CREST penetration testing companies: checked list, Nov 2026

CREST penetration testing companies can be checked in one place: the CREST register. This page cannot replace it. We list providers whose own pages state a CREST credential, A to Z with no ranking, and each provider page links the evidence. Facts were checked on 9 November 2026.

What does this list include, and how does a provider qualify?#

A provider qualifies when its own page or a CREST page states a CREST credential and our dataset records an evidence link for it. Wording varies, and we keep the provider's wording in the credentials note. Some entries say the credential covers certain services, for example penetration testing and vulnerability assessment. One entry notes that CREST "may relate to the human-led option" of its product. Others list CREST as a badge. Read the note on each provider page as well as the row.

Who does a CREST list help?#

It helps buyers whose contract, insurer or customer asks for a CREST firm, and buyers who want a third-party check of a company's testing process. It is less useful if you need one specific skill, such as a mobile app test, because the accreditation applies to a company and a service, not to a tester's skill in your stack.

What does CREST accreditation not tell you?#

It does not tell you who will test your system. CREST says there is no mandatory requirement for individuals to be CREST qualified for a company to achieve accreditation. It gives no price or date, and no auditor has to accept a report because of it. For UK public sector work, the NCSC separately runs CHECK. The NCSC says that if your organisation is not public sector, testing does not need to be done by a CHECK provider.

What five checks should you run?#

1. Search the company on the CREST Marketplace and note which services the listing covers.
2. Match the listed service to the service you plan to buy.
3. Ask who will test your system, and ask for their qualifications.
4. Ask for a sample report and read it (see providers with public sample reports).
5. Ask what retest is included and for how long.

What drives the price?#

Price follows scope, depth of manual work, the number of roles and tenants, and the retest terms. CREST status is one factor. Accreditation has a cost for the firm: CREST lists fees for a firm under 1 million pounds of revenue that add up to 10,500 pounds plus VAT in the first year, by our calculation from its fee page. That says nothing about what you pay. The "Published price" column shows a figure only where a provider lists one. See penetration testing cost.

How do you read the table?#

The CREST filter picks every provider with a CREST credential note. The other columns describe the provider as a whole. The Type column matters here: some are platforms with a human-led option, so ask whether the CREST service is the one you are buying. Also see boutique penetration testing firms.

What are the limits of this list?#

The list covers providers in our dataset only. A firm can be on the CREST register and missing here. A badge we could not link to evidence is not counted, and CREST pages sometimes block automated reads, so an entry rests on the provider's own text and links. The CREST register is the source of truth.