Insights
How much does a penetration test cost in the UK?
There is no honest single number, because the price of a penetration test is set by what is in scope, not by the type of test. Two companies asking for “an internal test” can be quoted amounts that differ by a factor of five and both quotes can be fair. What the quote is really pricing is the number of systems, address ranges and user roles the tester has to cover, because that decides how many days of a qualified person’s time the job takes. Anyone who gives you a price before asking what is in scope is either guessing or planning to charge you for the difference later.
What actually sets the price
Scope. Not the label on the test, the size of the thing being tested. For an internal infrastructure test that means how many internal network ranges are in play. For a web application it means how many user roles need to be tested against each other, how much functionality sits behind the login and whether there is an API underneath. For an external test it means how many live hosts are actually exposed once the dead addresses are discounted. Each of those translates into days. Days are what you are buying.
That is why a scoping conversation comes before a quote. Ten minutes establishing what you run and what matters most produces a scope that fits, which produces a price that reflects the work. Skipping that step produces a price that reflects a guess.
Fixed price or day rate
There are two ways to be quoted. A day rate multiplied by an estimated number of days, or a fixed price for an agreed scope. The day rate looks transparent, but the estimate is the supplier’s and if the job runs long the extra days are yours to pay. A fixed price puts the risk on the tester: the scope is agreed in writing, the price covers it. If the work takes longer than expected that is the tester’s problem, not yours. We quote fixed. A supplier who will not is telling you something about who they expect to carry the overrun.
The two costs that arrive after the quote
The first is the retest. A penetration test finds things; the whole point is that you fix them and someone confirms the fix worked. Plenty of quotes leave the retest out entirely or price it as a separate engagement, so the number you compared on was never the number you would pay. Ask whether the retest is included before you compare anything else.
The second is scope creep billed as extra days. A test starts, the tester finds an API nobody mentioned or a second address range. An email arrives about additional days at the day rate. Sometimes that is legitimate, because the scope genuinely was wrong. Often it is the business model. A properly scoped fixed price removes the incentive.
When one quote is far cheaper
It is usually a scan. A vulnerability scanner run against your address range, with the output formatted into a report, costs the supplier an hour and can be sold for a fraction of a real test. It is not a penetration test, because nobody has verified whether anything on the list is exploitable or reachable. If you are buying the test to satisfy an insurer, a customer or an auditor, a scan will not survive the first question they ask. A cheap quote is worth a phone call to establish whether a person will be doing the work.
When one quote is far more expensive
The extra is usually the brand and the people between you and the tester. Large providers carry account managers, sales teams and overheads that have to be paid for on every engagement. The quote reflects that whether or not the testing is any better. It is not necessarily worse either. It is just paying for things that are not testing. If you want to know what the extra buys, ask who will actually do the work and how many people sit between them and you.
The question to ask before comparing prices
Who exactly will be doing the testing? Not the company, the person. What do they hold, how long have they been doing it? Is the person on the scoping call the person who will be on the keyboard? Two quotes are only comparable once you know that, because the same scope tested by a senior consultant and by whoever was free that week are not the same product at any price.
Get that answer, confirm the retest is in, get the scope in writing with a fixed price against it, then compare. The cheapest quote that passes those three checks is usually the right one.