Penetration Testing Cost for UK Law Firms (2026)

A penetration test for a UK law firm typically costs £1,100 to £35,000 in the UK market. The low end is a short test of the internal network. The high end is a whole-firm test covering the client portal or document management system, the perimeter and internal systems. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a law firm?

Most law firms fall into one of five scopes, typically costing between £1,100 and £35,000 in the UK market. What you pay depends on how many systems are tested and how complex each one is, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Internal network and Active Directory	An assumed-breach test of a single-site firm: Active Directory, file-share scoping and separation between partners, support staff and IT administrators	1 to 3 days	£1,100 to £4,200
Perimeter and VPN	Internet-facing services, VPN and remote-desktop gateways, and exposed management interfaces	2 to 3 days	£2,200 to £4,200
Client portal or document management system	A client portal, matter system or document management system with a single user role, tested for matter-level confidentiality	5 days	£5,500 to £7,000
Portal plus the perimeter	The portal above, plus the internet-facing services around it	7 to 8 days	£7,700 to £11,200
Whole-firm test	A multi-role portal or data room, a larger perimeter, and the internal network including ethical-wall and tier separation	14 to 25 days	£15,400 to £35,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. Five things move the day count at a law firm: how many client-facing systems are in scope, how many user roles and matter boundaries each has, how large the network is, how many sites and domains it spans, and whether AI tools sit over case files.

• Number of systems. A document management system, a client portal and a conveyancing portal are separate tests, even when one IT team runs them all. See customer portal penetration testing.
• User roles and matter boundaries. Ethical walls, matter-level access and partner, secretarial and administrator tiers each add boundaries to test.
• Network size. The number of hosts, offices and Active Directory domains sets the length of the infrastructure work. See internal network penetration testing.
• Email and cloud. Microsoft 365 or Google Workspace configuration can be reviewed alongside the test. See Microsoft 365 security review.
• AI assistants. An assistant that answers questions over case files is tested in its own right. See AI penetration testing.

Tester grade is not a pricing factor, and neither is the size of the testing company or of your firm. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

Does LOCS:23 change what a law firm should budget?

It can, because it asks for scans every year. The ICO-approved certification scheme for legal services, LOCS:23, requires an external and an internal vulnerability scan at least once a year (controls 8.3.7.14 and 8.3.7.15). It does not require a penetration test.

The standard lists penetration tests among the protective technologies a certified firm can evidence under control 8.3.7.13. So a firm working towards LOCS:23 budgets for the scans, and adds a penetration test of the client-facing systems where it wants the stronger evidence. Our guide to penetration testing for law firms covers the wider requirements.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a system added after the quote, extra user roles, or a larger network than the one described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say who has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which systems are in scope: document management, client portal, data room, network, email.
2. For each web platform, the number of user roles and whether clients or third parties log in to it.
3. For the network, roughly how many hosts, how many offices, and how many Active Directory domains.
4. For the perimeter, roughly how many internet-facing addresses and remote-access services you have.
5. Who asked for the test, and the exact wording: a client panel, an insurer, or a certification such as LOCS:23.
6. Any dates to avoid, such as completion days or panel reviews.

Law firms can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document that triggered the request names an accreditation, say so when you ask for the quote.

How EJN Labs approaches pricing for law firms

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated law firm penetration testing service. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test document management systems, client portals and data rooms, legal AI assistants, email and wire-fraud defences, the internal network, VPN and endpoints, and Microsoft 365 or Google Workspace. Engagements are scoped around the handling of privileged material and reported under strict confidentiality. Testing is safe by default on production, with no denial of service.

Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for a law firm?

Typically £1,100 to £35,000 in the UK market. A perimeter and VPN test of 2 to 3 days is £2,200 to £4,200. One client portal at 5 days is £5,500 to £7,000. A whole-firm test of 14 to 25 days is £15,400 to £35,000. These ranges use UK day rates of £1,100 to £1,400.

Does LOCS:23 require a penetration test?

No. LOCS:23 requires an external and an internal vulnerability scan at least once a year, and lists penetration tests among the protective technologies a certified firm can evidence. A penetration test is a hands-on attempt to break your systems, which goes further than a scan.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

How long does a penetration test take for a law firm?

Between 1 and 25 testing days for the scopes in the table above. An internal network test is typically 1 to 3 days, one client portal is 5 days, and a whole-firm test is 14 to 25 days. EJN Labs delivers the report on the last day of testing.

Is the report kept confidential?

Ask for it in writing before you sign. EJN Labs scopes engagements around the handling of privileged material and reports under strict confidentiality, with findings delivered through a client portal. Agree up front who at the firm may see the report.

Get a fixed price for your firm

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Best Penetration Testing Companies for UK Law Firms, penetration testing for law firms, what a law firm needs from a penetration test, penetration testing cost in the UK and web application penetration testing cost.