“How much will this cost?” is one of the first questions any UK organisation asks when it starts looking at penetration testing. It is also the question most testing providers dodge. The honest answer is that a penetration test is priced like any other professional service: by the amount of skilled time your scope genuinely needs. This guide explains what moves the number up and down, what typical UK prices look like for common assessments, and how to get a fixed, transparent quote instead of a vague range.
What is the short answer?
For most UK organisations, a single penetration test falls somewhere between £3,000 and £15,000. A small, well-scoped external network test or a compact web application sits at the lower end. Larger estates, complex applications, multiple environments or cloud infrastructure push the figure higher. Goal-orientated work such as red teaming, or anything driven by a specific compliance deadline, sits well above that band. Treat any provider who quotes a flat price before understanding your scope with caution, in either direction.
What actually drives the cost of a penetration test?
Once you strip away the sales language, the price comes down to four things: how much there is to test, how hard it is to test, how long an expert needs, and what you need at the end.
Scope and complexity. The number of domains, IP addresses, applications, user roles, APIs and environments sets the floor. A marketing website with a login page is not the same job as a multi-tenant platform with an administration console, integrations and a payment flow. Complexity, not just volume, drives effort.
The type of assessment. An external infrastructure test, a web application test, a cloud configuration review and a red team engagement use different skills, different tooling and very different amounts of time. The methodology is chosen to match the risk you are trying to understand, and that choice is reflected in the price.
Testing hours and depth. A broad automated sweep is cheap and shallow. Manual, methodical testing by a qualified person finds the issues that matter, and it takes time. The depth you ask for, including whether testing is black box, grey box or white box, changes the number of days required.
Compliance and reporting requirements. If the output has to satisfy an auditor, a client or a cyber insurer, the reporting, evidence and quality assurance that sit behind the test add cost. Clear, prioritised remediation advice is not padding; it is the part you actually act on.
What are typical UK price ranges by assessment type?
The figures below are indicative starting points for a well-scoped engagement, not quotes. Real pricing depends on your environment.
External and internal network penetration testing. A focused external test of a small estate often starts around £3,000 to £6,000. Adding internal testing, multiple network segments or a larger address range increases the days required and the cost accordingly.
Web application and API testing. A single application typically starts in the region of £4,000 to £8,000. Applications with multiple user roles, complex business logic or a broad API surface take longer and cost more.
Mobile application testing. Testing an iOS and Android app, including its supporting back end, usually starts around £5,000. If both platforms and their APIs are in scope, expect the upper end of that range.
Cloud and infrastructure testing. Cloud configuration reviews and infrastructure testing are priced by the number of accounts, subscriptions and services in scope. A single well-architected environment may start around £5,000, with multi-account estates rising from there.
Cyber Essentials Plus. Certification assessment is a fixed, well-defined piece of work, which makes it one of the easier costs to predict. It is usually the smallest line item in a security budget and often the fastest route to demonstrable assurance.
Red teaming. Goal-orientated assessments that simulate a realistic adversary across people, processes, physical security and technology are multi-week engagements. Pricing reflects that, and the value is in testing whether your organisation can actually detect and respond, not just whether a system is patched.
How do I get an accurate, fixed price?
Accurate pricing comes from accurate scoping, and accurate scoping is a conversation, not a form. A good provider will spend time understanding your environment before quoting, then put a fixed price in writing against an agreed scope.
Start by telling them what you are trying to achieve. Are you chasing a contract requirement, preparing for certification, responding to a client questionnaire or genuinely trying to understand your risk? That single answer changes which assessment is right, and therefore what it costs.
Next, be specific about scope. List the domains, applications, IP ranges, cloud accounts and user roles you want covered. If you are unsure, say so and ask for help mapping it. A provider that helps you scope properly is usually a provider that prices fairly.
Then agree what good looks like at the end: a clear report, findings rated by risk, and practical, prioritised remediation advice you can hand to your team. Confirm the format, the timescale and whether a debrief is included.
What should I ask before I book?
Ask whether the testers are qualified and whether the work is delivered by the same people who scoped it. Ask how findings are rated, how false positives are handled, and whether you get retesting to confirm fixes have worked. Ask what happens if testing uncovers something serious mid-engagement, and how quickly you will be told.
Transparency matters in both directions. You should be able to see how the price was built, what is included, and what would fall outside the agreed scope. If a quote cannot be explained, it cannot be trusted.
Why transparent pricing matters
Security testing is a trust purchase. You are inviting an independent party to look for the weaknesses in your business, and you need to believe both the findings and the invoice. A provider that leads with clear pricing and plain-English scope is usually the same provider that leads with clear findings and plain-English advice.
The cheapest quote is rarely the cheapest outcome. Under-scoped testing that misses your real risk, or a report you cannot act on, costs more in the long run than doing it properly once. The right approach is a scope you understand, a fixed price you can budget for, and findings you can act on the same week.
If you want a straightforward conversation about what a penetration test would cost your organisation, Blackbox Pentesters will scope it with you and give you a transparent, fixed quote. No jargon, no hidden extras, just clear advice from an independent partner.
