Most UK penetration tests are priced by consultant day. SMARTSEC charges £795 + VAT per day, and every engagement is quoted as a fixed price before testing starts. Most tests take between one and six days, so the majority of engagements fall between roughly £800 and £5,000 + VAT.
The table below shows typical durations and costs. Your exact price depends on scope, which we confirm on a short scoping call.
Typical penetration testing costs
| Test type | Typical scope | Duration | Cost ex VAT |
|---|---|---|---|
| External infrastructure | Internet-facing IPs, perimeter services, remote access | 1–3 days | £795–£2,385 |
| Web application | Single application, authenticated and unauthenticated, up to 2–3 user roles | 3–6 days | £2,385–£4,770 |
| API | REST or GraphQL API, authorisation and business logic | 2–4 days | £1,590–£3,180 |
| Internal network & Active Directory | Internal hosts, AD attack paths, privilege escalation | 3–6 days | £2,385–£4,770 |
| Cloud security review | AWS, Azure or GCP configuration and identity | 2–5 days | £1,590–£3,975 |
| AI / LLM application testing | Prompt injection, RAG data exposure, agent and tool (MCP) abuse | 3–6 days | £2,385–£4,770 |
Larger or combined engagements—for example external, internal and web application testing together—are scoped individually.
What affects the cost of a pen test?
- Size of scope: number of IP addresses, applications, API endpoints or cloud accounts.
- Authentication and roles: testing as several user types takes longer than an unauthenticated test, but finds more.
- Complexity: custom business logic, multi-step workflows, payments and integrations need more manual testing.
- Environment: production, staging, or both, plus any testing windows or out-of-hours requirements.
- Reporting requirements: for example evidence for an insurer, a customer security questionnaire, or a regulator.
What you get with SMARTSEC
- Fixed price, agreed up front: scoping call, then a statement of work with days and price before any testing.
- Senior, hands-on testing: the person who scopes your test carries it out and signs off the report.
- Findings as they happen: verified issues are published to the SMARTSEC client platform during the engagement, so you can start fixing straight away.
- A report people can act on: executive summary, attack paths, CVSS scoring, clear remediation and retest criteria.
- Report and retest terms: delivery timing and the retest window are confirmed in your statement of work.
How to spot a “pen test” that isn’t one
Very cheap tests are often an automated vulnerability scan with a logo on the front. Ask any provider:
- Who will do the testing, and what is their experience?
- How much of the testing is manual, and how are findings verified?
- Can I see a sample report?
- Will you show how findings chain together, or just list them?
- Is a retest included?
Frequently asked questions
Is the price fixed?
Yes. After a short scoping call we confirm the number of days and a fixed price in a statement of work before any testing starts. There are no hidden day rates.
What is the difference between a vulnerability scan and a penetration test?
A scan is an automated check for known issues. A penetration test is carried out by an experienced tester who verifies findings manually, removes false positives, and shows how weaknesses chain together into real attack paths and business impact.
How often should we have a penetration test?
At least annually, and after significant change: a major release, new infrastructure, a cloud migration or an acquisition. Many insurers, customers and regulators expect an annual independent test as a minimum.
Can you test production systems safely?
Yes. Testing is agreed in advance, limited to the approved scope and window, and potentially disruptive tests are only run with your explicit approval.
Estimate your test
Get an instant guide price.
Choose a test type and an approximate scope. We’ll confirm the fixed price after a scoping call.
Indicative price, excluding VAT. Combined or unusually complex scopes need a tailored quote.
Or email us for a fixed-price quote →