Penetration Testing

How Much Does a Penetration Test Cost in the UK?

> query: penetration_test_cost_uk —— transparency: full —— hidden_fees: none<span class="cursor-blink">_</span>_

Hedgehog Security 12 March 2024 12 min read

What you should expect to pay — and what you get for it.

Penetration testing pricing in the UK is opaque. Most providers do not publish prices, and quotes can vary dramatically for what appears to be the same service. This makes it difficult for business owners to budget effectively or evaluate whether a quote is fair. This article provides transparent guidance on what penetration testing costs, what factors drive the price, and how to ensure you are paying for genuine security testing rather than an automated scan with a templated report.


Recommended

We found this during a real engagement.

Want to know if your environment has the same weakness? Book a free 30-minute scoping call.

Book a Scoping Call

UK penetration testing prices by type.

The following ranges reflect typical UK market pricing for professional, CREST-level penetration testing. Prices at the lower end of each range reflect smaller, simpler scopes; prices at the upper end reflect larger, more complex environments. These figures are guidance — your actual quote will depend on the specifics of your infrastructure.

Test Type Typical Duration Typical Cost Range
External Infrastructure 2–5 days £2,000 – £6,000
Web Application 3–10 days £3,000 – £12,000
Internal Infrastructure 3–7 days £3,000 – £9,000
Wireless Network 1–3 days £1,500 – £4,000
Social Engineering (Phishing) 2–5 days £2,000 – £6,000
Combined External + Web App 4–10 days £4,500 – £14,000
Combined External + Internal + Web App 7–15 days £7,000 – £20,000

Day Rate as a Benchmark

Most UK penetration testing providers charge between £800 and £1,500 per tester-day. The total cost is driven by the number of days required, which is determined by the scope. If a quote seems unusually cheap, calculate the implied day rate — if it falls below £600 per day, the provider is likely using junior testers, relying heavily on automated tools, or spending less time than the engagement requires.


The factors that make a test more or less expensive.

Understanding what affects the price helps you make informed decisions about scope and budget. Penetration testing is priced by effort — the more complex and extensive the engagement, the more days it requires, and the higher the cost.

Size of the Environment
More IP addresses, more web applications, more subnets, and more user roles all increase the testing effort. A web application with five pages and one user role takes far less time to test than one with fifty features, three user roles, and an API. Provide an accurate description of your environment during scoping to get an accurate quote.
Complexity
Complex business logic, custom authentication mechanisms, multi-step workflows, and integrated third-party systems all require more manual analysis. A simple brochure website is quick to test; a bespoke financial application with role-based access control and transaction processing takes significantly longer.
Testing Approach
Black box testing (no prior knowledge) requires more time for reconnaissance. White box testing (full documentation and access) enables deeper analysis but requires more time reviewing documentation and source code. Grey box testing typically offers the best balance of effort and value.
Provider Credentials
CREST-accredited providers with individually certified testers command higher day rates than unaccredited firms — but the quality of testing justifies the premium. A cheaper, unaccredited test that misses critical vulnerabilities provides no value at all.
Retesting
Some providers include retesting of critical and high findings in the base price. Others charge separately. Clarify this during scoping — retesting is essential to verify that remediation has been effective, and adding it as an afterthought can increase costs unexpectedly.

Why the cheapest quote is rarely the best value.

Penetration testing is a skilled, labour-intensive service. The quality of the test is directly proportional to the skill of the tester and the time they spend on your engagement. When a provider offers a significantly lower price than their competitors, one of three things is happening: they are spending less time, they are using less experienced testers, or they are relying on automated scanning rather than manual testing.

Price Bracket What You Typically Get
Below £1,500 for a 'full penetration test' Almost certainly an automated vulnerability scan with a branded report. No manual testing, no exploitation, no business logic analysis. The report will list scanner findings with generic remediation advice. You may receive a 'certificate' that has no industry recognition. This is not a penetration test — it is a scan marketed as one.
£2,000 – £6,000 for a focused engagement A genuine penetration test with a defined scope — typically external infrastructure or a single web application. Manual testing by a qualified tester, exploitation of discovered vulnerabilities, and a detailed report with evidence and remediation guidance. Appropriate for small to medium organisations with a focused scope.
£6,000 – £15,000 for a comprehensive assessment Multiple test types — external infrastructure, web application, and internal network — conducted by experienced, individually certified testers. Thorough manual testing, complex exploitation, and a detailed report suitable for compliance evidence. Appropriate for medium organisations or those with complex environments.
£15,000+ for enterprise or specialist testing Large-scale assessments covering extensive infrastructure, multiple applications, and specialist requirements such as red team operations, SCADA/OT testing, or mobile application assessments. Typically involves multiple testers working concurrently over several weeks.

The price of not testing.

When evaluating the cost of a penetration test, it is worth comparing it to the cost of the incidents it can prevent. A penetration test is a controlled, planned expenditure. A data breach is an uncontrolled, unplanned crisis.

Cost Comparison — Penetration Test vs Data Breach (UK)
── Penetration Test ────────────────────────────────────────
External + web app test: £4,000 – £8,000
Remediation effort (internal): £1,000 – £5,000
Retest: £500 – £1,500
Total planned spend: £5,500 – £14,500

── Data Breach (UK SME average) ───────────────────────────
Incident response & forensics: £5,000 – £30,000
Regulatory notification: £2,000 – £10,000
Legal fees: £5,000 – £50,000
ICO fine (if applicable): £0 – £17,500,000
Business interruption: £5,000 – £100,000+
Reputational damage: unquantifiable
Customer churn: unquantifiable
Total unplanned impact: £17,000 – £200,000+

How to get the best value from your budget.

If your budget is limited, prioritise rather than compromise on quality. A thorough test of your most critical systems is far more valuable than a superficial test of everything. Start with the highest-risk areas — typically external infrastructure and customer-facing web applications — and expand scope in subsequent years.

Budget Level Recommended Approach
Under £3,000 Focus on a single target — either an external infrastructure test or a web application test of your most critical application. Choose the one that poses the greatest risk if compromised. This provides a meaningful security baseline to build on.
£3,000 – £8,000 Combined external infrastructure and web application test. This covers your internet-facing attack surface comprehensively and is the most common starting point for small to medium UK businesses.
£8,000 – £15,000 Add internal infrastructure testing. This provides a complete picture of your security posture from both external and internal perspectives — the two most common attack vectors.
£15,000+ Full programme — external, internal, web application, social engineering, and wireless. Consider splitting this across the year for better coverage and easier budget management.

What to expect from the quoting process.

A reputable provider will not give you a fixed price without understanding your environment. Expect a scoping conversation — either by phone or video call — during which the provider asks about your infrastructure, applications, business objectives, and compliance requirements. This conversation typically takes 20 to 30 minutes and should be free of charge.

Following the scoping conversation, you should receive a written proposal that clearly states the scope, approach, duration, cost, what is included (such as retesting), and what is excluded. If a provider gives you a price without asking these questions, they are selling you a fixed package — not a tailored assessment.


No hidden fees. No surprises.

Our scoping consultations are free and our quotes are fixed-price — the price we quote is the price you pay. Retesting of critical and high findings is included in every engagement. We will explain exactly what your budget buys and help you prioritise if you need to.

Next Step

We found this during a real engagement.

Want to know if your environment has the same weakness? Book a free 30-minute scoping call.

Book a Scoping Call

Related Articles