How Much Does a Penetration Test Cost? UK Prices 2026

A UK penetration test typically costs between £1,500 and £15,000 depending on scope. A small web application test usually lands at £1,500 to £4,000, external infrastructure at £2,000 to £6,000, and larger or internal engagements at £5,000 to £15,000 or more. CREST-accredited day rates run £800 to £1,200, so the figure that actually decides your bill is the number of days, not the rate.

Price ranges by test type

These are realistic UK market ranges for 2026, for manual testing by a qualified tester with a written report and a re-test. They are not our quote for your job, because that depends on scope, but they are the numbers to sanity-check any quote against.

UK penetration testing price ranges, 2026
Test type	Typical days	Typical UK price
Small web application, 1 to 2 user roles	3 to 5	£1,500 to £4,000
Large web application, multiple roles, payments, API	8 to 15	£6,000 to £15,000
External infrastructure, up to ~64 live hosts	3 to 6	£2,000 to £6,000
Internal network, single site	5 to 10	£4,000 to £10,000
Cloud configuration review, single tenant	3 to 6	£2,500 to £6,000
Mobile application, one platform	5 to 8	£3,500 to £8,000
Segregation or firewall ruleset test	2 to 4	£1,500 to £4,000
AI or LLM application assessment	4 to 10	£3,000 to £10,000
Retest of previous findings	1 to 2	Often included; otherwise £600 to £2,000

Day rates, and why they matter less than you think

Almost every penetration test in the UK is priced the same way: a day rate multiplied by the number of days a competent tester needs.

Typical UK penetration testing day rates, 2026
Provider type	Day rate	What is in the number
Large consultancy	£1,000 to £1,500	Offices, account managers, a sales function, brand
Small or mid-size CREST provider	£800 to £1,200	Mostly the tester's time, limited overhead
Unaccredited or offshore	£250 to £500	Often an automated scan with a cover page

The spread in day rates largely reflects overhead rather than tester quality. A large consultancy funds offices, account managers and a sales team, and that is in the number. The tester doing your work may well be on the same certifications either way.

So when you compare quotes, the day rate is the smaller variable. The day count is where quotes genuinely diverge, sometimes by a factor of three for the same scope, and that is where your attention is best spent.

The seven things that actually move the number

1. User roles, the most understated driver

This is the single biggest cost driver on application testing and the one most often left out of a scoping form. Each additional role multiplies access-control testing, because every combination of who-can-reach-what has to be checked. An application with one user type and one with five are not remotely the same job. If a quote does not ask how many roles you have, it is a guess.

2. Distinct functionality, not page count

Two hundred near-identical product pages add almost nothing to a test. A payment flow, a file upload, a reporting engine and an admin console each add real days, because each is a genuinely different attack surface. Count features, not URLs.

3. Authenticated versus unauthenticated

Testing while logged in as each user type finds substantially more than looking at the front door, and it takes longer. For most applications, unauthenticated-only testing is poor value: you are paying for a test that misses the majority of the real risk.

4. How much information you give the tester

Grey-box testing, with credentials and documentation, finds more per day than black-box. Insisting on black-box means paying a skilled person to spend a day on reconnaissance that a real attacker would happily spend for free, and you get less security for the same money. There are good reasons to test black-box. "It is more realistic" usually is not one of them.

5. Live hosts and service diversity

On infrastructure testing, the number of IP addresses matters less than what is running on them. Thirty hosts running one hardened build is a faster job than eight hosts running eight different things.

6. Environment readiness

Credentials that do not work on day one, a test environment that falls over, or a staging system that has drifted from production all cost days. This is the most avoidable cost in the whole engagement, and it is entirely within your control.

7. What the report has to satisfy

A test whose report is going to a tender, an insurer or a regulator needs evidence of closure and often a formal retest. That is real work and it belongs in the quote. If your report is only for internal use, you may not need it.

Why a cheap test usually is not one

If a quote looks dramatically cheaper than everything else, it is usually one of three things: an automated vulnerability scan with a logo on the front, a genuine test scoped far too small to cover what you asked for, or unaccredited work that your buyer will reject.

Scans have their place. They find known, published vulnerabilities quickly and cheaply, and running one regularly is good practice. What they cannot do is chain findings together, exploit business logic, or reason about what your application is actually for. A pricing bug that lets a customer set their own discount will never appear in a scan report.

Buyers and insurers increasingly reject scan output presented as a penetration test. If you are buying a test because a contract requires one, check what the contract actually asks for before you buy on price. We have written more on what a low price really buys.

What to check before you accept any quote

Days, stated explicitly. If the quote does not say how many tester-days you are buying, you cannot compare it with anything.
Who holds the accreditation. If your contract names CREST, check the provider holds accreditation at company level, not just an individual with a CREST certification. The wording in proposals is sometimes deliberately blurred. Ours is verifiable on the CREST marketplace.
Whether a retest is included. Fixing findings without evidence of closure satisfies nobody.
Whether the report is written by the tester. Reports assembled by a delivery manager from tool output read exactly like it.
What happens if scope changes. You want to hear before the work is done, not on the invoice.

How we price it

We scope on a call rather than through a form, and quote a fixed price for the scope agreed. The scoping call is free. If a smaller scope genuinely covers what your buyer is asking for, we will tell you, because selling you fifteen days when eight would do is how providers lose clients on the second engagement.

We are a CREST-accredited provider at company level, and one of the first ten organisations worldwide accredited by CREST for AI-Enabled Penetration Testing. If you need the test in a hurry, see urgent penetration testing for what can and cannot be compressed.

Talk to us about testing

Tell us what you need looked at and we will tell you what the work actually involves, what it costs and when we can do it. CREST accredited, and the testing is done by the person you speak to.

Common questions

What is the cheapest a real penetration test can be?

Around £1,500 to £2,000 for a genuinely small, contained scope: a single simple web application with one user role, or a small external IP range. Below roughly £1,200 you are almost certainly buying an automated vulnerability scan rather than manual testing by a qualified tester. That may still be useful, but it is a different product and most buyers and insurers will not accept it in place of a test.

Why will nobody give me a price without a call?

Because the day count depends on things a form does not capture: how many user roles your application has, whether testing is authenticated, how much of your functionality is genuinely distinct, and what your buyer's requirement actually says. A provider who quotes a flat price sight unseen is either padding it heavily or planning to scope down later. A scoping call takes twenty minutes.

How many days should a small web application test be?

Three to five days for a single application with one or two user roles, tested authenticated, including reporting. Below three days there is not enough time to test authenticated functionality properly. Substantially above five days for a genuinely small application suggests the scope has been inflated, or that your application is less small than you think.

Does a CREST-accredited test cost more?

Yes, and the gap is real: CREST-accredited day rates run £800 to £1,200, against £250 to £500 for unaccredited or offshore work. What that buys is manual testing by an assessed tester and a report your buyer will accept. If your tender names CREST, an unaccredited test is worth nothing to you at any price, so the cheaper number is not a saving, it is a wasted spend.

Is a vulnerability scan the same as a penetration test?

No. A scan is automated and finds known, published issues. A penetration test is manual work by a qualified tester who chains findings together and exploits business logic that no scanner understands. Both are worth doing. Only one of them is what a contract means when it says penetration test.

Should a retest be included in the price?

It should be included or priced explicitly, not left ambiguous. If the report is going to a tender, an insurer or a regulator, you will need evidence that findings were closed, and that means a retest. We include retesting of your fixes and evidence of closure where it matters.

How much does an AI or LLM penetration test cost?

Typically £3,000 to £10,000, depending on whether you are testing the model interaction alone or the whole application around it: prompt injection, data leakage, excessive agency, tool use and the conventional application security underneath. See AI penetration testing for what a scope usually covers.

How often do we need to test?

Annually as a baseline, and after any significant change to what is exposed. Many contracts and insurers specify annual testing explicitly. If you release frequently, an annual test is a snapshot that is out of date within weeks, and a regular arrangement usually costs less per test than one-off engagements.

How much does a penetration test cost in the UK?