How to choose a penetration testing company in the UK.

A customer, an insurer or an auditor has asked for a penetration test. Now you have to pick a penetration testing company in the UK, and you have weeks, not months. Most advice on choosing one is written by the supplier it recommends. So is this. The difference is that the second section tells you when not to hire us.

There are three ways to get this wrong. Buying a logo. Buying by page count. Buying before you have scoped.

Decide who reads the result before you decide who writes it

A pentest is bought as evidence for a specific reader. Name that reader first.

An enterprise customer’s security team wants reproduction steps, two-account proof and a re-test statement their own pentester can check. An ISO 27001 auditor wants access-control validation mapped to ISO/IEC 27001 Annex A. A QSA wants a scope statement that matches the CDE and a tester the QSA accepts. A SOC 2 questionnaire wants a date, a scope and a letter of attestation. The ICO, after an incident, reads for whether you knew the class of issue existed, had tested for it, and had fixed and verified the fix — our reading, set out in UK GDPR and the ICO. A Cyber Essentials Plus assessor wants none of this: CE+ is a technical audit of five controls on sampled devices, and neither replaces the other, as Cyber Essentials is not a pentest explains.

Five artefacts from one engagement. A supplier who quotes before asking who it is for is selling days.

Rule out the regulated cases first

Three situations take the choice out of your hands. We do not hold CREST, NCSC CHECK or IASME certification. We say so on the first call, not in a footer.

CHECK-mandated work. NCSC describes CHECK as the scheme for authorised penetration tests of public sector and critical national infrastructure systems, and says central government systems at OFFICIAL and above should be assessed by CHECK companies. NCSC lists every assured CHECK provider on its own site, with a search tool.

A tender that names CREST as a condition of contract. Then you need a CREST member company. CREST describes accreditation as an annual cycle with an enforceable code of conduct and an assessed methodology. Logos are copied. Registers are not. Verify the claim on the CREST Marketplace. Look for the supplier’s profile, check that the legal entity matches the one on your contract, and check that penetration testing, not a neighbouring service, is among the accreditations listed. A supplier who claims the status and is not on the register has told you enough.

Regulated red teaming. CBEST is the Bank of England, PRA and FCA framework for threat-led testing of systemic UK firms. STAR-FS extends intelligence-led testing to non-systemic UK financial firms. TIBER-EU is the Eurosystem framework, updated in 2025 to align with DORA. Whether it reaches a UK firm is a question for that firm’s supervisor, not for this article. The CBEST implementation guide says the register of approved providers is published on the CREST website. If your supervisor named one of these, you are buying a programme, not a pentest, under that framework.

If none of those apply, certification becomes a quality question rather than a contractual one.

Scope before you shop

A buyer emails five firms with “we need a pentest, please quote.” Five quotes come back for five different things. The cheapest wins. Three weeks later the customer’s pentester asks why the API was out of scope.

Before the first call, write down the assets (domains, APIs, apps, cloud accounts, IP ranges), the roles, the number of tenants, what is out of bounds and the dates that would hurt. Decide whether staging is a true copy of production or a different system wearing its clothes. Name the person who picks up if something behaves unexpectedly at 16:00 on a Friday.

Decide which engagement you are buying: a web application test, an API test, a mobile test, a cloud security test, an external and internal network test or a thick-client test. The services page has a decision guide if your customer’s request was vague.

NCSC’s penetration testing guidance puts the risk owners, the technical staff who know the target and a representative of the test team in the scoping conversation, and sends the report to your own vulnerability management group with fix decisions remaining yours. A scoping call with only a salesperson in it is a sales call.

Shortlist a UK penetration testing company on method, not on logo

Supplier directories lead with logos. Sort by method instead. Three questions.

What decides whether something is a finding? The right answer is a person who reproduced it by hand. Scanners run alongside an engagement to cover breadth. They should never decide what goes in the report. If the sample report is 400 rows and no narrative, you are looking at a vulnerability assessment sold at pentest prices.

How many accounts will you need? Most UK SaaS products do not fail because of a 2014 SQLi. The finding that delays a UK deal is authorisation — user 2 reading user 1’s invoices by changing a UUID they were never meant to know. Proving that needs two accounts at the same privilege level plus one per role, and one account that should have no access at all, because the most useful proof is often the request that should have returned 403 and returned 200.

What does proof look like? Bounded. A few rows, a screenshot, a replay script. A supplier who proves impact by extracting the database, encrypting a share or leaving persistence behind has created an incident to demonstrate one. The proof standard belongs in the authorisation letter, alongside agreed rate limits, what happens when something degrades and when you hear about a critical finding. The right answers are “we stop and tell you” and “the day it is confirmed.”

Our answers are on the methodology page. Hold the rest of the list to the same three questions.

The legal basis is a disqualifying question

Unauthorised access to computer material is an offence under section 1 of the Computer Misuse Act 1990. An unauthorised act intended to impair a computer, or reckless as to whether it will, is an offence under section 3. Section 17 defines access as unauthorised when the person is not entitled to control access and does not have consent from someone who is.

That is the clause the authorisation letter exists to satisfy. Under the Act, access is authorised because the party entitled to control the system consented. Section 17 speaks of consent, not of writing. That is a tester’s reading of the statute, not legal advice. Your counsel’s reading wins over a blog post — including this one. Get it in writing anyway. A signed letter is the clearest evidence either side will have if anyone asks later.

The letter should name the assets, the identities, the hours, what is out of scope and how data will be handled. You sign. The supplier counter-signs. No packet is sent before it exists. A supplier who offers to start before the letter is signed — to save time, to run a surprise test, to make a detection exercise more realistic — is disqualified. Not marked down. Disqualified. Someone senior on your side must know a test is happening even when the security team is not told, and the letter has to exist either way.

If a third party hosts an asset — a partner’s API, a cloud workload, a hosting provider’s IP range — the supplier should confirm you are entitled to authorise testing of it before starting. Your consent is only worth what you control. When an agency commissions for a UK end-client, the agency contracts, the end-client is the beneficiary of the attestation letter and the asset owner still signs the authorisation.

Ask for these five things before you sign

A sample report. Redacted is fine. Read the executive summary as the director who will receive yours. They should finish it in five minutes and know whether to sign off. Then read one finding end to end: a CVSS v3.1 vector, the affected asset, exact reproduction steps, evidence, impact and a specific fix rather than “implement input validation.” Ask which CVSS version they use — FIRST publishes v4.0 alongside v3.1 — and whether adjustments from the base score are explained. A score with no vector is an opinion. Look for a coverage statement: what was not tested, and why. OWASP’s Web Security Testing Guide puts it plainly: “The quality of the technical testing is completely irrelevant if the client can’t understand your findings.”

A name. Who will run the keyboard. Not the pre-sales engineer. Not the practice lead. The person. Ask whether they will be on your job for the whole window and whether the name goes in the statement of work. At VAPT.UK the person at the keyboard is Hassan Jawaid, every time. The UK Cyber Security Council publishes a public professional register; if a supplier says its tester holds a Security Testing title, that is where to check it.

The re-test, in the fee. CREST’s programme guide says remediation should include agreeing short-term re-testing or verification. Ask whether re-testing confirmed findings is included or a change request, and what you receive afterwards — your customer or auditor wants a closure statement or sign-off letter. A test without a verified fix is half the evidence.

Insurance. Ask for the professional indemnity certificate, not the sentence on the website. We will not print a typical figure here, because we know of no UK body that publishes one for testing suppliers. Your own risk owner decides whether the figure on the certificate fits the engagement.

Data handling. What they collect, where it sits, who can see it and when it is deleted. UK GDPR applies to the engagement file too. The ICO’s guide to data security expects testing results to be recorded and acted on.

How certifications map to what you need

Each certification answers a different question. Match it to yours, then stop.

CREST company membership is a firm-level status. The accreditation standard examines professional indemnity insurance, contract management, complaint handling and conflict-of-interest policy. That is an assurance about the organisation, not about the individual on your job.

Individual CREST qualifications answer the tester question. CPSA is the entry-level written exam, CRT the intermediate practical, and CCT Infrastructure and CCT Application the senior exams with a written paper and a separate practical each. CREST’s own programme guide names both gaps: an accredited provider may not use qualified individuals, and a qualified individual at an unaccredited firm gives fewer assurances.

Any other individual exam is the same kind of thing: a statement about one person on one day. It says nothing about how a firm scopes, contracts, handles your data or writes for your board.

CHECK Team Leader is a role within the NCSC scheme. NCSC requires a UK Cyber Security Council Security Testing title at Principal or above, plus SC clearance. If you are a UK SaaS company selling to other companies, it is unlikely to apply unless a customer’s contract says so. If you are a central government department, NCSC says it should.

None of these substitutes for a sample report and a name. A certificate says the person once passed an exam. A sample report says what they did last month. What we have is a public record: 1,000+ vulnerabilities across 100+ bug bounty programmes, a Bugcrowd rank of #465 at 89.3% accuracy, and an about page that lists the rest without a logo we have not earned. Weigh that against a CREST member the same way: by reading what each has written.

How to read a quote

A pentest quote is a number of days against a defined scope. The quote should say how many testing days, on which assets, with which accounts and how many days reporting adds. If it says “comprehensive” and never says “days”, ask again.

For calibration, our own windows are in the questions at the end of this article.

If one quote is half of the others, ask what was removed. Usually it is the second account, the re-test or the manual time. A fixed quote in pounds sterling after a thirty-minute scoping call is a reasonable expectation. Page counts, per-seat and per-IP pricing for a web application usually mean the supplier priced the brochure, not the work.

Dates lock on the scoping call. The critical path is almost always your side: provisioning the test accounts and getting the authorisation letter signed.

Red flags in a penetration testing proposal

• The supplier will start before the authorisation letter is signed.
• The sample report is a scanner export with a cover page, or there is no sample report.
• The scoping call asked for one admin account and nothing about roles or tenants.
• The website prints a CREST or CHECK mark that does not match the register.
• The proposal promises “certified secure”, “hacker-proof”, “CAF compliant” or a guaranteed audit pass.
• Proof of impact means a bulk data export or persistence left behind.

Ten questions for every shortlisted supplier

Put them to each supplier in the same words and compare the answers side by side.

1. Who is this report for, and what will they do with it?
2. Is CREST or CHECK a condition of this contract, and if so, where is your register entry?
3. Who will run the testing, for the whole window, and does the name go in the statement of work?
4. How many accounts and roles do you need, and what becomes unprovable with fewer?
5. What decides whether something is a finding?
6. What does proof look like, and where do you stop?
7. Can we see your Computer Misuse Act 1990 authorisation letter template? No template, no engagement.
8. Is the re-test included, and what do we receive after it?
9. How many testing days, on what and how many days for reporting?
10. What do you collect, where does it live and when is it deleted?

Where this leaves you

Choosing a penetration testing company is a sequence, not a logo. Name the reader. Rule out the regulated cases. Scope on paper. Shortlist on method. Read a sample report and a name before a certificate. Count the days in the quote. If that lands on us, a thirty-minute scoping call gets you a fixed quote in pounds sterling. If it lands on a CREST member or a CHECK company, we would rather you knew on the first call than after the contract.

Questions

Questions this usually raises