A penetration test usually costs a few thousand pounds for a small, tightly scoped job and well into five figures for a wider one. The biggest driver is scope: how many systems, how deep the testing goes and who needs to read the report. AI pentesting adds a monthly option, with BreachLine plans from £399 a month.
That is the short answer. The rest of this guide explains where the money goes, what to ask before you sign, and when a monthly plan is a better fit than a single booked test.
What does a penetration test cost?
Prices depend on the market and the provider, so treat any single figure with care. The penetration testing cost page sets those ranges beside monthly plans. For a reference point, UK IT provider GR.IT Consultancy's 2026 pricing guide for small and mid-sized businesses puts most manual penetration tests at £1,500 to £15,000. Its figures include:
- a basic external network test on a small internet-facing footprint at £1,500 to £3,500, taking two to three days
- a combined external, internal and web application test at £8,000 to £15,000
- accredited testers at roughly £1,000 to £1,500 per consultant day
These are one provider's published UK figures, not a global benchmark. They are still useful, because they show the pattern most buyers meet anywhere: you pay for consultant days, and the number of days follows the scope.
What drives the price?
Four things move a quote more than anything else.
Scope. Ten public IP addresses take less time than a web app with several user roles, an API and a cloud account. Write down exactly what is in scope before you ask for prices, or two quotes will not be comparable.
Depth. A quick external check and a test that tries to chain weaknesses together are different jobs. Ask whether the tester will attempt safe exploitation or only report what a scanner flags.
Who reads the report. If a client contract, insurer or tender asks for a report from an accredited firm, that requirement decides much of the cost. If the test is for your own assurance, you have more freedom to choose.
How often you test. A single test shows how your systems looked during the test window. If you release new features monthly, that picture goes out of date quickly, and you either pay for more tests or accept the gap.
Why does a one-off test leave gaps?
Most small and mid-sized teams change their software far more often than they test it. A new login flow, a changed API endpoint or a fresh cloud setting can open a weakness the day after a test ends. The report is accurate for the version that was tested, and that version may no longer be the one your customers use.
This is the case for testing as you ship. Instead of one large engagement a year, you test smaller pieces of scope when they change, or on a schedule you set. Testing then follows your release rhythm rather than the calendar.
How does a monthly AI pentesting plan compare?
BreachLine's Nebula is an AI security testing engineer. You give it a scope and written authorisation, and it tests what you put in scope, on demand or on a schedule. It runs when you ask it to or when you schedule it, not around the clock.
The plans on breachline.io/pricing are:
- Individual: £399 a month, 400 credits
- Team: £899 a month, 1,000 credits
- Business: £2,299 a month, 2,800 credits
- Enterprise: £199 per seat per month (minimum five seats)
Testing, investigations and retests all use credits. Retests are not free, so plan for them when you choose a tier. A small test of one or two assets usually fits the £399 plan.
See the Nebula vs Intruder comparison and penetration testing in London.
What should you get for the money?
Whatever you buy, judge it by the quality of the findings, not the length of the report. We build Nebula around four things.
Proof. Findings are validated, with evidence and reproduction steps. Where a flaw can be exploited, Nebula provides safe exploit proof, so your developers can see the issue for themselves instead of arguing about whether it is real.
Test as you ship. Run a test when you release, or set a schedule. When you fix something, ask Nebula to retest the original issue on the changed system.
Quality. Validated findings mean less noise to sort through, and each finding comes with clear fix steps. Your team spends its time fixing, not triaging.
Trust. BreachLine Labs is a London company, BREACHLINE LABS LIMITED, company no. 17072871. We are Cyber Essentials certified (certification body CDS Defence & Security), whole organisation, certified 20 Aug 2026, valid to 20 Aug 2027. Verify our certificate. We are registered with the ICO (ref. ZC223129). Human sign-off on findings is available when a client requests it.
When do you still need a manual test?
An AI pentesting plan does not replace all kinds of engagement. If a contract, insurer or tender specifically asks for a report from an accredited testing firm, book one. Many teams combine the two: a booked test where a third party requires it, and regular testing between those tests to catch what changes.
For a deeper, point-in-time look at a single asset, BreachLine also offers a proof engagement at £2,500 for a single pass or £5,000 in depth.
What should you ask before you buy?
- What exactly is in scope, and what is excluded?
- Will the tester attempt safe exploitation, or only report scanner output?
- Does each finding include evidence and reproduction steps?
- How are retests priced, and how quickly can you get one?
- Who needs to accept the report, and do they require an accredited provider?
- How will you keep testing as your systems change?
Clear answers to these questions matter more than the headline price.
Ready to see it on your own systems?
Book a 30-minute demo and we will run Nebula against an asset you choose, within a scope you authorise. Book a demo.
Sources (checked 16 Oct 2026)
- BreachLine pricing
- Penetration testing cost
- BreachLine AI penetration testing: https://breachline.io/ai-penetration-testing
- BreachLine automated penetration testing: https://breachline.io/automated-penetration-testing
- GR.IT Consultancy, How Much Does Penetration Testing Cost in the UK? 2026 Pricing Guide for SMEs (14 Sep 2026): https://www.grit-consultancy.com/penetration-testing-cost-uk/
- Cyber Essentials certificate: https://registry.blockmarktech.com/certificates/41dcf80c-2d57-4a90-9d0f-24b7678736ee/
