Penetration testing cost for a UK SME in 2026 runs from roughly £2,500 for a single external network test to £15,000+ for a full-scope web app, API, and internal network engagement — and most of that spread comes down to how tightly you scope the work before you ask for a quote.
Why this matters
Most SMEs get their first penetration testing quote and panic. A number like £9,000 for a "quick test" looks arbitrary until you understand what's driving it: number of IP addresses, application complexity, and whether retesting is included.
Budgeting for penetration testing isn't about finding the cheapest provider. It's about matching spend to what your certification, insurer, or customer actually requires — and not paying for scope you don't need.
Get the scoping wrong and you'll either overpay for an engagement that tests systems nobody cares about, or underpay and fail your Cyber Essentials Plus audit or your next customer security questionnaire.
What you'll need
- Asset inventory: IP ranges, domains, apps, and cloud accounts in scope
- A driver — Cyber Essentials Plus audit, ISO 27001 certification, a customer security questionnaire, or a cyber insurance renewal
- Last year's test report, if one exists, to compare scope creep or shrinkage
- Three quotes from CREST or CHECK-accredited providers, requested against the same scope document
- A retest budget line — most providers charge separately for verifying fixes
- Internal time: 4-8 hours from IT or engineering to support the tester during the engagement
The steps
1. Define what's actually driving the test
A Cyber Essentials Plus audit needs a narrower test than an ISO 27001 certification or a customer contract that specifies annual penetration testing. Nail this down first because it sets the entire budget ceiling.
If a customer questionnaire is the trigger, check the exact wording — many only require an "external infrastructure test," not a full web app engagement. That distinction alone can save £3,000-£5,000.
Common mistake: budgeting for the most expensive test type "just in case" instead of confirming what's contractually required.
2. Build the asset inventory before you ask for quotes
Count your external IP addresses, list every customer-facing application, and flag any cloud environments — AWS, Azure, GCP — that hold production data. Testers price per IP, per app, and per day, so a vague scope produces vague, inflated quotes.
SMEs with a handful of external IPs and one web app usually land in the £2,500-£6,000 band for 2026. Add a second application, API endpoints, or cloud infrastructure and AWS environments into scope and costs climb toward £8,000-£12,000.
Common mistake: listing every server the business owns instead of only what's internet-facing or in-scope for the certification.
3. Get three quotes against the identical scope document
Write one scope document and send it to three CREST or CHECK-accredited providers unchanged. Quotes that vary by more than 20% against the same scope usually mean one provider is padding days or another is underscoping to win the deal.
Day rates for CREST-certified testers sit at £800-£1,200 in the UK market as of 2026. A test quoted at £1,500/day with no clear justification deserves a follow-up question before you sign anything.
Common mistake: accepting the cheapest quote without checking whether it covers the same number of test days as the others.
4. Separate the test fee from the retest fee
Most providers charge £500-£1,500 extra to retest and confirm remediated vulnerabilities. Skip this line item and you'll either pay it unexpectedly later or submit an uncertified report to your auditor.
Build retesting into the original budget, not as an afterthought after the first report lands with findings you need to fix.
Common mistake: assuming the report itself proves remediation — auditors and most insurers want a signed-off retest.
5. Scope web applications and APIs separately from infrastructure
If your product is a web app or exposes APIs, that's a different test type than external network testing, priced separately. Web application and API testing typically adds £4,000-£10,000 depending on the number of authenticated roles and endpoints.
SaaS companies pursuing SOC 2 or ISO 27001 usually need this test type even when their infrastructure footprint is small — the application is the attack surface that matters to customers.
Common mistake: budgeting only for network testing when your actual risk sits in the application layer.
6. Allocate 8-12% of your annual compliance spend to testing
For SMEs running an active ISO 27001 or Cyber Essentials Plus programme, penetration testing is a recurring line item, not a one-off. Budgeting 8-12% of total annual compliance spend for testing keeps the number predictable instead of a surprise each renewal cycle.
This ratio holds whether you're spending £15,000 or £60,000 a year on compliance overall — the test cost scales with the same asset footprint driving the rest of your spend.
Common mistake: treating penetration testing as a one-time certification cost instead of an annual line item.
7. Compare providers on accreditation, not just price
CREST and CHECK accreditation isn't optional for most UK certification bodies — an unaccredited tester's report may get rejected outright by your ISO 27001 or Cyber Essentials Plus auditor. Check the CREST-approved penetration testing companies before comparing day rates.
A £1,000 saving on an unaccredited provider costs more when the report gets rejected and you pay for a second test.
Common mistake: picking the lowest quote without confirming the provider holds current CREST or CHECK status.
Scope your next audit with confidence
See how OneClickComply automates evidence collection between penetration test cycles.
Troubleshooting
Problem: quotes vary wildly across providers for the same scope. Cause is usually inconsistent day counts. Ask each provider to break down days by test phase — reconnaissance, testing, reporting — and compare like for like.
Problem: the test report gets rejected by your auditor. Check the provider's accreditation status first. ISO 27001 and Cyber Essentials Plus auditors in 2026 generally require CREST or CHECK-certified testers, not just "experienced" freelancers.
Problem: budget approved but scope changes mid-quarter. New product launches or added cloud environments change the asset count. Re-run the scoping exercise before the engagement starts rather than absorbing the change as scope creep during testing.
Problem: retest costs weren't budgeted. Add a fixed retest line — £500-£1,500 — to every future quote request so it's never a surprise.
Problem: findings from the test never get remediated in time for the audit. Build a fixed remediation window (2-4 weeks) between the test date and your certification audit date, not back to back.
Tools and resources
- Asset inventory spreadsheet template (IPs, domains, apps, cloud accounts)
- A written scope document — see how to scope a penetration test before you buy one for the exact fields to include
- CREST and CHECK accreditation registers to verify provider status
- OneClickComply for tracking remediation evidence and audit readiness between test cycles
What to do next
Once the budget is set and the scope document is signed off, the next decision is which provider to book. Compare accredited firms against price, turnaround time, and retest inclusion before you send the purchase order.
Frequently asked questions
One last thing
The single biggest cost driver isn't the provider you pick — it's whether your scope document exists before you ask for quotes. SMEs that scope first and quote second consistently land 15-25% below those who ask providers to "scope it for us," because an outside firm has every incentive to quote the larger engagement.