In short
- ✓UK pen testers typically charge £600–£900 a day independently, £950–£1,200 for CREST-accredited mid-market firms and more for large consultancies.
- ✓A small external network test usually costs about £1,800–£3,500; a single web application about £3,000–£6,000.
- ✓Many small businesses get more value from fixing the basics and vulnerability scanning first, then testing when a client, contract or new system needs it.
What a penetration test is
A penetration test is a time-boxed, authorised attempt by a security specialist to break into your systems the way a real attacker would, followed by a report of what they found and how to fix it. It's different from a vulnerability scan, which is an automated check for known weaknesses, and from Cyber Essentials Plus, which checks the five Cyber Essentials controls rather than trying to break in.
Typical UK prices by test type
| Test | Typical UK cost | Typical length |
|---|---|---|
| External network (internet-facing systems, up to about 16 IPs) | £1,800–£3,500 | 2–3 days |
| Web application (single user role) | £3,000–£6,000 | 3–5 days |
| Web application with multiple roles and an API | £5,000–£12,000 | 5–10 days |
| Internal network (single office) | £4,000–£7,500 | 4–6 days |
| Microsoft 365 or cloud configuration review | £2,500–£6,000 | 3–5 days |
| Vulnerability scan (automated, not a pen test) | From about £500 | Hours |
Ranges from Cloudswitched's 2026 UK penetration testing pricing for SME scopes, ex-VAT.
What affects the price
- Scope: the number of IP addresses, applications, user roles and sites.
- Accreditation: CREST-accredited firms charge more, and some financial services clients require CREST. Public sector work may need CHECK.
- Retesting: some quotes include a retest after you fix issues; others charge extra.
- Timing: out-of-hours testing to avoid disruption can cost more.
Do you actually need one?
You probably need a penetration test if a client, contract or insurer asks for one, if you're launching a web application or customer portal that handles personal data, or after a major change such as a new network or cloud platform.
If none of those apply, most small businesses get more value by fixing the basics first: multi-factor authentication, updates, backups and Cyber Essentials, then running regular vulnerability scans. Testing before the basics are in place usually just produces a long report of easy findings.
How to get value from a pen test
- Agree a clear scope in writing: what's tested, what's off-limits and when.
- Fix known issues and run a vulnerability scan first, so the test finds real problems.
- Ask for a report with a plain-English summary for directors and prioritised fixes.
- Check whether a retest is included.
- Repeat yearly or after major changes.
Questions
How much does a penetration test cost in the UK?
For small businesses, typically about £1,800–£3,500 for an external network test and £3,000–£6,000 for a single web application. Day rates range from about £600 to £1,200, more for large consultancies.
Is a vulnerability scan the same as a penetration test?
No. A scan is an automated check for known weaknesses and costs much less. A penetration test is a manual attempt by a specialist to exploit weaknesses and shows what an attacker could actually do.
Is Cyber Essentials Plus a penetration test?
No. Cyber Essentials Plus is a technical audit of the five Cyber Essentials controls. It's valuable, but it doesn't replace a penetration test when a client asks for one.