How much does penetration testing cost?

The price depends mainly on what you ask a tester to look at and how many days that takes. The table below sets out typical ranges from published UK and vendor sources. Treat them as planning figures, not quotes.

Prices verified on 16 October 2026. Competitor prices change, so check each source before you buy.

Manual penetration testing in the UK is usually sold by the consultant day, so anything that adds days adds cost. Grit Consultancy's 2026 guide names three main drivers:

• Number of targets. Twenty IP addresses and one web app is a different job from several sites, domains and applications.
• Internal versus external. Internal tests usually cost more, because mapping and exploiting Active Directory attack paths takes longer than testing a hardened perimeter.
• What the report has to satisfy. A report that must stand up to an auditor or a large client's security team needs formal evidence and structure, which adds days.

Other factors that move a quote include the number of user roles in an application, whether testing must happen out of hours, and whether a retest is included or billed separately. Grit lists separately charged retests, remediation support, out-of-hours work and attestation letters as common exclusions that turn a cheap quote into an expensive one. Ask about each before you sign.

When you collect quotes, send each provider the same scoping pack: your asset counts, the reason for the test, your testing window and the systems that must not be touched. Ask for the number of days, not only the total, so you can compare like with like.

Testing frequency matters as much as the price of a single test. Grit Consultancy recommends testing at least once a year and again after any significant change, such as a new public-facing application, a cloud migration or an acquisition. If you release software often, the number of times you need to test in a year can matter more to your budget than the day rate. A £5,000 annual test that is out of date after the next release may cost more per useful result than a cheaper option you can repeat.

Finally, budget for the fixes. Grit's guide notes that the hidden cost is rarely the test itself; it is the remediation work in the report afterwards. If you do not have in-house engineers, include the cost of applying fixes and then confirming they work.

A basic external network or infrastructure test on a small internet-facing footprint typically costs £1,500 to £3,500 and takes two to three days, according to Grit Consultancy. That usually covers up to around 20 public IP addresses, plus the firewall, VPN and mail gateway.

External tests are performed remotely, so where your tester is based makes little difference to the price. Grit notes that anything quoted far below a few hundred pounds a day is almost certainly an automated vulnerability scan, not a manual test. Scans have their place, but they are not the same product. A scan lists known weaknesses; a penetration test tries to chain weaknesses together to show real impact, such as turning an exposed service into wider access.

Internal network and Active Directory tests are a different job. Grit puts them at £4,000 to £10,000 over four to eight days for a typical single office network, and some may need a tester on site.

A manual test of one authenticated web application with two or three user roles typically costs £3,000 to £8,000 and takes three to six days (Grit Consultancy). APIs that sit behind the application are often scoped in alongside it. Larger or more complex applications, with many roles or integrations, take longer and cost more.

Per-test AI options now sit alongside the day-rate model. On their own pricing pages, checked on 16 October 2026. See What does a pen test cost in 2026?

With BreachLine, testing runs on Nebula, an AI security testing engineer. See breachline.io/pricing.

Expect roughly £1,000 to £1,500 per tester per day from a CREST-accredited provider, according to Grit Consultancy, with the wider market spanning about £800 to £2,500 depending on seniority, accreditation and specialism. Grit estimates that accreditation adds roughly 20 to 30 per cent to a day rate.

If a contract, tender, insurer or regulator names CREST, that requirement decides the matter. For the full comparison, see our guide to CREST pen tests and AI pen testing.

A monthly plan changes the shape of the spend. Instead of one large invoice once a year, you pay a fixed monthly fee and use credits for testing whenever something changes. BreachLine's plans, as listed on breachline.io/pricing on 16 October 2026.

The difference from a one-off test is that the plan lets you test again after a release or a fix, rather than waiting for next year's engagement. See Do retests use credits? and What does AI penetration testing do differently?

• Start with the basics. Grit Consultancy points out that many SMEs are quoted for a pen test when they were really asked for Cyber Essentials or a scan. Check what your client or insurer actually needs first.
• Scope tightly. Test the internet-facing applications that hold customer data first, rather than everything at once.
• Send the same scoping pack to every provider. It makes quotes comparable and exposes padding.
• Ask about retests and exclusions up front. A cheap headline price can hide extra charges for retests and reports.
• Fix before you retest. Retesting costs time or credits, so confirm a fix is deployed first.
• Test little and often. A monthly plan lets you check each change as it ships, instead of paying for a large engagement that is out of date within weeks.

Do you need Cyber Essentials as well as a pentest? Compare plans on /pricing.