Penetration Testing Services UK

A penetration testing service is a scoped engagement in which a qualified tester, working with your written authorisation, attacks agreed targets such as web applications, APIs, networks or cloud accounts, proves which weaknesses can be exploited and reports each one with a severity rating and a fix. Some providers also sell testing as a subscription, known as penetration testing as a service (PTaaS), or combine it with scanning as VAPT.

Yes, when the owner of the systems authorises it in writing; testing without permission can be an offence under the Computer Misuse Act 1990, as our guide to what penetration testing is explains.

At least once a year, and after any significant change to your infrastructure or applications. PCI DSS requires annual internal and external testing and testing after significant changes, plus segmentation testing every six or twelve months depending on whether you are a service provider. See PCI DSS penetration testing for the detail.

Usually, yes. A scan is automated and finds known weaknesses. A penetration test is carried out by a skilled tester who verifies and exploits vulnerabilities, chains them together and tests business logic that scanners cannot. Most standards expect both, which is why we also offer vulnerability scanning services.

Most tests are priced by tester-days. In published pricing guides from UK providers we reviewed in September 2026, typical day rates were about £1,000 to £1,500, so the price mainly reflects how many days your scope needs. Our penetration testing cost guide breaks this down by test type, and the penetration testing quote form gets you a fixed price.

A small API or external test can take a few days; a typical web application around a week; mobile, hardware and red team work longer. We confirm testing dates, reporting and the retest window in the fixed-price proposal.

Black box starts with no inside knowledge, grey box gives the tester credentials and some documentation, and white box adds source code and architecture detail, which pairs well with a secure source code review. Our guide to black box vs white box penetration testing compares all three.

Every engagement includes written scoping and a fixed price, manual testing, a report with an executive summary and technical findings rated with CVSS and mapped to the standards you answer to, and a debrief call with your technical team. A retest of fixed findings can be scoped into your proposal.

For PCI DSS, yes: Requirement 11.4 requires internal and external penetration testing. ISO 27001 does not name it, but Annex A 8.8 and 8.29 make it the clearest evidence (see ISO 27001 penetration testing). Cyber Essentials Plus is a separate technical audit, not a penetration test.

We agree rules of engagement, testing windows and contacts before we start, avoid denial-of-service style testing unless requested, and can test in staging environments. Production testing is carried out carefully and with your approval.

Yes. A retest of remediated findings can be scoped into your proposal, and the updated report gives your auditor or customer evidence that issues have been closed.

We are a PCI SSC-approved QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and ISO 27001 certified. Testing follows published methodologies such as OWASP, PTES and NIST SP 800-115. If a contract or regulator names a specific testing scheme, tell us when you ask for a quote and we will confirm in writing whether we meet it.

Yes, where the work needs it. Our head office is in Accrington, Lancashire, about 20 miles from Manchester, so we cover cyber security and penetration testing in Manchester and the North West on site, and test remotely across the rest of the UK and abroad.