Penetration Testing Cost for UK Schools, Trusts and Colleges (2026)

A penetration test for a UK school, trust or college typically costs £2,200 to £35,000 in the UK market. The low end is a short test of one school’s internet-facing services. The high end is a college or university estate covering web platforms, the perimeter and internal networks. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a school, trust or college?

Most schools, multi academy trusts and colleges fall into one of six scopes, typically costing between £2,200 and £35,000 in the UK market. What you pay depends on how many systems are tested and how many kinds of user each one has, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Single school, perimeter only	The management information system (MIS), remote access for staff and suppliers, and the internet-facing side of Microsoft 365 or Google Workspace	2 to 3 days	£2,200 to £4,200
Single school, perimeter and internal network	The perimeter above, plus what a compromised student or staff account could reach, including the guest and student networks	3 to 6 days	£3,300 to £8,400
One web platform with a single user role	An admissions form, a booking system or a simple parent-facing site	5 days	£5,500 to £7,000
Multi-role learning or parent platform	A parent portal, learning platform or examination system with staff, student and parent roles, including the links between them	8 to 12 days	£8,800 to £16,800
Multi academy trust, trust-wide	Central IT and the shared platforms every academy inherits, tested once, with a larger perimeter and several school networks sampled	6 to 13 days	£6,600 to £18,200
College or university estate	A multi-role platform, a larger perimeter, and internal networks, including separation between student, staff and research systems	14 to 25 days	£15,400 to £35,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. In education, five things move the day count more than the rest: how many schools are in scope, how many kinds of user a platform has, the size of the network, remote access and the cloud tenancy.

• Number of schools. A trust that shares one set of platforms is tested once for the shared parts. Each school’s own network adds days only where it is sampled or tested separately.
• Kinds of user. A platform with staff, student and parent roles takes longer than a single-role form, because the parent-to-child links and the boundaries between schools on a shared platform are tested.
• Network size. The number of internet-facing addresses, school sites and Active Directory domains sets the length of the infrastructure work.
• Remote access. Staff, suppliers and IT support often reach the school from outside. Each remote-access route is part of the perimeter test.
• Guest and student networks. These sit alongside staff systems, and testing the separation between them adds time to an internal test. See internal network penetration testing.

Tester grade is not a pricing factor, and neither is the size of the testing company or the school. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a platform added after the quote, extra user roles, or more schools than the ones described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say who has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which systems are in scope: the MIS, remote access, Microsoft 365 or Google Workspace, parent portals, learning platforms, networks.
2. For each web platform, which roles exist (staff, student, parent, guest) and whether several schools share it.
3. For the perimeter, roughly how many internet-facing addresses and remote-access routes you have.
4. For internal networks, the number of school sites and whether staff, student and guest networks are separated.
5. For a trust, whether central IT runs the shared platforms, and whether you want findings reported per school.
6. Who asked for the test, and the exact wording: your governors, an insurer, or your own cyber risk assessment.
7. Term dates, exam periods and any other days to avoid.

Does the DfE require a penetration test?

No. The DfE’s cyber security core standard asks you to “Conduct a cyber risk assessment annually and review every term”. It does not name a penetration test. A test is evidence for that risk assessment. The same page says Cyber Essentials is a requirement for colleges under their funding agreement, and that some schools may wish to complete it.

Insurance is a separate question. The DfE’s Risk Protection Arrangement lists “Cyber cover £250,000 for any one loss and in any one membership year”, and schools that buy commercial cover may be asked about testing on the insurer’s own form. Our guide to what the DfE standard means for testing covers the detail.

How EJN Labs approaches pricing for education

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated education service for schools, colleges and multi academy trusts. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

For a trust we run one engagement covering the whole trust: central IT and the shared platforms every academy inherits are tested once, individual schools are sampled, and findings are reported per school so each IT lead knows exactly what to fix. We schedule around term dates, and report as a prioritised fix list your IT support can work through.

Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for a school?

Typically £2,200 to £8,400 in the UK market for a single school. A perimeter-only test of 2 to 3 days is £2,200 to £4,200. A perimeter and internal network test of 3 to 6 days is £3,300 to £8,400. These ranges use UK day rates of £1,100 to £1,400.

How much does a penetration test cost for a multi academy trust?

Typically £6,600 to £18,200 in the UK market for a trust-wide engagement of 6 to 13 days. Shared platforms are tested once rather than once per school, so a trust usually costs less than a separate test for every academy. Findings are reported per school.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

How long does a penetration test take for a school or college?

Between 2 and 25 testing days for the scopes in the table above. A school perimeter test is typically 2 to 3 days, a trust-wide engagement is 6 to 13 days, and a college or university estate is 14 to 25 days. EJN Labs delivers the report on the last day of testing.

Can testing be scheduled around term dates and exams?

Yes. Tell the testing company your term dates and exam periods when you ask for the quote. EJN Labs schedules around term dates, offers out of hours slots at no extra charge, and tests safe by default on production, with no denial of service.

Get a fixed price for your school or trust

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Best Penetration Testing Companies for UK Schools, Colleges and Universities, penetration testing for schools, colleges and MATs, does the DfE standard require penetration testing, penetration testing cost in the UK and network penetration testing cost.