A manual penetration test in the UK costs from about £2,500 to £25,000+, and most mid-market web application or internal network tests fall between £3,750 and £8,000 [1]. UK day rates sit mostly between £800 and £1,200, with a median of £1,000 across 30 government rate cards [2]. In the US, most organisations pay $10,000 to $30,000 per engagement, and Synack puts the all-types average at about $18,300 [3].
Most of the spread in penetration testing cost comes from days, not rates. A quote is a day rate times the tester-days your scope needs, so two firms charging the same rate can be five times apart [2]. A "pen test" for a few hundred pounds is nearly always an automated vulnerability scan. That's a different product, and we cover it below, ours included.
Penetration testing prices at a glance
Pen test prices by type, from sources published in 2026. The UK and US columns come from different sources and methods, so read each column as a range for its own market.
Test type | UK (GBP) | US (USD) | Typical tester-days |
|---|---|---|---|
Web application | £3,750 to £6,250+ for 3 to 5 days [1]; up to £18,000 for deeper scopes [2] | $5,000 to $30,000 [3] | 3 to 12 [2] |
External network | From £2,500 (2 to 3 days); £3,750 to £6,250+ for 3 to 5 days [1] | $4,000 to $12,000 [3]; about $5,000 for under 10 live hosts [6] | 2 to 5 [1] |
Internal network | £6,250 to £10,000+ [1] | $5,000 to $35,000 [3] | 5 to 8 [1] |
API | £7,000 to £12,000 [2] | $5,000 to $30,000 [3] | 4 to 9 [2] |
Mobile app (one platform) | £3,000 to £7,000 [5]; £7,500 to £14,000 [2] | $7,000 to $35,000 [3] | 5 to 10 [2] |
Cloud | £4,000 to £10,000 [5]; £8,000 to £14,000 [2] | $10,000 to $50,000 [3] | 4 to 5 [2] |
Social engineering and phishing | £2,000 to £6,000 [5]; £6,000 to £15,000 [2] | $3,000 to $12,000 [3] | 7 to 10 [2] |
Red team | £15,000 to £50,000+ [1] | $30,000 to $150,000+ [3] | 10 to 15+ [2] |
Vulnerability scan (not a pen test) | £500 to £2,000 one-off [5]; £300 to £2,000 a month managed [1] | Scanner plans from $69 to $499 a month [2] | Automated |
Day rates are the better sanity check:
UK | US | |
|---|---|---|
Normal manual day rate | £800 to £1,200 for the middle half of the market, median £1,000 [2]; SECFORCE calls £1,000 to £1,500 typical and suggests budgeting about £1,200 [4] | $1,200 to $3,000 for a senior tester at a boutique firm; $150 to $400 an hour [3] |
Too cheap to be manual testing | Under £500 a day [1][4] | No reliable published floor found |
What drives penetration testing cost
UK ranges from published 2026 price lists. Sources [1] and [2].
Most cost drivers change how many days the test needs. Published day rates move far less [2].
Scope and asset count
For an external network test, the count that matters is live IP addresses with at least one open port. Triaxiom Security calls this the biggest single cost driver and prices it at about $5,000 for fewer than 10 hosts, $8,000 to $15,000 for 10 to 50, and $15,000 to $20,000+ above 50 [6].
Web applications scale with pages, forms and user roles. Precursor Security estimates 3 days for a 10-page application and 7 to 10 days for a 200-page one with several roles [1]. Stingrai's price index notes that each extra role roughly doubles the authorisation test matrix [2]. For APIs, count endpoints and authentication flows.
Test type
Cloud work now carries a higher median day rate than network work, £1,250 against £1,000 on UK rate cards [2]. iOS and Android almost always price as two separate targets [2]. Red teams cost more mainly because they run 10 to 15 days or longer, at a median of £1,400 a day [2].
Black, grey or white box
In a black-box (closed box) test the tester starts with no inside information. The NCSC says this models an outside attacker more closely, but "the lack of information can also result in vulnerabilities remaining undiscovered in the time allocated for testing" [7]. Precursor estimates black-box testing adds 20 to 40% over white-box, and says most compliance tests run grey-box [1].
Our own tests are black-box unless you grant more access. If your budget only covers a few days on an app with logins, though, give the tester an account for each role. You get more of the app tested for the same money.
Retests, reporting and compliance
Check whether a retest is included. In Synack's example, a $10,000 engagement that charges $3,000 per retest can end well over budget if fixes land in phases [3]. Precursor tells buyers to budget 15 to 25% extra for compliance-mapped engagements, and may charge a rush premium when scoping to delivery is under two weeks [1]. Synack says Big 4 consultancies typically charge two to three times what specialist firms charge [3].
What compliance frameworks ask for
Buyers often overestimate what their framework demands.
- PCI DSS v4.0.1 requires internal (11.4.2) and external (11.4.3) penetration tests at least once every 12 months and after any significant change, plus segmentation testing (11.4.5). Quarterly scans by an Approved Scanning Vendor (11.3.2) are a separate requirement, and PCI guidance says scanning alone is not a penetration test. The tester must be qualified and independent but doesn't have to be a Qualified Security Assessor [8].
- ISO 27001:2022 names no penetration test in any Annex A control. A pen test is the usual evidence for controls 8.8 (technical vulnerabilities) and 8.29 (security testing in development and acceptance) [9].
- SOC 2 has no explicit pen test requirement. Mike DeKock, a CPA writing on the Cloud Security Alliance blog, says a pen test is the most common last requirement he hears of before an enterprise deal closes [10].
- Cyber Essentials Plus is a technical audit by a licensed certification body, with internal and external vulnerability scans and checks on a sample of devices [11]. Only a certification body can award it, so a pen test won't get you the certificate, and CE+ doesn't test your web application or APIs [16].
Vulnerability scan vs penetration test
On our homepage we put it this way: "A vulnerability scan lists known issues; a penetration test tries to prove what an attacker can actually do."
Vulnerability scan | Penetration test | |
|---|---|---|
Who runs it | A tool, matching known signatures | A person using tools, trying to break in and chain findings |
What you get | A list of known issues by severity, with false positives | Findings proven by exploitation, with the request that worked and its impact |
Access control and business logic flaws | Rarely found | The main focus on web apps |
Time | Minutes to hours | Days (3 to 12 for one web app) [2] |
Typical UK price | £500 to £2,000 one-off [5] | £2,500 to £25,000+ [1] |
Counts as a PCI DSS pen test | No [8] | Yes, if it follows the 11.4.1 methodology [8] |
Use it for | Regular checks between tests | Pre-launch, major changes, compliance, customer demands |
SECFORCE gives an example a scanner will miss. An app shows user IDs somewhere, and its change-password function takes an ID without checking that it belongs to the logged-in user, so anyone can reset anyone's password. A tester will catch that. A scanner won't [4].
A newer category sits in between. Autonomous, AI-driven web app tests now list at $3,000 (Stingrai) and $3,500 (Cobalt, a promotional price), close to the cheapest published human-delivered test at $3,500 to $4,000 (Intruder) [2]. Attackers use the same tooling, as in the case we covered of hundreds of AI agents pointed at PaperCut servers. Nobody knows yet how far auditors will accept autonomous tests. PCI DSS asks for a qualified, independent tester, and whether a team running such a platform counts is, in Zero Hunt's words, "a question for your assessor" [8].
CREST and CHECK: what they mean and when you need them
CREST accredits companies and, separately, certifies people. An accredited company has had its processes, testing methodology and data handling assessed, and signs a code of conduct committing it to that methodology, with an independent complaints route for buyers [12][13]. Individual testers hold exams such as CRT, an intermediate exam the NCSC recognises for CHECK [14], and CCT, which comes in infrastructure and application versions [17].
You need CREST when a contract, insurer or procurement questionnaire names it. PCI DSS does not require it [8]. Without a named requirement, judge a provider on its methodology, a sample report and the named tester's experience, all items on SECFORCE's procurement checklist [4].
CHECK is the NCSC scheme for penetration testing of central government departments, public sector bodies and critical national infrastructure [15]. The NCSC recommends that government organisations use CHECK testers and companies [7].
Whatever the brief says, ask each vendor (us included) which accreditations the company holds and what the named tester is certified in, then check the company in the CREST member directory.
How to scope a pen test and get an accurate quote
The NCSC's model engagement says the scoping document should state the effort needed, "usually given in terms of resource days" [7]. Ask for that.
- List what is in scope: URLs, API base paths with an endpoint count (send the OpenAPI file if you have one), live public IPs, cloud accounts, and each mobile app per platform.
- Count user roles and name the flows you worry about most, such as payments, admin, file upload and password reset.
- Choose black, grey or white box. For grey box, create a test account for each role before the start date.
- Say why you are testing: PCI DSS, an ISO 27001 audit, SOC 2, a customer questionnaire or a launch. Ask your auditor whether they expect a particular report format.
- Agree staging or production, testing windows, and a contact who can answer the tester during the test.
- Ask for the quote in tester-days, with the named tester, the retest terms and the exclusions. Stingrai lists the four exclusions that most often inflate an invoice: retesting, report reformatting for auditors, out-of-hours testing and travel [2].
- Get two or three quotes. Divide each total by its days and compare the scopes line by line. SECFORCE's view is that the fair price usually sits in the middle of the quotes you get [4].
Red flags in cheap penetration testing quotes
- A price arrives without a single scoping question. SECFORCE tells buyers to be wary of this [4].
- The quote has no tester-day count, or the implied day rate is under £500 for something sold as manual testing [1][4].
- The implied rate is between £500 and £800. That's below the middle of the market, and Stingrai's advice is to ask who is doing the testing and how much of it is automated [2].
- The sample report reads like scanner output, with no reproduction steps or proof of exploitation [4].
- Nobody mentions insurance [4], or asks you to sign written authorisation and rules of engagement before testing starts.
- A retest is "available" but has no price.
Expensive quotes deserve questions too. SECFORCE's advice: if the price looks high and the vendor can't explain the days, treat that as a bad sign [4].
Frequently asked questions
How much does a penetration test cost in the UK?
A manual UK penetration test costs from about £2,500 for a small external network test to £25,000+ for a full assessment. Most mid-market web application or internal network tests fall between £3,750 and £8,000 [1]. The total is the day rate times tester-days, and UK day rates mostly sit between £800 and £1,200 [2]. A quote far below that is usually an automated scan.
How much does a penetration test cost in the US?
Most US organisations spend $10,000 to $30,000 per engagement, with an all-types average of about $18,300 [3]. A web application test typically runs $5,000 to $30,000, an external network test $4,000 to $12,000, and a red team exercise $30,000 to $150,000 or more [3]. Triaxiom quotes about $5,000 for an external test of fewer than 10 hosts [6].
What is a normal penetration testing day rate?
In the UK, £800 to £1,200 covers the middle half of published rates, with a median of £1,000 across 30 G-Cloud 14 rate cards [2]. SECFORCE suggests budgeting about £1,200 a day and treats anything under £500 as unlikely to be a real pen test [4]. In the US, a senior tester at a boutique firm typically costs $1,200 to $3,000 a day [3].
Is a vulnerability scan the same as a penetration test?
No. A vulnerability scan is an automated check for known issues. A penetration test is a person trying to exploit and chain weaknesses to show what an attacker could do. A one-off vulnerability assessment costs £500 to £2,000 in the UK [5]; a manual test starts around £2,500 and takes days [1]. PCI DSS guidance says scanning alone is not a penetration test [8].
Do I need a CREST or CHECK accredited penetration tester?
CHECK is for UK central government, public sector bodies and critical national infrastructure [15]. CREST matters when a contract, insurer or customer questionnaire asks for it. PCI DSS requires neither; it asks for a qualified, organisationally independent tester [8]. Either way, ask for the named tester's certifications and check the company in the CREST member directory.
How long does a penetration test take?
A web application test takes 3 to 12 tester-days [2], an external network test 2 to 5 days and an internal network test 5 to 8 days [1]. Red teams run 10 to 15 days or more [2]. Gradeon puts the time from scoping to final report at two to four weeks for UK SMEs [5].
Where our prices sit
We publish our penetration testing prices, in USD. Our pricing page lists our starting tiers, including:
- Lite, $250: "Basic vulnerability scan and summary report"
- Plus, $500: "Manual testing of common exploits with detailed recommendations"
- Enterprise, $10,000: "Organization-wide security simulation with C-level briefing"
These are starting prices for a written scope, not a quote. At $1.3644 to the pound (the 21 August 2026 Federal Reserve rate Stingrai uses [2]) they come to about £180, £370 and £7,330, but we invoice in USD.
Go back to the £500-a-day line from the red flags list. Lite sits under it because Lite is a scan, and we sell it as one: use it for a first look, not as the only check before go-live. Plus and above add manual checks for the usual web flaws. The statement of work sets the scope and says whether a retest is included, so compare us with anyone on this page by tester-days and scope, not tier names.
For a number on your own scope, send the brief through our penetration testing services page. We'll tell you how many days it needs, or that we're the wrong fit. The full rate card is on our pricing page, and managed security and website monitoring covers the months between tests.
How this guide was made: Ramin Moradi researched and wrote it with AI assistance. Every figure was checked against its linked public source on 12 October 2026. Prices change; the dates of each source are listed below.
Sources
- Precursor Security, "How Much Does Pen Testing Cost? (2026 Guide)". https://www.precursorsecurity.com/services/offensive-security/penetration-testing/cost (read 8 Oct 2026)
- Stingrai, "Penetration Testing Price Index 2026", 1 Sep 2026 (prices read 29 Aug 2026; G-Cloud 14 rate cards, EJN Labs and Precursor price lists, vendor pricing pages). https://www.stingrai.io/blog/penetration-testing-price-index-2026
- Synack, "How Much Does a Pentest Cost? 2026 Trends and Insights", 25 Jun 2026, updated 18 Sep 2026 (read 12 Oct 2026). https://www.synack.com/blog/penetration-testing-cost/
- SECFORCE, "Pen Testing Price List UK and EU Guide 2026". https://www.secforce.com/the-blog/pen-testing-price-list-uk-and-eu-guide-2025/
- Gradeon, "How Much Does Penetration Testing Cost in the UK in 2026?", 26 Mar 2026. https://gradeon.co.uk/how-much-does-penetration-testing-cost-in-the-uk/
- Triaxiom Security, "The Complete Guide to External Penetration Testing (2026)", 3 Apr 2026. https://www.triaxiomsecurity.com/blog/the-complete-guide-to-external-penetration-testing-2026/
- NCSC, "Penetration testing" guidance. https://www.ncsc.gov.uk/guidance/penetration-testing
- Zero Hunt, "PCI DSS penetration testing and scanning: Requirements 11.3 and 11.4 in v4.0.1". https://zerohunt.ai/learn/pci-dss-penetration-testing-requirement-11-4/ (primary text: PCI DSS v4.0.1, PCI SSC Document Library, https://www.pcisecuritystandards.org/document_library/)
- Strobes, "ISO 27001 Penetration Testing Requirements". https://strobes.co/blog/iso-27001-penetration-testing-requirements/
- Cloud Security Alliance (Mike DeKock, CPA), "SOC 2 Reports and Penetration Tests", 2 Feb 2024. https://cloudsecurityalliance.org/blog/2024/02/02/soc-2-reports-and-penetration-tests
- IASME, Cyber Essentials FAQ. https://iasme.co.uk/cyber-essentials/frequently-asked-questions/
- CREST, "Accreditation". https://www.crest-approved.org/membership/accreditation/
- CREST, "CREST Defensible Penetration Test" (PDF). https://www.crest-approved.org/wp-content/uploads/2022/12/CREST-Defensible-Penetration-Test-v5-2.pdf
- CREST, "CREST Registered Penetration Tester (CRT)". https://www.crest-approved.org/skills-certifications-careers/crest-registered-penetration-tester/
- NCSC, "CHECK penetration testing". https://www.ncsc.gov.uk/information/check-penetration-testing
- Incursion Cyber Security (Lewis Lockwood), "Cyber Essentials Plus vs penetration testing", updated 30 Sep 2026. https://incursion-security.co.uk/cyber-essentials-plus-vs-penetration-testing/
- CREST, "Security Testing" (CRT, CCT INF and CCT APP certifications). https://www.crest-approved.org/cyber-service-categories/security-testing/
Comments