Penetration testing UK: companies compared, CREST and CHECK

Penetration testing in the UK means a provider tests your systems under a written scope, and many buyers ask first about CREST and CHECK. The table lists providers whose HQ country is the United Kingdom in our dataset, in A to Z order. It is not a ranking, and no provider pays for position. The match is narrow by design, and the next section explains why.

Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.

How do we assign a provider to a country?#

We use the HQ country recorded in the dataset, taken from the provider's own pages. A provider matches this page when that field says United Kingdom. We do not match by where clients sit, where testers work or where a company is registered.

This rule has a cost. A provider that serves UK clients from another country does not match. A provider that publishes no HQ shows as "Not published" and does not match either. Pen Test Partners lists NCSC CHECK penetration testing on its homepage, but we did not find an HQ country on the pages we checked, so it is not in the table. Find it in the provider directory instead.

What do CHECK and CREST mean for a buyer?#

CHECK is an NCSC scheme. NCSC says it assesses all companies offering CHECK services to make sure they follow its methodology, and says the scheme is for central government departments, public sector bodies and UK critical national infrastructure (CNI). CHECK team leaders and team members must hold UK Cyber Security Council titles in Security Testing and a valid SC clearance as a minimum (NCSC information for buyers, checked 9 November 2026).

NCSC also says: "If your organisation is not public sector, penetration testing does not need to be conducted by a CHECK service provider." CHECK providers are listed on the NCSC website.

CREST is a separate body. Its site has a supplier search, so you can check a provider's listing yourself (CREST, checked 9 November 2026). In our dataset, a credential row records what the provider states and the evidence link we checked. For example, JUMPSEC lists CREST and CHECK on its AI penetration testing page. Open each profile for the evidence, then confirm the listing in the CHECK or CREST directory.

Who is in the table?#

Source for each row: the provider's own pages in the dataset, checked 9 November 2026. The three rows differ in kind: a platform that sells an automated test at a list price, and two consultancies that quote. Compare them on scope and evidence, not on the word "UK".

Local rules and buyer needs#

Three UK situations change what you ask for.

1. Public sector or CNI work. Read the buyer rules. NCSC sets CHECK for these systems, and the public sector may buy CHECK services through a central route set up with Crown Commercial Service.
2. Private sector work. No NCSC rule requires CHECK, so choose on scope, evidence and your own customers' demands.
3. Customer or insurer requirements. If a customer asks for CREST or CHECK in a contract, copy their wording into your request for quotes.

What to ask providers#

Send the same questions to every provider and compare the written answers.

1. Which credentials do you hold? Give us the directory link for each one.
2. Who does the testing, and do they hold the credentials the scheme requires?
3. Where do testers work, and where do you store our reports and captures?
4. Do you test remotely, on site, or both?
5. Which UK or other law governs the contract?
6. Is a retest included, and for how long?
7. Can we see a sample report? The table shows which providers publish one.

Price drivers#

Most providers publish no price, so you will get a quote. Price depends on:

• Scope: applications, APIs, networks and cloud accounts
• User roles and environments to test
• On-site days and travel
• Scheme requirements such as CHECK, which limit who can test
• Report type and retest terms

For published prices and their units, see penetration testing cost.

How to read the table#

Read Delivery and Type first: a platform and a consultancy sell different things. Then check Web, API, Cloud and AI apps columns for stated scope. Published price shows a list price when the provider has one, and "custom quote" or "not published" when it has none. Turnaround and Retest repeat the provider's wording, and units differ. Open the provider profile for the source link on each claim.

A small table does not mean a small market. It means few providers in the dataset state a UK HQ.

Remote testing and data location#

A UK buyer can use a provider in any country for remote testing. What changes is data handling. Ask where the provider stores reports, captures and test credentials, who can access them and when they are deleted. Ask your data protection adviser whether a transfer of personal data to another country needs a safeguard.

Where to go next#

Compare more providers in the provider directory or the locations index, or read the best penetration testing companies. Before you request quotes, read questions to ask a pentest provider.