Penetration testing services in the UK cover seven scopes: web applications and APIs, mobile apps, external and internal networks, Active Directory, cloud environments, social engineering and red teaming, and UK buyers expect them from a CREST-accredited provider. Purchases are driven by ISO 27001, PCI DSS, DORA and NIS2 programs, by Cyber Essentials Plus holders who need deeper assurance, and by FCA and NHS supplier reviews. Typical 2026 pricing runs from £4,000 for a small web application to £90,000 for a red team engagement. This guide covers what each service includes, why CREST matters in procurement, what testing costs and how to buy.
The NCSC handled 204 nationally significant cyber incidents in the twelve months to August 2025, up 130 percent on the year before (NCSC Annual Review 2025), and UK procurement teams have responded by writing independent penetration testing and CREST accreditation into supplier onboarding.
What penetration testing services include for UK buyers
Penetration testing is sold by scope, and each scope tests a different control set.
Web application and API penetration testing
Penetration testers cover every user role, the APIs behind the application, authorization at object and function level, tenant boundaries and business logic, mapped to OWASP WSTG and ASVS with request and response evidence for every finding. Web application penetration testing is the scope most often covered by fixed pricing.
Mobile application penetration testing
iOS and Android apps tested against OWASP MASVS and MASTG, from binary analysis and runtime instrumentation to certificate pinning and local storage, with the backend API in the same engagement. See mobile application penetration testing.
External and internal network penetration testing
External testing starts from the public internet with no credentials; internal testing starts inside the LAN from an assumed-breach foothold and covers credential relay, privilege escalation and lateral movement. See internal and external network penetration testing.
Active Directory security assessment
The identity layer most ransomware incidents run through: domain configuration, ACLs, certificate services, trust relationships and the escalation paths from a standard user to domain administrator. See Active Directory security assessment.
Cloud penetration testing
AWS, Azure and Google Cloud environments tested as an attacker would approach them: IAM privilege escalation, cross-account trust abuse, exposed storage, Kubernetes and serverless compromise. See cloud penetration testing.
Social engineering
Phishing campaigns that measure how your people respond to realistic lures, and physical security assessments of offices and facilities. See phishing campaigns and physical security assessments.
Red teaming and adversary simulation
Full-scope, objective-based simulations aligned with MITRE ATT&CK and the threat-led principles of TIBER-EU and DORA, testing people, processes and technology without notice to the defending team. See red teaming and purple teaming.
Why CREST matters in UK procurement
CREST was founded in the United Kingdom in 2006 as a not-for-profit accreditation body for the security testing industry, and British procurement grew up around it. Firm-level accreditation is a company-level audit of a provider's methodology, quality processes, staff vetting and data handling, and it is the credential UK procurement teams screen for first, distinct from individual certifications such as CREST CRT.
As of August 2026, 202 of the 510 firm-level CREST Penetration Testing accreditations worldwide belong to UK-headquartered companies, according to the CREST Marketplace. NCSC CHECK approves providers to test HMG and public-sector systems and is not required for commercial work, while CBEST and CREST STAR-FS cover intelligence-led testing of systemically important financial institutions. Accreditations lapse, so verify a provider on the CREST Marketplace; the CREST-accredited penetration testing companies guide explains how.
The compliance and supplier drivers behind UK purchases
Seven drivers cover most of the UK market.
Driver | What it expects | What UK buyers usually commission |
|---|---|---|
Cyber Essentials Plus | A hands-on audit of five baseline controls on a sample of devices, without exploitation, so not a penetration test | A penetration test alongside the certificate |
ISO 27001:2022 | Technical vulnerability management (Annex A 8.8) and independent review, evidenced at audits | Annual test across the ISMS scope |
PCI DSS v4.0.1 | Requirement 11.4: internal and external testing at least every 12 months and after significant change | Web, API and network scopes plus segmentation testing |
DORA | Annual ICT testing for financial entities in scope, threat-led testing every three years for designated entities, applicable since January 2025 | Application, network and cloud testing; red team scopes for designated entities |
NIS2 | Vulnerability handling and testing for EU essential and important entities; the UK's Cyber Security and Resilience Bill is the domestic equivalent | Annual testing of the systems that deliver the regulated service |
FCA supplier reviews | Operational resilience rules and supplier due diligence that commonly require a current independent penetration test | A current report with remediation evidence and a retest |
NHS supplier reviews | The Data Security and Protection Toolkit and the Digital Technology Assessment Criteria ask for penetration testing evidence for patient-data systems | Testing of the systems that process patient data |
UK GDPR Article 32 adds a general obligation to regularly test technical measures. Penetration testing supports each program with the same evidence: a scoped report, per-finding proof, remediation status and a retest.
What a penetration test costs in the UK in 2026
The chart below shows typical 2026 UK ranges for the most common engagements, drawn from our ranking of the top UK penetration testing companies.
Figure 1: Typical 2026 UK penetration testing price ranges by engagement type, in GBP. Source: Stingrai 2026 UK pricing benchmarks.
What moves a quote between bands: authenticated roles and endpoint counts for applications, hosts and Active Directory depth for networks, account count and IAM complexity for cloud, and whether the scope runs under CHECK. See the global penetration testing cost guide and the red team engagement cost guide for detail.
Stingrai publishes fixed prices for exactly one web application and its APIs, listed in USD on the pricing page: an Autonomous Pentest by Snipe at USD 3,000 per assessment or USD 450 per month, and a Hybrid Pentest at USD 6,800 per assessment or USD 1,275 per month, with a No High or Critical Finding = Don't Pay guarantee on the Autonomous tier. Every other scope is quoted through the Get a Quote form, and the penetration testing cost calculator gives a scope-based estimate first.
How to scope and buy a penetration test in the UK
Start with the driver and the deadline. An ISO 27001 audit, a PCI assessment date, a DORA testing cycle or a customer questionnaire sets the scope and the calendar; work backward from the date the report must exist, leaving time for remediation and a retest.
Inventory the scope in the units providers price on. Roles and endpoints for applications, hosts and subnets for networks, accounts and identities for cloud, domains and forests for Active Directory; a one-page inventory turns a vague proposal into a fixed price.
Choose the approach and the cadence. Gray box testing, with credentials for each role, suits most UK compliance scopes; an annual one-time test satisfies most programs as written, and teams shipping weekly move to a continuous program that retests every significant release.
Ask what the Statement of Work contains. Methodology (PTES, OWASP, NIST SP 800-115), deliverables, a retest, remediation support and rules of engagement; a proposal without a retest is incomplete.
Verify the provider. Check firm-level CREST accreditation on the CREST Marketplace, require a CHECK provider only for HMG or public-sector scopes, read verified Clutch reviews and look for published research. The pentest and red team RFP question bank lists the questions to put in a tender.
Request the quote, then see the platform. Quotes are issued from a scoping form rather than on a call, so the numbers trace to the inventory you supplied; a demo call is where you review requirements and see how findings, retests and integrations work.
Where Stingrai fits for UK organizations
Stingrai delivers UK and wider EMEA engagements from its London office at 1 Coldbath Square, Farringdon, London EC1R 5HL, with headquarters in Toronto. Founded in 2021, Stingrai Inc holds firm-level CREST accreditation as a Penetration Testing service provider and the Top Clutch Cybersecurity Company United Kingdom 2026 award, is rated 5.0 out of 5.0 across 19 Clutch reviews, has published 18 CVEs and presents research at DEF CON and BSides. Its penetration testers hold CREST CRT, OSCP, OSWE, OSEP and OSCE3.
Engagements run through the Stingrai PTaaS platform, with findings as they are confirmed, Jira and GitHub integration, live chat with your penetration testers, a complimentary retest and free on-call remediation support. On the Hybrid tier, Snipe, Stingrai's autonomous AI agent for web application testing, hunts IDOR, broken authorization and business logic flaws while our penetration testers test alongside it throughout the engagement, directing its focus and extending the attack paths it surfaces. Stingrai delivers both annual one-time penetration tests and continuous programs.
The fixed prices above cover one web application and its APIs; everything else is quoted through the Get a Quote form. A 30-minute demo call with the founder reviews your requirements and shows the platform and Snipe; it is not a quoting step.
Frequently Asked Questions
How much does a penetration test cost in the UK?
UK penetration tests typically cost £4,000 to £12,000 for a small web application or single API, £12,000 to £30,000 for a mid-size SaaS or mobile application, £15,000 to £42,000 for a network test, £16,000 to £45,000 for cloud engagements and £30,000 to £90,000 for red team engagements in 2026, with annual continuous programs at £20,000 to £80,000. Stingrai publishes fixed USD prices for one web application and its APIs, from USD 3,000 per assessment, and quotes every other scope through its Get a Quote form.
Do UK organizations need a CREST-accredited penetration testing provider?
For most private-sector scopes, including ISO 27001 audits, PCI DSS, customer security reviews and FCA-regulated firms, a CREST-accredited provider is the standard UK procurement asks for. Firm-level accreditation audits the company's methodology, quality processes, staff vetting and data handling. It is distinct from individual tester certifications such as CREST CRT, and both should be verified on the CREST Marketplace.
What is the difference between CREST and NCSC CHECK?
CREST is an independent accreditation body that audits member companies and certifies individual testers for commercial work of any kind. NCSC CHECK is a UK government scheme that approves providers to test HMG, public-sector and critical national infrastructure systems. If an engagement does not touch government data, CHECK is not required and adds no assurance value over CREST.
Does Cyber Essentials Plus require a penetration test?
No. Cyber Essentials Plus is a hands-on technical audit of five baseline controls on a sample of devices. It does not attempt exploitation, privilege escalation, chaining or business-logic abuse, so it is not a penetration test and does not substitute for one. Most UK organizations hold it as a baseline and commission a penetration test as their assurance activity.
Which compliance programs does a penetration test support in the UK?
ISO 27001, PCI DSS, DORA and NIS2, plus the testing obligation in UK GDPR Article 32. PCI DSS v4.0.1 Requirement 11.4 mandates internal and external penetration testing at least every 12 months and after significant change, ISO 27001 auditors expect independent technical testing with documented remediation, DORA requires annual ICT testing with threat-led testing every three years for designated entities, and NIS2 expects vulnerability handling and testing. One well-scoped engagement serves all of them.
What do FCA and NHS supplier reviews expect from a penetration test?
FCA-regulated firms must manage operational resilience and third-party risk, so their supplier reviews commonly ask for a current independent penetration test from a CREST-accredited provider, with remediation evidence and a retest. NHS organizations and suppliers handling patient data are asked about penetration testing in the Data Security and Protection Toolkit and the Digital Technology Assessment Criteria. A scoped report with per-finding evidence, remediation status and a completion letter answers both.
Does Stingrai have an office in the UK?
Yes. Stingrai's UK office is at 1 Coldbath Square, Office One, Farringdon, London EC1R 5HL, with headquarters in Toronto, Canada, and UK and wider EMEA engagements are delivered from London. Most testing is performed remotely through the PTaaS platform; internal network, Wi-Fi and physical security assessments are delivered onsite across the UK or through remote access arranged during scoping.
How often should a UK organization run a penetration test?
At least annually and after any material change to applications, infrastructure or identity, which is the cadence UK assessors expect and PCI DSS requires. Teams that release frequently move to a continuous program that retests every significant release, and a provider should offer both annual one-time tests and continuous programs, with a retest in every engagement.
Related Reading
Ready to scope a penetration test in the UK?
Stingrai is a CREST-accredited penetration testing service provider with a London office, rated 5.0/5.0 across 19 Clutch reviews, with 18 published CVEs. Get a Quote, or book a 30-minute demo call with our founder to review your requirements and see the PTaaS platform and Snipe.
