Ask five UK suppliers for a penetration test price and you will often get five different numbers. That is not always a red flag. Pricing almost always comes down to day rate multiplied by the days needed for your scope, plus any extras for rush work, on-site access or compliance paperwork. A brochure site with one user role does not cost the same as a multi-tenant SaaS platform with privileged admin journeys and a wide API surface.
This guide is for UK buyers who need a realistic budget, not a marketing slogan. It covers how day rates behave in 2026, what drives day count, indicative bands for common scopes, and the questions that separate a genuine manual-led test from an automated scan with a fancy cover page. Attack Vector engagements start from £1,500 for tightly defined work.
In short
- UK skilled day rates commonly sit roughly between £600 and £1,200 per day; total cost is rate × days for your scope.
- Small, well-bounded jobs can start from £1,500; complex applications, large IP estates and internal Active Directory work sit higher.
- Quote quality tracks who tests, how much manual time is included, and how usable the report is, not only the day rate.
- An unusually cheap fixed price often means scan-only work that auditors and insurers treat lightly.
- Use an indicative calculator, then confirm scope on a call before you treat a number as fixed.
Context: why UK pricing looks messy
Penetration testing in the UK is a mixed market. Independent consultancies, specialist boutiques, generalist IT firms and large accredited houses all sell something labelled as a pentest. Overhead models differ. Some quotes fund senior practitioner time. Others fund project managers, account teams and junior delivery staff who follow a checklist.
A higher day rate does not automatically mean a stronger tester. A lower day rate does not automatically mean a weaker one. What matters for risk reduction is whether a competent human will validate findings, attempt realistic attack paths, and write a report your engineers can act on. Credentials help buyers filter: for Attack Vector, lead consulting credentials include Cyber Scheme Team Leader (CSTL), from The Cyber Scheme, and Chartered Cyber Security Professional (ChCSP), the UK Cyber Security Council's chartered title.
How UK day rates behave in 2026
A practical budgeting starting point is a day-rate band of about £600 to £1,200 for skilled UK penetration testing. Where a quote lands inside that band depends on seniority, specialism (web, API, cloud, Active Directory, mobile), demand, and how much of the fee pays for delivery versus sales overhead.
Day rate alone is a weak buying criterion. Ask:
- Who will perform the testing (named role seniority, not only a sales contact)?
- How many days are reserved for manual testing versus automated tooling?
- What is explicitly out of scope?
- What does the report include (evidence, severity method, remediation guidance, retest options)?
- Will you get a debrief, or only a PDF dropped into a portal?
Attack Vector identifies security weaknesses so your team can prioritise remediation. The commercial model is testing and clear reporting, not an open-ended promise to fix your systems.
What actually drives the number of days
Once you have a day rate, total cost follows scope. The main multipliers are:
Attack surface size
More public IPs, more hostnames, more applications and more API endpoints mean more discovery, more triage and more validation. A handful of external hosts is a different job from a /24 range (256 addresses) with forgotten staging systems still live.
Authentication depth
Unauthenticated testing is cheaper than testing three or four privileged roles. Authorisation flaws (horizontal and vertical privilege issues) appear when testers can move between roles and compare what each can reach. That takes time, and it is often where the serious findings live.
Application and business logic complexity
A marketing site with a contact form is not the same as a payments workflow, a clinical workflow, or a multi-tenant admin console. Logic abuse does not show up reliably in scanners.
Environment and access model
Remote testing of a production-like staging environment is usually smoother than production-only windows with tight change freezes. On-site internal testing, complex VPN onboarding, or multi-cloud account access all add coordination days even when technical testing days look modest.
Compliance and evidence packaging
A clean technical report may be enough for internal risk owners. Buyers sometimes also need wording that maps to ISO 27001 evidence packs, NHS DTAC technical security questions, DSPT conversations, SOC 2 customer questionnaires, cyber insurance forms, or MPA/TPN-aligned content security controls. Extra narrative and remediation tracking can add effort; it should be scoped honestly rather than bolted on for free and then rushed.
Timeline pressure
Compressed deadlines cost more because diaries and out-of-hours windows have to move. Planned annual testing is almost always better value than a panic purchase two weeks before an audit.
Indicative UK budget bands (not a fixed tariff)
These are planning ranges for 2026, not a price list. Exact quotes depend on assets, roles, environments and deadlines.
| Typical need | Rough shape | Planning band (ex VAT) |
|---|---|---|
| Small, tightly bounded job (a few external IPs or a simple web app) | Around 2 days | From £1,500 minimum for the whole job |
| Small external infrastructure (limited IPs) | 2-4 days | Often low-to-mid thousands |
| Single web app, one or two roles | 3-5 days | Often mid thousands |
| Web app + API, several roles | 5-8+ days | Mid-to-higher thousands |
| Broader external estate or multi-app package | Multi-week effort | Higher thousands |
| Internal network / Active Directory depth | Depends on sites, VLANs, identity complexity | Often higher than a small external job |
| Retest of agreed findings | Fraction of original effort | Scoped separately |
Treat any public calculator output as indicative. Fixed commercials follow a scoping conversation.
How to read a quote without getting burned
Red flags
- "Unlimited apps and IPs" at a rock-bottom fixed fee
- Deliverable that looks identical to a raw scanner export
- No named testing approach (OWASP WSTG-style web work, infrastructure methodology, authenticated roles)
- No time budget for manual validation
- Severity everywhere marked critical, or nowhere actionable
- No retest path defined when your auditor expects closure evidence
Healthy signals
- Clear inclusions and exclusions
- Assumption list (credentials, environments, rate limits, out-of-hours rules)
- Manual-led testing with tooling in support, not the other way round
- Report samples or a clear report structure description
- Honest conversation about CREST/CHECK if your procurement needs company schemes
If you are still deciding whether you need a penetration test or a vulnerability scan, read the companion comparison of penetration testing versus vulnerability scanning. Buying the wrong product is the fastest way to waste budget.
The expensive kind of cheap
Under-scoped testing creates false comfort. Common patterns:
- Testing a marketing subdomain while the customer portal stays untouched
- Excluding APIs that carry the real business logic
- Running only unauthenticated checks against an authenticated product
- Filing a scan PDF as "annual penetration test" evidence for an insurer or NHS buyer
- Leaving Critical and High findings open with no retest budget, then discovering the gap mid-procurement
A smaller, well-aimed engagement that surfaces real, evidenced weaknesses on systems that matter usually beats a thick binder nobody remediates.
What a quote will not tell you
- From £1,500 is a starting point for limited scopes, not a promise that every estate fits that number.
- Day-rate bands above are market context for planning, not a guarantee of any supplier’s rate card.
- Instant online estimates are indicative. Fixed quotes follow scoping.
- No penetration test guarantees you will pass an audit, win a tender, obtain cyber insurance, or achieve certification.
- Attack Vector identifies weaknesses and documents them clearly; we do not claim to remediate your systems as part of the test fee.
If you already know the rough size of the job, try the instant quote calculator. If you are unsure whether to start with web, API, external or internal work, email [email protected] for a short scoping discussion.
Service overviews sit under penetration testing services, including web application and infrastructure testing.
FAQ
Why do UK penetration test quotes vary so widely?
Because scope, seniority, manual effort, overhead model and deadline differ. Comparing day rates without comparing days and deliverables is misleading.
Is a cheaper day rate always worse?
No. Some experienced independents carry low overheads. Judge the people doing the work, the methodology and the sample reporting quality.
Will a low fixed price satisfy my auditor or insurer?
Only if the scope matches what they asked for and the deliverable is a genuine test report. A scan dressed as a pentest often fails scrutiny later, when fixing the gap is more expensive.
How many days does a typical SME web application need?
Many modest apps land in a handful of days once roles and environments are clear. Multi-role, multi-tenant or heavily integrated products need more. Ask for assumptions in writing.
Do you charge per vulnerability found?
No. Ethical testing is priced on effort and attack surface. Paying per finding creates the wrong incentives.
What should we send to get an accurate quote?
URLs or asset lists, authentication requirements, staging versus production constraints, deadlines, and any compliance wording (ISO 27001, NHS DTAC/DSPT, cyber insurance, MPA/TPN). The calculator captures much of this; a call clears the rest.
Suggested Resources
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.