Most UK penetration testing companies will not show you a price. Here are ours.
Three fixed price packages, the scope limits printed next to the price and no scoping call before you know what it costs. Every figure on this page excludes VAT, which is charged at 20%.
Every package below is that rate multiplied by the number of days, with nothing added for reporting, the debrief or the retest. Work that does not fit a package is quoted the same way: a number of days, times £950, in writing, within one working day.
Pick the test that matches what you run
Each package is named after what it tests. If your estate sits inside the limits shown, the price shown is the price you pay. If it does not, the section below the packages explains how the price changes.
External Test
Up to 20 internet facing hosts
- Manual testing of everything your organisation exposes to the internet, with findings verified by hand and safely exploited where that proves the risk
- Written report with an executive summary and technical findings
- Debrief call to walk through the results
- Retest of Critical and High findings within 30 days
- Websites, logins and internal networks are not included
Usually bought for: a cyber insurance renewal, a customer questionnaire, Cyber Essentials Plus or a first test.
Book the External TestExternal and Web Test
Up to 20 internet facing hosts
One public website, tested without a login
- Everything in the External Test
- Manual testing of one website against the OWASP Top 10 and the logic behind it, as an attacker without an account
- Written report with an executive summary and technical findings
- Debrief call to walk through the results
- Retest of Critical and High findings within 30 days
- Customer portals, staff logins, APIs and mobile apps are quoted separately
Usually bought for: annual testing, a new website launch, a customer security questionnaire or ISO 27001.
Book the External and Web TestExternal, Web and Internal Test
Up to 20 internet facing hosts
One public website, tested without a login
One site, one domain, up to 250 internal hosts
- Everything in the External and Web Test
- Internal network test from the position of an attacker who has reached your network, delivered on site or remotely through a drop box we post to you
- One report covering the perimeter and the internal network
- Debrief call to walk through the results
- Retest of Critical and High findings within 30 days
- Second sites, second domains and segregation testing are quoted separately
Usually bought for: ISO 27001, a cloud or office migration, or a first internal test after years of external only testing.
Book the Full TestWhat the scope limits mean
A fixed price only works if both sides agree what it covers before anyone starts. These are the definitions we quote against. If your numbers are over the limit, the price moves by whole or half days at the published rate, so you can work it out before you contact us.
Anything in the “quoted separately” list is not an upsell hidden behind the package. It is work that takes a different amount of time depending on what you have, so it needs a day count of its own. You will get that count, times £950, in writing.
What the price always includes
Scoped by a tester
The person who scopes your test is a tester and knows how to correctly scope the work, not guess.
A live view of the test
Every finding appears in your client portal as it is confirmed, with the detail needed to start fixing it. You are not waiting for the report to know what was found.
A report written for two audiences
An executive summary your board and your insurer can read, then technical findings with evidence and remediation steps for the people fixing them.
A debrief call
Once the report lands we walk through it with you, answer the questions it raises and agree what to fix first.
A retest within 30 days
Critical and High findings are retested once within 30 days of the report so you can show they are closed. Those are the findings insurers and customers ask about.
A start date agreed at order
Dates are fixed when you book, in writing.
Who does the testing
The team is led by Jordan Glover, who holds the Principal Cyber Security Professional (PriCSP) title from the UK Cyber Security Council, awarded through The Cyber Scheme, which is the same Council title route that CHECK team leaders are now required to hold. Every test on this page is scoped and led by a Principal registered tester.
Day rates in this market tend to move with the badges a company holds rather than with the person doing the work. The rate on this page is what the testing costs. If your contract or regulator requires a specific accreditation, say so when you book and we will tell you straight away whether we can meet it.
How a fixed price test runs
Tell us what you have
Host count or IP ranges, the website address and whether it has a login. For the internal package, the number of sites, domains and rough host count. Takes a few minutes.
Confirmation within one working day
If you sit inside the limits, you get a booking confirmation at the published price. If you do not, you get a day count times £950 in writing. Either way you know the number the next working day.
Authorisation and dates
You sign a short authorisation form naming the systems in scope and we fix the dates. For the internal package we post you the drop box.
Testing, visible as it happens
Findings appear in your portal as they are confirmed. If something serious turns up you hear about it the same day, not in the report.
Report and debrief
The report follows the testing days and we walk through it with you on a call.
Retest
Fix the Critical and High findings, tell us when you are ready and we retest them within the 30 day window.
Book a test
Send the details below through the contact form and we will come back within one working day with a confirmation or a day count.
- Which package you want
- Number of internet facing hosts, or the IP ranges
- Website address and whether it has a login
- For the internal package: sites, domains and rough host count
- The month you want the test done
- What is driving it, if there is a deadline behind it
Prefer to talk first? Edinburgh 0131 605 6703, London 020 3051 8897.
Frequently Asked Questions
Why publish prices when nobody else does?
Because the usual process wastes your time. You fill in a form, wait for a call, describe your estate, wait for a proposal and then find out the number. We know what two, five and ten days of our time cost, so we have written it down. The only thing a scoping call adds is confirming your estate fits the limits, which the form does.
Is this a vulnerability scan dressed up as a penetration test?
No. Scanning is one of the first steps, but every finding in the report has been verified by hand and exploited where that is safe and proves the point. The report tells you what was done, what was found and what was not found. If you want a scan on its own, that is a different service at a different price. We will say so rather than sell you the wrong thing.
I have more than 20 hosts. What happens to the price?
Each additional block of up to ten hosts adds half a day at £950, so 30 hosts on the External Test is £2,375 and 40 hosts is £2,850. Beyond about 50 hosts it is usually better to scope the test properly rather than keep adding blocks, so we will suggest a day count instead.
My website has a customer login. Can I still use the package?
The package tests the website as a visitor without an account. Testing the logged in side depends on how many user types you have and what they can do, so it is quoted as a number of days once we know that. Most single role portals add two to three days to the External and Web Test.
Why are only Critical and High findings retested?
Because those are the findings that insurers, customers and auditors ask you to prove you have fixed. They are the ones worth a second round of testing. Medium and Low findings come with remediation guidance in the report. If you want everything retested, that is booked as a day at the published rate.
Do you work outside Scotland?
Yes. External and web testing is delivered remotely wherever you are. Internal testing is delivered on site anywhere in the UK, with travel included, or remotely from a drop box we post to you.
Is the price fixed once I book?
Yes, provided what we test matches what you told us. If the host count turns out to be higher on the day, the “over the limit” rule above applies and we tell you before doing the extra work, not after.
How long are these prices valid for?
Until 31 October 2027. If they change after that, the change goes on this page before it applies to anyone. A test booked while a price is showing is delivered at that price, whatever the date of the test.
Something that does not fit a package?
Authenticated applications, APIs, cloud, wireless, firewall reviews and larger estates are all quoted the same way: a day count, times £950, in writing within one working day. Tell us what you have and we will tell you how long it takes.
Ask for a Day Count