Penetration testing for UK organisations, done by hand and proven.
Our testers attack your applications, APIs, cloud accounts, networks and Microsoft identity estate with your written permission, in windows agreed in UK time. You get confirmed findings, clear fixes and evidence you can file for ISO 27001, UK GDPR or a client questionnaire.
- People test, tools assist
- Fixed fee, ex VAT
- Retest of fixes at no charge
- Overlaps the UK working day
GET /statementsAlertedEntra IDOpenVPNFixed/loginFixedIllustrative example. No real client data.
Methods and UK frameworks our reports map to
- PTES
- OWASP WSTG
- OWASP MASVS
- OWASP API Top 10
- MITRE ATT&CK
- CVSS v4.0
- ISO/IEC 27001:2022
- UK GDPR Art. 32
- PCI DSS v4.0.1
- Cyber Essentials controls
- NHS DSPT
- FCA · PRA resilience
Twenty test types, grouped into four practices
We sell no monitoring and no software. Everything below is offensive testing, from a single API check to a multi-week red team.
Application Testing
Web apps, APIs, mobile and desktop clients, source code and AI features, tested role by role for the flaws automated tools overlook.
Infrastructure & Cloud
Perimeter, internal networks, Active Directory, cloud accounts, Kubernetes, Wi-Fi and connected devices.
Adversary Simulation
Objective-led red teaming, people-focused social engineering and collaborative purple team exercises.
Testing Programmes
Combined VAPT, year-round continuous testing, audit-driven pentests and verification of your fixes.
Five steps from enquiry to closed findings
Every step ends with something in writing, and every date is set in UK time.
- Scope
A short call to list targets, roles and deadlines, then a fixed GBP price.
- Authorise
Someone entitled to approve signs the authorisation and rules of engagement.
- Test
Manual testing in the agreed window, with criticals reported as soon as confirmed.
- Report
Evidence, CVSS 4.0 ratings and fixes, followed by a call to walk through them.
- Retest
We check what you fixed at no charge and issue a dated letter.
Where a pentest report earns its keep in the UK
Few UK rules say "buy a penetration test". Many ask you to show that security controls are checked. A dated report with retested fixes is the plainest way to do that.
UK GDPR Article 32
Expects a process for regularly testing, assessing and evaluating how well your security measures work. Testing the systems that hold personal data is direct evidence.
ISO/IEC 27001:2022
Annex A 8.8 covers technical vulnerability management and 8.29 covers security testing in development and acceptance. See our ISO 27001 guide.
PCI DSS v4.0.1
Requirement 11.4 asks for internal and external tests every year and after significant change, plus regular checks that segmentation holds.
FCA and PRA resilience
SYSC 15A has firms name their important business services, fix an impact tolerance for each and test scenarios against them. Targeted testing feeds that work.
NHS DSPT
Anyone able to reach NHS patient data or NHS systems submits the toolkit annually. Test results help support the technical answers.
Insurers and buyers
Renewal forms and supplier questionnaires ask how you test. Our cyber insurance guide covers what a report can show.
We don't claim CREST, CHECK or PCI QSA status. If a contract or regulator names one, bring it up when we scope the work and we will tell you plainly if we can meet it.
Write-ups an engineer can act on alone
Each finding says where it is, how we confirmed it, what it would let someone do and what change closes it. We start from CVSS 4.0 and then weigh your data and exposure, so the fix order reflects your business rather than a generic score.
- Exact requests, steps and screenshots to reproduce each issue
- Fix advice that suits your framework and hosting
- CWE and OWASP references on every item
- Status column updated after the retest
Example finding · Illustrative
See a likely price before the first call
The calculator converts scope into tester-days at typical UK day rates of roughly £750 to £1,500, then shows a range excluding VAT. Small UK projects usually start near £2,500 for an external, API or wireless test and near £3,750 for web, mobile or cloud.
What pushes the price up or down
Only testing, so testing gets our full attention
When a pentest is a side line in a wider IT contract, it tends to shrink to a scan. Ours is the whole business.
Each role tried
We log in as every type of user you have and test whether the boundaries between them hold.
Paths, not piles
Three minor issues that combine into a breach get reported as one real story.
Microsoft-heavy estates
Hybrid Active Directory, Entra ID, Azure and Microsoft 365 are daily work in UK testing.
Confirmed only
No unverified scanner output. A tester checked every item that reaches your report.
A pentest report is sensitive. So is everything behind it.
These safeguards come with every engagement, from a two-day API test upwards.
Safeguards on every test
- Signed authorisation in place before any testing, as the Computer Misuse Act 1990 expects
- Mutual NDA on request, before you share architecture or code
- Evidence stored encrypted and limited to the testers on your job
- Reports delivered through a controlled channel, not loose email attachments
- Accounts you lent us are switched off or handed back at close
- Our working copies are destroyed once your chosen retention period ends
Fixed GBP price
Scope and fee agreed in writing before testing starts, quoted excluding VAT.
Retest included
When you have fixed reported issues, we confirm them without a further fee.
Live critical alerts
Confirmed criticals reach the person you nominate straight away.
UK-day overlap
India is 4.5 hours ahead in summer and 5.5 in winter, so our days overlap yours.
Each sector has its own crown jewels
Regulators, customers and attackers look at different things in each industry, so the scope shifts with them.
Financial services and fintech
Open banking APIs, payments logic and operational resilience.
SaaS and technology
Tenant isolation plus evidence for ISO 27001 and SOC 2.
Healthcare and NHS suppliers
Patient data, clinical integrations and DSPT answers.
Retail and e-commerce
Checkout abuse, loyalty fraud and PCI DSS testing.
Public sector suppliers, education and charities
Procurement questionnaires and Cyber Essentials Plus preparation.
Manufacturing and logistics
Plant networks, warehouse systems and vendor access.
Useful reading before you commission a test
Written by working testers: audit evidence, insurer questions, scoping and retests.
Penetration Testing for ISO 27001: Evidence for Annex A 8.8 and 8.29
How a penetration test supports ISO/IEC 27001:2022 Annex A 8.8 and 8.29, how to scope it for a UK certification audit and how often to…
Read articleHow a Penetration Test Helps with Cyber Insurance Proposals and Renewals
How a penetration test helps UK organisations answer cyber insurance proposal forms and renewal questions on MFA, patching, backups, EDR and…
Read articleHow to Scope a Penetration Test Without Wasting Tester-Days
A scoping worksheet for UK pentest buyers: objectives, assets, test accounts, authorisation and tester-day sizing before you ask providers for a…
Read articleHow Often Should You Run a Penetration Test?
How UK organisations set penetration testing frequency around release pace, risk and duties such as PCI DSS, ISO 27001 and UK GDPR Article…
Read articlePentest RFP Questions That Separate Strong Providers from Weak Ones
What to ask penetration testing providers in a UK tender: method, testers, reporting, retesting, data handling, accreditation claims and pricing ex…
Read articleFrom Report to Resolved: Remediation and Retesting After a Pentest
A practical plan for UK teams after a pentest: triage, owners, fix dates, retests and the evidence auditors, insurers and enterprise customers ask to…
Read articleQuestions UK buyers ask us
Who is behind PentestProviders UK?
PentestProviders is the penetration-testing brand of BugFoe Private Limited, a cybersecurity company incorporated in India in 2021 and based in Ahmedabad, Gujarat. We deliver remotely to UK clients. More on the about page.
How do you fit around the UK working day?
India is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours ahead in winter, so our working days overlap. Testing windows are agreed in UK time at scoping, and critical issues are passed to your nominated contact the moment we confirm them.
What does a UK penetration test usually cost?
UK tester-day rates commonly fall between about £750 and £1,500. Small UK projects typically start near £2,500 for an external, API or wireless test, or near £3,750 when the target is a web application, mobile app or cloud account. Our cost calculator gives a range in GBP, excluding VAT.
Is a pentest the same as Cyber Essentials Plus?
No. For Cyber Essentials Plus, a Certification Body audits the scheme's five controls on your actual devices and systems. A penetration test looks for ways to chain weaknesses into real compromise. Plenty of organisations do both, and our findings can help you prepare for the audit.
Are you CREST or CHECK accredited?
No, we don't claim either. CREST accreditation is an industry scheme that no UK law makes compulsory; CHECK applies to UK government, public-sector and CNI systems. If a contract names one, raise it at scoping and you'll get a plain answer on whether we can meet it.
What has to be in place before you begin?
A clear scope, test accounts where relevant, and written authorisation signed by someone entitled to give it, as the Computer Misuse Act 1990 requires. Our guide to scoping a pentest walks through the rest.
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request