The Best API Penetration Testing Companies in the UK (2026)

The best API penetration testing companies in the UK in 2026 are listed below. Each one holds a CREST penetration testing accreditation and runs a dedicated API testing service for REST, GraphQL or SOAP APIs, and each is compared on published pricing, retests and report turnaround so you can shortlist with confidence.

1. Pen Test Partners

Pen Test Partners is a long-established UK security consultancy with a dedicated API penetration testing service. Its page sets out the areas covered, including broken object-level authorisation, broken authentication, injection, server-side request forgery and insecure business logic, and names the OWASP Web Security Testing Guide as the primary source of its methodology. Its CREST listing shows long membership, with accreditations in penetration testing, vulnerability assessment, incident response and application security testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated API penetration testing service covering REST, GraphQL, gRPC and SOAP, with manual exploitation of the OWASP API Top 10 including broken object level authorisation, broken function level authorisation, mass assignment and server-side request forgery. It is one of two companies on this list that publish pricing. API testing starts from £4,000 and typically costs £7,000 to £12,000 over 4 to 9 days, as stated on the pricing page. Small, at £4,000 to £7,000, covers a single REST API with fewer than 25 endpoints over 4 to 5 days. Growth, at £7,000 to £12,000, covers REST and GraphQL with 25 to 100 endpoints and OAuth flows over 6 to 9 days. Enterprise, from £12,000, covers microservice meshes with more than 100 endpoints over 10 to 15 days. Verified: CREST Marketplace listing for EJN Labs.

Every engagement is a fixed price for a defined scope, quoted within 24 hours of a 30-minute scoping call. The published day rate for its CREST-certified consultants is £1,100 to £1,400. Retesting of fixed findings is free until every finding is closed. By EJN Labs’ own figures, free retests save clients up to 35% against paying for retesting separately, and free rescheduling means a slipped release date costs nothing. There are no callout, cancellation or out-of-hours fees.

Findings are posted to a client portal as they are confirmed. The report arrives on the last day of testing, the shortest stated turnaround on this list, with CVSS-scored findings, remediation guidance and a signed letter of attestation. Testing is by UK-based, CREST-certified penetration testers, safe-by-default on production with no denial of service, and out of hours slots are available. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus.

Pen Test Partners is first because it is the longer-established company on this list, with a broad range of CREST accreditations. On the criteria this page can check from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, with free retests until every finding is closed and a report on the last day of testing, which is why it sits second.

3. Precursor Security

Precursor Security is a UK offensive security consultancy with a dedicated API penetration testing page covering REST, GraphQL and SOAP, which states that every engagement tests all ten OWASP API Security Top 10 (2023) categories. It also publishes pricing: its penetration testing page lists an API security assessment with a starting price for a single API surface, a stated report turnaround after test completion and a stated retest window, and its cost page states an approximate consultant day rate. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

4. WorkNest Secure (Pentest People and Bulletproof)

WorkNest Secure is the cyber security business behind the Pentest People and Bulletproof brands. Its API penetration testing page describes assessment of REST, SOAP and GraphQL APIs for weaknesses, misconfigurations and business logic flaws, with findings published in a report on its GuardNest platform. The page also mentions a remediation check service. CREST-accredited for penetration testing, vulnerability assessment, incident response and application security testing. Brands absorbed into a parent appear under the parent’s listing. Verified: CREST Marketplace listing for WorkNest.

5. Kroll

Kroll is a global risk advisory firm with a dedicated API penetration testing service. Its page says its certified pen testers find vulnerabilities in APIs that scanners cannot identify, and it describes work with large enterprises in regulated industries. Kroll holds CREST accreditation for penetration testing, incident response and security operations centre, and its listing shows a United States headquarters. Verified: CREST Marketplace listing for Kroll LLC.

6. Sencode

Sencode is a UK penetration testing company with a dedicated API penetration testing page that states testing against the OWASP API Security Top 10 (2023). The same page states free retesting for every penetration test with a stated retest window, and a report turnaround after the testing phase is complete. Pricing is agreed per scope rather than published. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

7. Fortbridge

Fortbridge is a UK penetration testing company with a dedicated API penetration testing page. It states manual testing of REST, GraphQL, SOAP and gRPC endpoints, with GraphQL-specific checks for introspection disclosure, query depth abuse and batching attacks, and a methodology aligned with the OWASP API Security Top 10. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a live, dedicated public page for API penetration testing. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 24 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• A dedicated API testing page. A general penetration testing company was not enough. Each entry needed its own public page for API testing. A home page that lists APIs in a menu did not count. Well-known testing companies with no such page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices for API testing on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. An API team usually has to prove that findings were fixed, and often by a customer’s deadline. Where a company states its retest terms or report turnaround we noted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All seven companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing except Kroll, and have a dedicated API testing page. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are taken from each company’s own public pages, linked in its profile above, as they stood on 24 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do you have to have an API penetration test?

No rule names an API penetration test as mandatory in itself. The duties that lead organisations to commission one are broader, and an API is usually in scope of them. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures. It does not name penetration testing as the method, but the ICO’s data security guidance lists vulnerability scanning and penetration testing as techniques for doing so, and an API that exposes personal data is part of what you are testing.

Where an API sits in a cardholder data environment, requirement 11.4 of PCI DSS 4.0.1 does require penetration testing: internal testing under 11.4.2 and external testing under 11.4.3, at least once every 12 months and after significant change. That applies only to systems in scope of the cardholder data environment. ISO 27001 does not require a penetration test either. Annex A 8.8 requires you to identify and evaluate technical vulnerabilities once you declare that control applicable, and the ISO 27002 guidance for 8.8 lists periodic, documented penetration tests as one way to do it.

In practice the request usually comes from outside the team: an enterprise customer’s security questionnaire, a partner or open banking integration review, or a cyber insurer. The NCSC’s penetration testing guidance describes a test as a method for gaining assurance in your vulnerability assessment and management processes, which is why teams commission one after a major API release as well as on a schedule. The OWASP API Security Top 10 is a standard that most providers on this list test against, not a legal requirement. For scope and cost, see our API penetration testing service.

What a buyer should ask an API penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. How do you test authorisation? Broken object level and function level authorisation are the flaws scanners miss, so ask whether testers swap object IDs and roles by hand across every permission tier.
3. Which API types and documents do you work from? Ask whether REST, GraphQL, gRPC and SOAP are covered, and whether they use your OpenAPI, Swagger or Postman files to map every endpoint.
4. Is a retest included, and for how long? Customers and auditors ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. Can you test a live API safely? Ask how disruptive checks such as rate limit and resource consumption tests are handled on production, and whether a staging copy is expected.
6. What is the fixed price for our scope? Ask for a day count and a day rate, not a range, and ask when the report arrives.

Get a quote

Read the published starting price and day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about API penetration testing.