Penetration Testing UK: OSCP Testers for Private-Sector Companies
Penetration testing for UK companies is a manual, authorised attack on your web applications, APIs, networks and cloud, scoped to the goal in front of you: an ISO 27001 audit, a SOC 2 report, PCI DSS, a customer security questionnaire or your UK GDPR security obligations. Budget Security delivers it to companies in London, Manchester and across the UK remotely from The Hague: OSCP-certified testers, a start within 7 days of booking, and testing that runs in UK business hours.
Scope it yourself and see the tester-day estimate before anyone talks to you. Sign up or try the calculator.
One thing to know first: we are not CREST-accredited and not an NCSC CHECK provider. The CREST sections below explain what those schemes are, which buyers need them, and when an OSCP-led test is the right fit instead.
What we test for UK companies
Most UK buyers arrive with a document in hand: a customer's supplier security questionnaire, an ISO 27001 certification body asking for test evidence, or a SOC 2 auditor's request list. You register your assets once, pick the asset, the goal and a tester-day limit, and the scoping engine returns the plan, including what a shorter plan leaves untested and whether it still meets the goal you named.
Scope options for UK engagements:
- Web application penetration testing: authenticated and unauthenticated testing of customer portals, admin panels, role boundaries, tenant isolation and the sign-up and checkout flows that carry personal data.
- API penetration testing: the REST and GraphQL interfaces behind your web and mobile apps, partner integrations and open-banking connections.
- Network penetration testing: your internet-facing perimeter, then what an attacker reaches from inside over an authorised VPN: Active Directory, file shares and internal services.
- Cloud penetration testing: identity, configuration and privilege paths in AWS, Azure and Google Cloud accounts, including workloads hosted in UK regions.
Every engagement is manual testing by an OSCP-certified tester. Tooling handles discovery. Exploitation, business logic and attack chains are human work.
Penetration testing in London
London is where the UK's fintech, payments, insurance and B2B SaaS companies sit side by side with the banks and enterprises they sell to. For a London vendor, the scope is usually set by the customer, not the company: a procurement team sends a questionnaire, asks for a recent penetration test report, and wants to see that confirmed findings were retested and closed.
The report has to satisfy that customer's security team, so it names the methodology, rates each finding by severity with reproduction steps, and records retest status. For a regulated financial firm, check first whether your regulator expects a CBEST or STAR-FS assessment for the system in question (see the CREST sections below). If what you need is a pentest of a customer platform for ISO 27001, SOC 2 or a client questionnaire, that is the work we do.
A typical London engagement is a grey-box test of a customer-facing web application plus its API, 3 to 5 tester-days, with the cloud account added when the goal is ISO 27001 or SOC 2.
Penetration testing in Manchester
Manchester's mix is broader: digital agencies and software houses, e-commerce and retail, media and broadcast technology, health-tech, and professional-services firms with internal networks that have never been tested from the inside.
Two scopes come up most. Software and e-commerce companies need their web application and API tested before a major release or a large customer contract. Professional-services firms ask for an internal network test alongside the external one, because the question they want answered is not "can someone get in" but "what does someone reach once one laptop is compromised". That scope covers Active Directory, file shares, internal web services and the cloud identities tied to them.
CREST penetration testing: what CREST is and what it accredits
CREST describes itself as "an international not-for-profit, membership body representing the global cyber security industry", and says: "Since 2006, we have been leading the cyber security community." CREST (International) is "a not for profit company registered in the UK with company number 09805375", with a registered address in Coventry. Source: CREST, Who is CREST?.
CREST does two separate things, and UK buyers often blur them:
- It accredits companies. "We have over 500 accredited Member companies against a rigorous standard." A company is accredited per service, such as penetration testing, vulnerability assessment or incident response. When a tender asks for a "CREST-accredited supplier", this is what it means.
- It certifies individuals. "We also certify thousands of professionals worldwide, putting them through their paces in industry leading examinations." Source: CREST, Who is CREST?. The penetration testing certifications include the CREST Practitioner Security Analyst (CPSA), CREST Registered Penetration Tester (CRT), CREST Certified Tester - Infrastructure (CCT INF) and CREST Certified Tester - Application (CCT APP). Source: CREST, CREST certifications.
A "CREST pentest" in procurement language is a test delivered by an accredited member company, usually by testers who hold CREST certifications. Company accreditation and individual certification are separate, so check which one your requirement names.
How CREST accreditation works for companies and testers
For a company. "Organisations applying for CREST Accreditation must submit detailed evidence", which "includes documentation and examples covering company processes, service methodologies, and data security practices." The CREST Accreditation Team reviews each application, gives feedback where improvements are needed, and "once an application meets the required standards, accreditation is awarded." It is not a one-off: "Accredited companies must maintain their standards and undergo periodic reassessments." Source: CREST, What is accreditation?.
Members also "abide by our enforceable Codes of Conduct and Ethics and our Complaints and Resolution Measures", and applications examine "complaint handing and conflict of interest policies". Source: CREST, Why use a CREST supplier?. For a buyer, that complaints route is one of the practical benefits: there is a body to escalate to if a supplier's work falls short.
For a tester. CREST examinations run at three levels. "The CREST Practitioner level examinations are the entry level professional exams", aimed at around 2,500 hours of experience. The Registered level is "the next step", at around 6,000 hours. The Certified level is "designed to set the benchmark for senior professionals", at around 10,000 hours. CREST notes "the above timescales are recommended, not mandatory." Source: CREST, About CREST certifications. The CRT, for example, "is an intermediate level examination" and "remains a practical assessment consisting of multiple choice, flags and short form answers", with a duration of 2.5 hours. Source: CREST, CREST Registered Penetration Tester.
CREST, CHECK, CBEST and STAR-FS: where UK buyers ask for them
A common view in the UK market is that you need CREST to work for the UK government. The official wording is more specific, and the scheme it points to is CHECK, which belongs to the NCSC, not CREST.
NCSC CHECK. "CHECK is the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks." Source: NCSC, CHECK penetration testing. The NCSC's guidance: "The NCSC recommends that HMG organisations use testers and companies which are part of the CHECK scheme." Source: NCSC, Penetration testing. Note the word is "recommends".
IT Health Checks for the PSN. For an ITHC supporting a PSN compliance submission, central government organisations "should ensure their chosen partner is part of" CHECK, and "for non-central government customers, Tiger Scheme, CREST-approved ITHC services or the Cyber Scheme can be utilised". Source: GOV.UK, IT Health Check (ITHC): supporting guidance. So CREST does appear in government work, as one of three accepted routes for councils and other non-central bodies.
CBEST and STAR-FS. The Bank of England describes CBEST as "a framework for regulators to work with firms using a simulated cyberattack", in which "an accredited service provider carries out the simulation". Source: Bank of England, Operational resilience of the financial sector. Its implementation guide names CREST as "the CBEST Accreditation and Certification body". Source: Bank of England, CBEST implementation guide. CREST's supplier directory lists "UK BoE CBEST Threat Led Penetration Testing" and "UK BoE STAR-FS Threat Led Penetration Testing" as assured services held by specific member companies. Source: CREST Marketplace, for example NCC Group's listing.
Procurement questionnaires. Outside those schemes, "CREST-accredited" is something a buyer chooses to ask for. CREST's own pitch to buyers is that "our member companies are accredited and quality assured against measurable and enforceable standards and competencies." Source: CREST, Why use a CREST supplier?. If your customer's questionnaire names CREST, use a CREST member.
Where that leaves you: a government department, public sector body or CNI operator should follow the NCSC's CHECK recommendation. A council needing a PSN ITHC should use CHECK, Tiger Scheme, CREST-approved ITHC services or the Cyber Scheme. A financial firm in a CBEST or STAR-FS assessment needs an accredited provider. We are none of those, and we are a fit for:
- Private-sector companies that need a penetration test as evidence for ISO 27001, SOC 2 or PCI DSS.
- Companies preparing for Cyber Essentials Plus that want their controls tested before the certification assessment.
- Any company holding personal data that wants evidence for its UK GDPR and Data Protection Act 2018 security obligations.
- Suppliers answering a customer's security questionnaire that asks for a recent, independent penetration test by qualified testers, without naming a scheme.
What CREST-accredited testing costs in the UK: published examples
Few UK firms publish prices. The figures below are the ones we could find on public pages on 24 October 2026. They are published examples from individual firms, not a market average, and the unit and scope behind each figure differ.
| Firm and listing | Published figures | Source |
|---|---|---|
| Cyphere (CREST-accredited, Altrincham), penetration testing cost guide | Daily rates of £800 to £1,000 for junior testers and £1,200 to £1,800 for senior CREST-certified consultants (the range stated in the firm's guide) | thecyphere.com |
| DigitalXRAID Ltd, "CREST Penetration Testing" on G-Cloud 15 | Role rates: associate £900, lead £1,200, principal £1,350 (the listing page does not state the unit) | GOV.UK Digital Marketplace |
| Fortis Cyber Security Limited, "CREST Accredited Penetration Testing" on G-Cloud 15 | Role rates: associate £650, lead £895, principal £995 (the listing page does not state the unit) | GOV.UK Digital Marketplace |
G-Cloud listings are written for public sector buyers and link a full pricing document, so read that document before comparing figures. For what our own tester-day rate means for your scope, use the pentest pricing calculator. The FAQ below gives the rate.
UK penetration testing firms on the CREST directory
If your requirement names CREST or CHECK, these are well-known UK firms you can check. CREST and CHECK status is taken from each firm's CREST Marketplace listing.
Bridewell
Describes its work as protecting "Critical National Infrastructure (CNI) and organisations who require the highest standard of cyber security."
- Penetration Testing, Security Operations Centre, Incident Response
Cyphere
Describes itself as "a CREST-accredited, IASME-licensed cyber security company based in Altrincham, Greater Manchester."
- Altrincham, Greater Manchester
- Penetration Testing
Dionach
Describes itself as "a CREST-approved global provider of information security solutions".
- Oxford and Glasgow
- Penetration Testing; UK NCSC CHECK Provider; CBEST and STAR-FS Threat Led Penetration Testing
JUMPSEC
Describes itself as "a specialist UK cybersecurity company".
- Acton, London
- Penetration Testing; UK NCSC CHECK Provider
LRQA
Assurance group whose CREST listing states it operates "in more than 150 countries with a team of more than 5,000 people".
- Birmingham
- Penetration Testing; UK NCSC CHECK Provider; CBEST and STAR-FS Threat Led Penetration Testing
NCC Group
Describes itself as "a global cyber security company".
- Penetration Testing; UK NCSC CHECK Provider; CBEST and STAR-FS Threat Led Penetration Testing
Pen Test Partners
Lists OT, ICS and IIoT security testing and transport systems testing among its services.
- Buckingham
- Penetration Testing; UK NCSC CHECK Provider; CBEST and STAR-FS Threat Led Penetration Testing
Prism Infosec
Describes its work as supporting "organisations globally to prepare for, respond to and manage cyber security threats."
- Cheltenham and Liverpool (per its CREST listing)
- Penetration Testing; UK NCSC CHECK Provider; CBEST and STAR-FS Threat Led Penetration Testing
Secarma
Describes itself as a "Penetration Testing and Cybersecurity Company".
- Manchester
- Penetration Testing, Vulnerability Assessment, Cyber Audit
Listed alphabetically. Facts from each firm's own site and its CREST Marketplace listing on 24 October 2026; tell us at press@budgetsecurity.com if something is out of date.
CREST vs OSCP: which one your test needs
Budget Security's testers hold the OSCP. We are not a CREST member company and we do not claim CREST equivalence. They are different things: CREST accredits companies and certifies individuals through its exam levels, while the OSCP is an individual certification from OffSec. OffSec's exam is "24-hour proctored" and asks candidates to "identify, exploit, and report real-world vulnerabilities in live lab systems". Source: OffSec, PEN-200 and the OSCP.
When an OSCP-led test fits: your requirement asks for an independent penetration test by qualified people with a clear methodology, without naming a scheme. Check the wording of your ISO 27001, SOC 2 or customer-questionnaire request: if that is what it asks for, an OSCP-led test answers it, and it matches the NCSC's general advice that third-party tests "should be performed by qualified and experienced staff only". Source: NCSC, Penetration testing.
When to hire a CREST or CHECK firm instead: the requirement names CREST, CHECK, CBEST or STAR-FS; you are a government department, public sector body or CNI operator; you need a PSN IT Health Check; or you want the CREST complaints route as part of your supplier assurance. In those cases, use the directory above or the CREST Marketplace. That is a sound choice.
UK GDPR and the Data Protection Act 2018
"In the UK, data protection is governed by the UK General Data Protection Regulation (UK GDPR)" and "the Data Protection Act 2018". Personal data must be "handled in a way that ensures appropriate security". Source: GOV.UK, Data protection.
The ICO is direct about testing: "the UK GDPR specifically requires you to have a process for regularly testing, assessing and evaluating the effectiveness of any measures you put in place." On how to do it: "Technically, you can undertake this through a number of techniques, such as vulnerability scanning and penetration testing." Source: ICO, A guide to data security.
The ICO does not say a penetration test is mandatory. It names it as one way to meet the testing requirement. A test gives you a dated, independent record of what was tested, what was found and when it was fixed.
That record matters most on a bad day. "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it." Source: ICO, Personal data breaches: a guide. Scope details are on GDPR penetration testing.
Cyber Essentials Plus, ISO 27001, SOC 2 and PCI DSS
Cyber Essentials Plus is the UK-specific one. The NCSC describes it as "the same protections, but with more rigorous, independent technical testing" than Cyber Essentials. Source: NCSC, Cyber Essentials overview. That technical testing is part of the certification itself, and the NCSC page does not call it a penetration test. Our test is not a Cyber Essentials Plus assessment and does not award the certificate. It shows you, before the assessment, where your controls fail under a real attack.
For the other three frameworks, the same engagement can serve all of them when it is scoped for it:
- ISO 27001 penetration testing: independent test evidence for Annex A technical vulnerability management, with findings mapped to the control each one defeated.
- SOC 2 penetration testing: evidence for the common criteria a US auditor samples.
- PCI DSS penetration testing: external and internal testing of the cardholder data environment and its segmentation.
Set the framework as the goal at scoping time and the report cross-references every finding to it.
How an engagement runs from The Hague
Budget Security has no office, staff, address or phone number in the UK. Testing is delivered from the Netherlands by OSCP-certified testers over authorised, logged connections.
- Same working day. The UK is 1 hour behind the Netherlands all year, so testing runs inside UK business hours. Your team can reach the tester during the test, and verified findings land in the dashboard as they are confirmed.
- Start within 7 days of booking. A start within 24 hours is possible only when a tester is available, carries an urgency fee, and is never guaranteed.
- The report arrives within 48 hours after the test ends: executive summary, technical findings with evidence, remediation per finding and the compliance mapping for the goal you set.
- Payment is due after report delivery. Nothing is charged at booking.
- A confirmed start date can be moved, but not for free, because the tester-days were reserved for you.
- Retests of fixed findings are ordered from the dashboard and close the finding in the same tracker your auditor or customer sees. You can give an assessor read access instead of emailing a PDF around.
What we need before the start date: scope sign-off, credentials for authenticated testing, and a signed authorisation letter. The platform collects all three.
FAQ
Penetration testing in the UK FAQ
Do I need a CREST pentest?
Is Budget Security CREST accredited?
What is the difference between CREST and CHECK?
Are you a UK penetration testing company?
How do you quote UK companies?
Does UK GDPR require a penetration test?
Can you test internal networks without coming on site?
How fast can you start, and when do I pay?
Penetration testing for your UK company, scoped by you, priced before you commit.
OSCP-certified testers. Start within 7 days. Testing in UK business hours. Report within 48 hours after the test ends.