# Penetration testing UK: companies compared, CREST and CHECK

Source: https://pentestcompare.com/locations/united-kingdom/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing UK companies from one sourced dataset, A to Z, matched by HQ country. CHECK explained from NCSC text, with what to ask and how to read the table.

> **Short answer:** This page lists providers whose headquarters country is the United Kingdom in our dataset, A to Z. The match uses HQ country only, so providers headquartered elsewhere that serve the UK, or that do not publish an HQ, are not in the table. NCSC says organizations outside the public sector do not need a CHECK provider. Ask any provider about data location, remote testing and its credentials.

Penetration testing in the UK means a provider tests your systems under a written scope, and many buyers ask first about CREST and CHECK. The table lists providers whose HQ country is the United Kingdom in our dataset, in A to Z order. It is not a ranking, and no provider pays for position. The match is narrow by design, and the next section explains why.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [NCC Group](https://pentestcompare.com/providers/ncc-group/) | Security consultancy | human-led | unknown | unknown | yes | unknown | not published | Not published | Not published | not published |

Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.

## How do we assign a provider to a country?

We use the HQ country recorded in the dataset, taken from the provider's own pages. A provider matches this page when that field says United Kingdom. We do not match by where clients sit, where testers work or where a company is registered.

This rule has a cost. A provider that serves UK clients from another country does not match. A provider that publishes no HQ shows as "Not published" and does not match either. Pen Test Partners lists NCSC CHECK penetration testing on its homepage, but we did not find an HQ country on the pages we checked, so it is not in the table. Find it in the [provider directory](/directory/) instead.

## What do CHECK and CREST mean for a buyer?

CHECK is an NCSC scheme. NCSC says it assesses all companies offering CHECK services to make sure they follow its methodology, and says the scheme is for central government departments, public sector bodies and UK critical national infrastructure (CNI). CHECK team leaders and team members must hold UK Cyber Security Council titles in Security Testing and a valid SC clearance as a minimum ([NCSC information for buyers](https://www.ncsc.gov.uk/schemes/check/information-for-buyers), checked 9 November 2026).

NCSC also says: "If your organisation is not public sector, penetration testing does not need to be conducted by a CHECK service provider." CHECK providers are listed on the NCSC website.

CREST is a separate body. Its site has a supplier search, so you can check a provider's listing yourself ([CREST](https://www.crest-approved.org/), checked 9 November 2026). In our dataset, a credential row records what the provider states and the evidence link we checked. For example, JUMPSEC lists CREST and CHECK on its AI penetration testing page. Open each profile for the evidence, then confirm the listing in the CHECK or CREST directory.

## Who is in the table?

| Provider | Type | Delivery | What the dataset records |
|---|---|---|---|
| Intruder | Application security platform | Automated | Published price of $3,500 per test for an AI web app test, no sample report, no credentials listed |
| JUMPSEC | Consultancy | Human-led | Custom quote; CREST, CHECK, ISO 9001 and ISO 27001 listed on its AI penetration testing page |
| NCC Group | Security consultancy | Human-led | No price, turnaround, retest or sample report published; office page names Manchester as Global HQ |

Source for each row: the provider's own pages in the dataset, checked 9 November 2026. The three rows differ in kind: a platform that sells an automated test at a list price, and two consultancies that quote. Compare them on scope and evidence, not on the word "UK".

## Local rules and buyer needs

Three UK situations change what you ask for.

1. Public sector or CNI work. Read the buyer rules. NCSC sets CHECK for these systems, and the public sector may buy CHECK services through a central route set up with Crown Commercial Service.
2. Private sector work. No NCSC rule requires CHECK, so choose on scope, evidence and your own customers' demands.
3. Customer or insurer requirements. If a customer asks for CREST or CHECK in a contract, copy their wording into your request for quotes.

## What to ask providers

Send the same questions to every provider and compare the written answers.

1. Which credentials do you hold? Give us the directory link for each one.
2. Who does the testing, and do they hold the credentials the scheme requires?
3. Where do testers work, and where do you store our reports and captures?
4. Do you test remotely, on site, or both?
5. Which UK or other law governs the contract?
6. Is a retest included, and for how long?
7. Can we see a sample report? The table shows which providers publish one.

## Price drivers

Most providers publish no price, so you will get a quote. Price depends on:

- Scope: applications, APIs, networks and cloud accounts
- User roles and environments to test
- On-site days and travel
- Scheme requirements such as CHECK, which limit who can test
- Report type and retest terms

For published prices and their units, see [penetration testing cost](/guides/penetration-testing-cost/).

## How to read the table

Read Delivery and Type first: a platform and a consultancy sell different things. Then check Web, API, Cloud and AI apps columns for stated scope. Published price shows a list price when the provider has one, and "custom quote" or "not published" when it has none. Turnaround and Retest repeat the provider's wording, and units differ. Open the provider profile for the source link on each claim.

A small table does not mean a small market. It means few providers in the dataset state a UK HQ.

## Remote testing and data location

A UK buyer can use a provider in any country for remote testing. What changes is data handling. Ask where the provider stores reports, captures and test credentials, who can access them and when they are deleted. Ask your data protection adviser whether a transfer of personal data to another country needs a safeguard.

## Where to go next

Compare more providers in the [provider directory](/directory/) or the [locations index](/locations/), or read [the best penetration testing companies](/guides/best-penetration-testing-companies/). Before you request quotes, read [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).

## Questions

### Do I need a CHECK provider for a UK pentest?

Only if you are public sector or UK critical national infrastructure. NCSC states that if your organisation is not public sector, penetration testing does not need to be conducted by a CHECK service provider. Private companies often choose one anyway, but no NCSC rule requires it.

### What is the difference between CHECK and CREST?

CHECK is an NCSC scheme for testing public sector and UK critical national infrastructure systems. NCSC assesses each CHECK company and sets staff requirements. CREST is a separate body with its own supplier listing. A provider can hold one, both or neither, so check each against its own directory.

### Why does the table show so few providers?

The table matches by headquarters country in our dataset. Many providers that serve UK clients are headquartered elsewhere or publish no HQ, so they do not match. For a wider list, use the main directory and read each profile.

### Can a provider outside the UK test my UK systems?

Yes, remote testing is common. Ask where the testers work, where reports and captures are stored, and which law covers the contract. Public sector work may need CHECK or other clearances, so read your buyer rules first.

## Sources

- [NCSC: Information for CHECK buyers](https://www.ncsc.gov.uk/schemes/check/information-for-buyers)
- [CREST: home page and supplier search](https://www.crest-approved.org/)
- [NCC Group: office locations](https://www.nccgroup.com/us/)
- [PentestCompare provider dataset (filter: United Kingdom)](https://pentestcompare.com/data/providers.json)