How Much Does a Penetration Test Cost in the UK?

What drives the price

A penetration test is quoted on effort, and effort comes from scope:

• What's being tested. A single small web application is a very different job from a large estate of applications, cloud environments and internal networks.
• Size and complexity. Number of applications, hosts, user roles, APIs and integrations all add days.
• Depth. Authenticated testing (logging in as different user types) finds more than an unauthenticated look, but takes longer. Black-box, grey-box and white-box approaches cost differently.
• Re-test. A good engagement includes re-testing your fixes and issuing evidence — important if the report is for a tender or insurer.

As a rough guide, a small web-app test often lands around £1,500–£4,000, external infrastructure around £2,000–£6,000, and larger or internal engagements £5,000–£15,000 or more. CREST-accredited day rates are typically £600–£1,200.

Why a cheap ‘test’ usually isn't one

If a quote looks suspiciously cheap, it's often an automated vulnerability scan with a logo on the front. Scans have their place, but they miss business-logic flaws, chained attacks and anything requiring a human to think like an attacker — and buyers and insurers increasingly reject scan output presented as a penetration test. A real test is manual work by a qualified tester.

How we scope and price

We scope honestly against what you actually need and what your buyer is asking to see, then quote a fixed price — no padding, and no selling you a bigger engagement than the requirement calls for. If a smaller scope genuinely covers it, we'll say so.

Common questions