Question 1

How much does a penetration test cost?

Accepted Answer

Penetration testing costs range from £3,500 for a narrow-scope API test to £100,000+ for a full red team engagement. The three main variables are test type, scope, and provider tier. A standard web application test for a mid-market company at a boutique firm costs £8,000–£18,000 in the UK ($10,000–$22,000 in the US). Use our calculator on the homepage for a scoped estimate.

Question 2

What is the average cost of a penetration test in the UK?

Accepted Answer

The UK average for a standard 5-day web application pentest at a boutique CREST-accredited firm is £8,000–£15,000 in 2026. Day rates range from £800/day (freelancer, mostly automated) to £3,500+/day (Big 4 enterprise consultancy). A fair manual pentest from a boutique firm costs £1,000–£1,800/day in the UK.

Question 3

What is the average cost of a penetration test in the US?

Accepted Answer

US market rates for a standard web application pentest at a boutique firm are $10,000–$22,000 for a mid-market engagement. US day rates run $1,200–$2,500/day for boutique firms, $2,500–$5,000+/day for enterprise consultancies. The US market is roughly 20–30% more expensive than equivalent UK engagements at comparable tiers.

Question 4

Why do pentest prices vary so much?

Accepted Answer

Prices vary by seven main factors: test type (social engineering vs red team is a 10× difference), scope (10 assets vs 200+), company size, compliance requirements (PCI DSS adds 20–35%), provider tier (freelancer vs Big 4 is a 3–5× difference), engagement model (black vs white-box), and urgency. The wide £3,000–£100,000+ range is not vagueness — it genuinely reflects these variables.

Question 5

What is the difference between a cheap pentest and an expensive one?

Accepted Answer

Below £3,000: almost certainly an automated scan (Nessus/Qualys) with a cover page. No manual exploitation. Will not satisfy PCI DSS or SOC 2 auditors. £5,000–£15,000: genuine manual testing from a boutique CREST firm. Finds logic flaws, chained attacks, and business context vulnerabilities. £20,000+: compliance-specific evidence packaging, senior tester, deeper scope, or Big 4 brand premium. The day-rate calculator on our quote evaluation page helps assess any specific quote.

Question 6

Can I get a free penetration test?

Accepted Answer

Sort of. Some PTaaS platforms offer free trials (Intruder has a 14-day free trial for vulnerability scanning). Bug bounty programs can theoretically surface findings without upfront cost. But a genuine manual penetration test cannot be free — it requires 3–10 days of expert time at market rate. 'Free pentest' offers are almost always automated scan outputs or heavily limited scope assessments with an upsell.

Question 7

How long does a penetration test take?

Accepted Answer

Consultant engagement days by test type: web application 5–10 days, network 3–5 days, cloud infrastructure 5–10 days, mobile app 5–8 days, API 3–6 days, red team 2–8 weeks, social engineering 1–3 weeks. Total elapsed time from contract to final report is typically 4–8 weeks — scoping takes 1–2 weeks, testing 1–2 weeks, reporting 1–2 weeks, and re-test window 2–4 weeks.

Question 8

What happens during a penetration test?

Accepted Answer

Phase 1: Scoping call (1–2 hours) to define scope, rules of engagement, and methodology. Phase 2: Reconnaissance — passive and active information gathering. Phase 3: Scanning and enumeration — automated tooling to identify attack surface. Phase 4: Manual exploitation — tester attempts to exploit identified vulnerabilities. Phase 5: Post-exploitation — demonstrating impact (credential exfiltration, lateral movement). Phase 6: Reporting — CVSS-scored findings with PoC evidence and remediation guidance. Phase 7: Re-test — verification that critical/high findings are resolved.

Question 9

What is included in a penetration test report?

Accepted Answer

A quality pentest report includes: (1) executive summary for non-technical stakeholders with risk rating and key findings, (2) scope and methodology documentation, (3) technical findings section with one page per finding — description, CVSS score, proof of concept, evidence screenshots, remediation guidance, (4) findings summary table sorted by severity, (5) retesting status tracking. Red flags: no executive summary, no CVSS scores, no PoC evidence, findings that could apply to any application (not your specific environment).

Question 10

What is the difference between black, grey, and white box testing?

Accepted Answer

Black-box: tester has no prior information — simulates an external attacker with no insider knowledge. Most realistic but finds fewer vulnerabilities due to limited context. Grey-box: tester receives some information (application credentials, limited architecture docs) — best balance of realism and coverage. Most common for web app and network tests. White-box: full access — source code, architecture diagrams, internal documentation — deepest coverage but adds 30–70% to cost and is less realistic from an attack simulation perspective.

Question 11

Do I need to be present during the penetration test?

Accepted Answer

Not throughout, but your technical point of contact needs to be reachable. You should be available for: (1) engagement kickoff call to confirm scope and rules of engagement, (2) critical finding escalation — if a tester finds an active breach or critical RCE, you need to know immediately, (3) mid-engagement check-in if requested, (4) report debrief call post-delivery. Expect 3–5 hours of your time across a typical 5-day engagement.

Question 12

How often should I run a penetration test?

Accepted Answer

Minimum annual for most organisations. PCI DSS: annual external pentest + quarterly internal vulnerability scans. SOC 2: annual to maintain Type II certification. ISO 27001: annual as best practice. High-change environments (multiple major releases per year): consider semi-annual. After major infrastructure changes (cloud migration, new application launch, significant architectural changes): ad-hoc retest. DORA: TLPT every 3 years for significant financial entities.

Question 13

Is penetration testing worth it for a small business?

Accepted Answer

Yes. IBM's Cost of a Data Breach 2024 puts the global average at $4.88M and US average at $9.36M per incident. A standard small business web app test costs £5,000–£10,000. If it finds and prevents a single exploitable authentication bypass that could have led to a breach, the ROI is 50–100×. The question is not whether pentesting is worth it — it's whether your organisation can absorb the cost of not testing.

Question 14

What is the ROI of a penetration test?

Accepted Answer

Direct ROI calculation: (Breach cost avoided × Probability of breach prevented) ÷ Pentest cost. At IBM's US average of $9.36M and even a 1% annual breach probability, expected value of prevention is $93,600/year — far exceeding a £10,000 pentest. Beyond breach prevention: PCI DSS/SOC 2 requirement fulfilment (necessary for operating), cyber insurance premium reduction (some insurers offer discounts for annual pentesting), and engineering team improvement (findings drive secure development practices).

Question 15

What happens if a pentest finds nothing?

Accepted Answer

A 'clean' pentest report from a reputable firm is a genuine assurance signal — it means a qualified expert tested your environment and found no exploitable vulnerabilities in scope. It does not mean your application is perfectly secure. Common reasons for few findings: narrow scope (only tested authentication, not full app), grey-box advantage (testers avoided guessing business logic), recently hardened environment. If you receive a clean report from a cheap provider, verify the implied day rate — it may be an automated scan.

Question 16

Does PCI DSS require a penetration test?

Accepted Answer

Yes. PCI DSS v4.0 Requirement 11.3 explicitly mandates annual external penetration testing of the cardholder data environment (CDE), plus testing after significant changes. The tester must be qualified — CREST accreditation or QSA certification is strongly preferred. A standard pentest report will often not satisfy a QSA — tell your provider it's for PCI DSS compliance at scoping stage. Typical cost: £8,000–£20,000 for a standard CDE scope.

Question 17

Does SOC 2 require a penetration test?

Accepted Answer

Not explicitly, but auditors increasingly require one. SOC 2 CC6.6 (network protection) evidence is most convincingly demonstrated through a pentest. A SOC 2 Type II report without pentest evidence puts you at risk of a qualified opinion from your auditor. Most tech companies targeting enterprise customers need a pentest to pass a rigorous Type II audit. Cost premium: 10–20% over standard pentest for audit-ready documentation.

Question 18

Does ISO 27001 require a penetration test?

Accepted Answer

Not explicitly, but Annex A 8.8 (technical vulnerability management) and 8.29 (secure development) together make a pentest the expected evidence mechanism. Certification bodies (BSI, Bureau Veritas) increasingly expect annual pentest evidence during surveillance audits. Without it, you may face non-conformity findings. Minimal cost premium over standard pentest — the main difference is ensuring your report references the ISO 27001 controls being addressed.

Question 19

What certifications should my pentester have?

Accepted Answer

Individual tester minimum: OSCP (Offensive Security Certified Professional) — proves practical exploitation skills. Better: CREST CRT/CCT or GPEN/GWAPT (GIAC). For compliance: organisation-level CREST accreditation for PCI DSS. For UK government work: NCSC CHECK scheme. For DORA TLPT: TIBER-EU qualified provider only. Always ask for individual tester credentials, not just company-level accreditation — the company's CREST membership doesn't guarantee the individual on your engagement is certified.

Question 20

Will my pentest report satisfy my auditor?

Accepted Answer

It depends on the report quality and whether it was scoped for compliance. Key requirements: executive summary for non-technical stakeholders, CVSS-scored findings with severity ratings, methodology documentation (OWASP/PTES/CREST), scope documentation matching your system description, evidence of manual testing (PoC screenshots, findings specific to your application), re-test evidence for critical/high findings. Tell your auditor which tester you are planning to use before the engagement — they may have specific requirements.

Penetration Testing FAQ (2026)

Cost Questions

Process Questions

Frequency & ROI

Compliance Questions