Penetration testing in the UK is priced by effort: the number of tester-days needed, multiplied by the day rate, plus reporting and a retest. Per-IP pricing, per-app packages and PTaaS credits are just different ways of packaging that effort. Once you know what drives the number of days, UK quotes become much easier to compare.
UK penetration testing price ranges by test type
The table below multiplies typical effort by the common UK day-rate range of £750 to £1,500. It covers a single, clearly scoped engagement including a report and one retest. Treat these as planning figures, not quotes. Your scope is what sets the price.
| Test type | Typical effort | Indicative UK price (ex VAT) |
|---|---|---|
| Web application | 5–15 days | £3,750 – £22,500 |
| API (REST/GraphQL) | 4–12 days | £3,000 – £18,000 |
| Mobile app (iOS + Android) | 6–15 days | £4,500 – £22,500 |
| External network / perimeter | 2–8 days | £1,500 – £12,000 |
| Internal network / Active Directory | 5–20 days | £3,750 – £30,000 |
| Cloud (AWS/Azure/GCP, per account) | 5–20 days | £3,750 – £30,000 |
| Wireless (per site) | 2–5 days | £1,500 – £7,500 |
| Social engineering / phishing | 3–10 days | £2,250 – £15,000 |
| Red team / adversary simulation | 4–12 weeks | £25,000 – £120,000+ |
Published UK price lists tend to start at around £2,500 for a small external, API or wireless test, and around £3,750 for web, mobile or cloud work. Larger internal tests usually start at £6,000 or more. Quotes well below these levels usually mean less time or a mostly automated test.
Penetration testing vs Cyber Essentials costs
UK buyers often compare pentest quotes with Cyber Essentials, but the two do different jobs. Cyber Essentials is a self-assessment against five baseline controls, and IASME's published fee for it is a few hundred pounds plus VAT depending on organisation size. Cyber Essentials Plus adds a hands-on technical audit by a Certification Body, typically priced from around £1,500 to several thousand pounds depending on how many devices and sites are sampled. Neither is a penetration test. See Cyber Essentials vs penetration testing for how they fit together.
What drives the price of a UK penetration test
1. Scope and size
For applications, the main drivers are the number of user roles, screens, API endpoints and complex workflows such as payments, approvals and multi-tenant logic. For networks, it is the number of live hosts and the size of the Active Directory estate. For cloud, it is the number of accounts or subscriptions and the services in use.
2. Testing approach
Grey-box testing, where testers get accounts and documentation, usually finds the most for the same budget. A black-box test spends paid days on discovery your team could have shared in an email.
3. Accreditation and seniority
Providers holding CREST accreditation or NCSC CHECK status, and senior testers with qualifications such as CREST CCT, generally charge towards the upper end of the day-rate range. If your contract or a public-sector buyer requires an accredited provider, budget for it. If not, judge providers on evidence. Our CREST and CHECK guide explains the difference.
4. On-site work and timing
On-site days add travel and expenses, and out-of-hours or weekend testing windows often carry a premium. Many internal and wireless tests can now run remotely through a VPN or a small test device posted to your site, which avoids those costs.
5. Reporting requirements
Reports prepared for PCI DSS, ISO 27001 surveillance audits, NHS DSPT submissions or FCA-regulated firms may need extra evidence, attestation letters or specific methodology statements. Agree what you need at scoping.
6. VAT
UK-based providers normally add VAT at 20%. When a UK business buys services from a provider outside the UK, the reverse-charge rules usually apply instead. Ask your finance team how this affects you.
Pricing models you'll come across
- Fixed price per engagement: the most common model in the UK and the easiest to budget for, provided the scope is written precisely.
- Day rate (time and materials): common for red teams and complex or changing environments.
- PTaaS subscriptions or credits: suits frequent testing, but compare the depth of testing you get per credit.
- Framework call-offs: public-sector buyers often buy through procurement frameworks with pre-agreed rates.
How to cut cost without cutting quality
- Provide credentials and documentation so testers spend their days testing, not discovering.
- Get Cyber Essentials-level hygiene in place first. Patching and secure configuration remove the easy findings, so testers can focus on deeper issues.
- Test a stable staging environment that mirrors production.
- Bundle related assets such as a web app, its API and its cloud account into one engagement.
- Plan ahead of audit and renewal deadlines. Last-minute starts cost more and leave no time to fix issues.
- Consider a capable offshore provider. Remote delivery from lower-cost locations can give the same depth at lower day rates. We deliver remotely from India for UK clients and quote fixed prices in GBP. Request a quote.
Red flags in cheap quotes
- A price given before anyone has asked about your scope.
- A full application test promised within 24 to 48 hours.
- No named testers, CVs or sample report.
- Findings that list scanner plugin IDs instead of reproducible steps.
- No retest, or a retest charged at full price.
Frequently asked questions
What is a typical UK penetration testing day rate?
Most UK providers charge roughly £750 to £1,500 per tester-day, depending on seniority, accreditation and the type of testing. Specialist work such as red teaming or hardware testing can cost more.
Is VAT added to penetration testing quotes?
UK-based providers normally add VAT at 20%. For services supplied by a provider outside the UK to a UK business, the reverse-charge rules usually apply. Check the treatment with your finance team.
Is retesting included?
It should be. Many reputable providers include one retest of fixed findings within 30 to 90 days. Confirm this in writing before you sign.
Ready to compare? Request a fixed-price quote in GBP or explore our penetration testing services.