A penetration test that only pokes at your login page isn't a penetration test — it's a false sense of security. If your product ships a web app and an API in 2026, both need separate, documented attack paths tested before you can call the exercise complete.
Why this matters
Customers, auditors, and cyber insurers now ask for a penetration test report by name — not a vulnerability scan printout. ISO 27001 Annex A control 8.29 expects security testing during development; SOC 2 assessors expect an annual test with a retest; Cyber Essentials Plus assessors expect external and internal checks that go beyond a scan.
Most buyers get burned on scope, not on the tester's skill. If you haven't fixed your scope document yet, scope the penetration test properly before you buy one — a vague scope is the single biggest reason companies pay twice for the same test in 2026.
Who this is for
This guide is for engineering leads, founders, and security-adjacent operators at UK software companies who need a web application and API penetration test to close a customer security questionnaire, pass an ISO 27001 or SOC 2 audit, or satisfy a contract clause. If you're comparing quotes right now and the numbers don't line up, the difference is almost always scope, not price.
What to look for in a web app and API penetration test
OWASP Top 10 and API Security Top 10 coverage
A proper test checks your web app against the OWASP Top 10 and your API against the separate OWASP API Security Top 10 — two different lists, two different attack surfaces. A provider quoting one list and calling it complete is testing half your product.
CREST or CHECK accreditation
Accreditation tells you the tester passed a standardised exam and the firm carries professional indemnity cover. For any 2026 contract involving customer data, insurers and enterprise buyers will ask for this by name.
Authenticated testing across every role
An unauthenticated scan tells you what an anonymous visitor sees. Real risk lives in what an authenticated user, an admin, or a compromised low-privilege account can reach — test every role, not just the front door.
A retest built into the scope
Findings without a retest are a to-do list, not proof of a fix. Confirm the quote includes one retest of critical and high findings before you sign, not as a paid add-on afterward.
Reporting mapped to your compliance framework
A report that maps findings to ISO 27001 Annex A, SOC 2 trust criteria, or Cyber Essentials Plus requirements saves you weeks of translation work at audit time. A generic PDF with a traffic-light table does not.
API endpoints tested separately from the UI
Your API is not "covered" because the web app that calls it was tested. Broken object-level authorisation and injection flaws live in endpoints the UI never touches — insist the scope names them individually.
Top picks by buyer profile
The compliance-first pick — for SaaS teams targeting ISO 27001 or SOC 2 in 2026. Look for a report mapped directly to Annex A.8.29 and trust services criteria, with findings pre-formatted for your auditor. One spec that matters: does the report separate "informational" from "exploitable" findings, since auditors only care about the latter. Verdict: Buy.
The volume pick — for MSPs running tests across multiple client environments on a rolling calendar. The right fit scopes each client stack separately rather than bundling them into one generic statement of work, which is exactly what penetration testing services for MSPs with multiple clients walks through. One number that matters: how many concurrent client scopes the provider can run without pushing your retest window past 30 days. Verdict: Buy.
The regulated-sector pick — for fintech startups under FCA scrutiny where a template report gets rejected on sight. Demand a named CREST-registered consultant on the cover page, not "our security team." Verdict: Consider — worth the premium if you're raising or renewing a banking partnership this year, skip it if you're pre-revenue.
The public-sector pick — for NHS and G-Cloud suppliers where the buyer's own framework dictates test cadence and reporting format. Confirm the provider has actually delivered against that specific framework before, not just "public sector experience" in general. Verdict: Consider.
The default pick — for general UK SMEs comparing three or four quotes with no specific framework pressure yet. Start with a side-by-side using the best penetration testing companies for UK small businesses before you commit to a statement of work. Verdict: Buy — this is the safest starting point if you've never bought a test before.
Turn your pentest report into audit evidence
OneClickComply automates the evidence collection your ISO 27001, SOC 2, or Cyber Essentials Plus audit needs.
What to avoid
- An automated scan sold as a penetration test. If the deliverable is a Nessus or OpenVAS export with a logo slapped on it, you paid for a scan, not manual testing.
- Fixed-fee reports with no named tester. Anonymous "our team" reports are the first thing an auditor or enterprise procurement team will flag in 2026.
- A one-off test with no retest before your audit date. Findings without a retest are unresolved findings — your ISO 27001 or SOC 2 assessor will ask for proof of the fix, not just the ticket.
Verdict comparison
| Pick | Best for | Retest included | Maps to compliance | Verdict |
|---|---|---|---|---|
| Compliance-first | ISO 27001 / SOC 2 teams | Yes, standard | Annex A.8.29, SOC 2 | Buy |
| Volume (MSP) | Multi-client providers | Per-client scope | Varies by client | Buy |
| Regulated-sector | Fintech under FCA | Yes, named consultant | FCA-aligned | Consider |
| Public-sector | NHS / G-Cloud suppliers | Framework-dependent | Framework-specific | Consider |
| Default | First-time buyers | Confirm before signing | Generic | Buy |
Frequently asked questions
One last thing
Most rejected pentest reports in 2026 get rejected for the same reason: the API was never named in the scope, so the tester never touched it. Before you sign anything, make the provider list every API endpoint by name in the statement of work — not "API testing included" as a single line item.