How much does a penetration test cost in the UK?

In the UK, a penetration test for a small business typically costs from around £2,000 to £6,000 for a single external network or website test, with internal network tests and larger scopes costing more. Most testers charge a day rate, often between about £750 and £1,500 a day, multiplied by the number of days the scope needs. The single biggest factor is what you ask them to test.

What testing firms charge

Few providers publish prices, but two UK testing firms that do give these typical ranges. Both are indicative; your quote depends on your scope.

Sources: Cyphere, Penetration Testing Cost in UK 2026, which quotes manual testing day rates of £750 to £1,100; JUMPSEC, How Much Does Penetration Testing Cost in the UK?, which puts a small business website or small external network test at £2,500 to £4,000. Prices exclude VAT.

What drives the price

• Scope. How many internet addresses, websites, applications, offices and user roles are tested. Every one adds tester time.
• Type of test. External tests of what faces the internet are usually cheaper than internal tests, which look at everything an attacker could reach once inside.
• How much the testers are told. A "black box" test, where testers start with no information, needs more time for reconnaissance. Giving testers accounts and documentation ("grey box" or "white box") lets them test more deeply in the same time.
• Accreditation. Testers with accreditations such as CREST or CHECK usually charge higher day rates.
• Reporting requirements. Tests for a standard such as PCI DSS need more formal evidence, which adds time.
• Retesting. Some providers include a retest of the fixes; others charge for it.

How long does a small business test take?

Usually days rather than weeks. Cyphere estimates 5 to 10 tester days for a web application or small network, and 1 to 2 days for a small wireless test. A focused external test of a small business's internet-facing systems can be shorter. On top of the testing, allow time for the report and a walkthrough of the findings.

How to avoid paying for the wrong test

• Start from what you've been asked for. If a customer, insurer or tender asked for testing, read the exact wording. It may need a penetration test of specific systems, or an accredited tester, or it may be satisfied by regular vulnerability scanning.
• Fix the easy things first. Run a vulnerability scan and patch what it finds before the test. The NCSC recommends sharing your latest vulnerability assessment with testers, so their paid time goes on finding what scanners can't. Our guide to vulnerability scanning vs penetration testing explains the difference.
• Test what matters most. For many small businesses that's the internet-facing systems, the website or portal clients log in to, and Microsoft 365 or Google Workspace.
• Don't pay for accreditation you don't need, but do check for it when a contract requires it.
• Make sure it's really a penetration test. Ask how much of the time is hands-on testing by a person rather than automated scanning.

Questions to ask on any quote

1. How many tester days have you allowed, and what's your day rate?
2. Exactly which systems, addresses and applications are in scope, and what's excluded?
3. Is it a fixed price?
4. What does the report include? (The NCSC says it should cover each issue found, the risk and how to fix it.)
5. Is a retest included, and within what timeframe?
6. Who will do the testing, and what qualifications do they hold?

What we charge

Our own experts carry out penetration testing at our standard day rate. We agree the scope and a fixed quote with you in writing before any testing starts, and a retest of what you've fixed is included. If a tender names an accreditation, we can arrange testing through Sophos Advisory Services and confirm the testers' credentials meet it before you commit.

Tell us what you need tested and we'll send you a quote.

< Back to Guides