitably skilled individual, covering everything in scope. Where a constraint prevents full coverage, that constraint is formally documented and carried into the report rather than left out of it.

On sign-off

A suitably qualified individual or a company officer formally attests that the test followed the accredited methodology and the agreed scope. CREST maps this to SFIA levels: scoping and delivery at level 4, sign-off at level 5. In plain terms, somebody senior puts their name to it.

What to look for in the report you receive

This is a checklist you can hold any provider to, including us:

• The stated goals, objectives and scope, including locations, exclusions and the coverage actually achieved.
• Full results and a timeline of key activities, with logs available on request.
• Enough detail for your own people to understand and reproduce each issue.
• A risk assessment for each vulnerability, with CVSS severity ratings.
• Remediation advice for each vulnerability, specific to your system.
• A statement of totality against the defined scope.
• The CREST IDs of the people who scoped and delivered the work, with evidence of their qualifications.
• CREST contact details for complaints and Code of Conduct queries.
• A unique reference for the engagement.

If a report you have been given is missing most of that, it is worth asking why before you hand it to a customer or an auditor who may well know the specification.

CREST accredits more than penetration testing

Accreditation is granted per discipline, not as a single badge, and this is where requirements and reality most often fail to meet. CREST accredits companies across penetration testing, vulnerability assessment, intelligence-led testing under STAR, threat intelligence, security operations centres, cyber security incident response, cyber incident exercising, and application security testing under CREST OVS, which aligns to the OWASP ASVS and MASVS standards. STAR-FS covers the financial sector, and CREST also underpins a number of government and regulator schemes.

So "CREST accredited" on its own is an incomplete statement. A company accredited for incident response is not thereby accredited for penetration testing. When you check a provider, check the discipline, not just the presence of a logo.

Solusec's accreditation is in penetration testing, and separately we hold the CREST AI-Enabled Penetration Testing accreditation. What that second one actually covers is worth reading if you are buying testing for a system with AI or LLM components, because the term is being used loosely in the market.

CREST, CHECK and the other schemes

Four names circulate and they are not interchangeable.

CREST is the commercial standard and the one most private sector contracts, tenders and insurers mean.

CHECK is an NCSC scheme for testing UK government systems and parts of critical national infrastructure. It requires security-cleared testers working for an NCSC-approved company. If a requirement genuinely says CHECK, CREST does not substitute for it.

The Cyber Scheme and Tigerscheme certify individual testers and are recognised routes to CHECK team member and team leader status. They certify people rather than companies.

Requirements written by people who are not security specialists frequently say CHECK when they mean an accredited independent test, and occasionally say CREST when the system genuinely falls under CHECK. Reading the actual wording takes minutes and sometimes changes the answer entirely. CREST versus CHECK covers the distinction in more detail.

We are open about where we sit: Solusec is not an NCSC CHECK provider and does not hold SC clearance. Where a requirement specifically demands either, we say so at the first conversation rather than let you waste a bid. Where it asks for an accredited independent test, which is far more common, CREST answers it.

How to verify a provider in two minutes

You do not have to take anybody's word for this, including ours.

1. Search the CREST marketplace. Every accredited member is listed at marketplace.crest.org with the disciplines they hold. If a company is not there, it is not accredited, whatever the website says.
2. Check the discipline matches. Confirm the listing covers penetration testing, not only an adjacent service.
3. Check the region. CREST operates internationally and accreditation is granted per entity. A group listing is not the same as the legal entity that will contract with you.
4. Ask for the CREST IDs of the individuals. The Defensible Penetration Test specification expects these in the report, so asking for them before you buy is entirely reasonable.
5. Ask who signs off. Sign-off sits at a higher competence level than delivery for a reason.

Ours is here, and every other accreditation we hold is published with the register it can be checked on.

What CREST accreditation does not tell you

Worth being straight about the limits, because overclaiming here is common.

It does not tell you the test was good. It tells you the company has an audited methodology and the processes to deliver against it. A competent, accredited provider can still deliver a thin engagement if the scope was wrong or the days were too few.

It does not tell you the price is fair. Accreditation is a floor, not a ceiling, and the day rate is driven far more by overhead than by competence. What a low price actually buys you covers that in detail.

It does not mean you are secure, and the specification says so itself. A test describes a defined set of systems at a point in time, using the access and days agreed.

And it is not a substitute for asking the ordinary questions: how many days, who is doing it, can I see a sample report, is retesting included. Accreditation makes those questions more likely to be answered honestly. It does not answer them for you.

When you actually need it

Three situations account for most of the demand, and in all three the requirement comes from somebody other than you.

Procurement. Public sector frameworks and enterprise supplier assurance programmes frequently mandate CREST accreditation outright, and an evaluator will check the marketplace rather than take the proposal's word for it.

Cyber insurance. Underwriters use accreditation to judge whether an engagement was carried out to an acceptable standard, both at renewal and, more pointedly, when assessing a claim. Testing for cyber insurance covers what they tend to ask for.

Demonstrating due diligence after an incident. "We used a CREST accredited provider" is a materially stronger position than "we used a consultant", and that difference is most visible at precisely the moment you would least like to be having the conversation.

If none of those apply and nobody has asked, accreditation still tells you something useful about how a provider operates, but it should not be the only thing you weigh.

Where we work in the UK

We are based at Albrighton in Shropshire and work with organisations across the UK: England, Scotland, Wales and Northern Ireland. Web application, API, cloud and external infrastructure testing is delivered remotely as standard, so location makes no difference to the work, the tester or the report.

Internal network testing is the exception. We either travel, with travel quoted as a separate line rather than folded into an inflated day rate, or ship a preconfigured device that connects back to us and gives the same internal position for considerably less. Across the West Midlands and Shropshire we charge no travel at all. Where we work sets out the detail, including the territories we cover beyond the UK.

How we work

You deal directly with the tester, from the scoping call through to the debrief. There is no account management layer, which matters most when something unexpected turns up mid-test and the sensible response is a phone call.

Scope and price are agreed in writing before anything starts, along with the authorisation and rules of engagement that make the testing lawful. The price is fixed for that scope, and if the scope changes materially we tell you before doing the work.

Retesting of remediated findings is included rather than sold to you afterwards, and the report is reissued, because a report full of open findings rarely satisfies whoever asked for it.

Typical lead time is two to three weeks from order. Where a date is immovable, fast and urgent options exist, and we would rather tell you early that a date is not achievable than take the booking.