The Best Cloud Penetration Testing Companies in the UK (2026)

The best cloud penetration testing companies in the UK for 2026 are listed below. Each one holds a CREST penetration testing accreditation and publishes a dedicated cloud testing page covering AWS, Azure or Google Cloud, and each is compared on published pricing, retests and report turnaround so you can shortlist quickly.

1. Sentrium

Sentrium is an independent UK penetration testing consultancy with a dedicated cloud penetration testing page for environments on platforms such as AWS, Azure and Google Cloud. The page lists what a test can cover: Microsoft 365, internal cloud virtual networks, externally available services, functions as a service (AWS Lambda and Azure Functions), virtual machines and containers, storage and user access permissions. It states an indicative cost range for a cloud penetration test, and its penetration testing page states retesting of high and critical findings for a stated period after the test. CREST-accredited for penetration testing and cyber audit. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated cloud penetration testing service covering AWS, Azure and GCP. It tests identity and access, federation and SSO trust, CI/CD pipeline trust, storage exposure, secrets and key management, containers and Kubernetes, serverless and compute, network perimeter and logging gaps, and chains them into cross-cloud attack paths. Findings are mapped to CIS Foundations Benchmarks, NIST SP 800-115 and CREST OVS. It is one of two companies on this list that publish pricing. Cloud testing starts from £4,500 on the pricing page. Small covers a single account, subscription or project with up to 10 services for £4,500 to £8,000 over 3 to 4 days, Growth covers 3 to 10 accounts for £8,000 to £14,000 over 4 to 5 days, and Enterprise covers 10 or more accounts for £14,000 to £22,000 over 5 to 8 days. Every engagement is a fixed price for a defined scope, quoted within 24 hours of the scoping call. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

Retesting of fixed findings is free until every finding is closed. By EJN Labs’ own figures, free retests save clients up to 35% against paying for retesting separately, and free rescheduling means a slipped release date costs nothing. Findings are posted to a client portal as they are confirmed. The report arrives on the last day of testing, the shortest stated turnaround on this list, with a CVSS score and prioritised remediation guidance for each finding, followed by a walkthrough call. There are no callout, cancellation or out-of-hours fees.

Testing is delivered by UK-based, CREST-certified penetration testers, priced at a fair-market £1,100 to £1,400 per day. Production environments can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off. Out of hours or overnight slots are available.

Sentrium’s cloud page, which sets out the services a test covers alongside an indicative cost range and a retest window for high and critical findings, keeps it first. On the criteria this page can verify from public pages, EJN Labs has the most complete published answer, with a £4,500 starting price, free retests until every finding is closed and a report on the last day of testing, which is why it sits second.

3. JUMPSEC

JUMPSEC is a UK offensive security company with a dedicated cloud penetration testing page covering AWS, Azure, Entra ID, Microsoft 365 and GCP, including container services such as AKS and EKS, with recommendations rooted in CIS benchmarks. CREST-accredited for penetration testing, vulnerability assessment, incident response, security operations centre and threat led penetration testing. Verified: CREST Marketplace listing.

4. OnSecurity

OnSecurity is a UK penetration testing company with a dedicated cloud penetration testing page covering AWS, Azure and GCP and the cloud misconfigurations that are easy to miss. That page states free retests for fixed issues within a flexible window. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

5. Precursor Security

Precursor Security is a UK offensive security consultancy with a dedicated cloud penetration testing page covering AWS, Azure, GCP and Microsoft 365, with testing of IAM policies, storage configurations, serverless functions and container workloads. That page states starting prices for a single-account assessment and for multi-cloud scopes. Its home page states that a retest is included, and its penetration testing page states a report turnaround after test completion. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

6. Evalian

Evalian is a UK data protection and security consultancy with a cloud penetration testing page describing tests for insecure APIs and misconfigurations in identity and access management (IAM), and setting out the shared responsibility boundaries for AWS, Azure and Google Cloud. Its penetration testing page states a free retest and a report turnaround after completing the test. CREST-accredited for penetration testing, application security testing, vulnerability assessment, incident response and security operations centre. Verified: CREST Marketplace listing.

7. WorkNest Cyber

WorkNest Cyber (the home of Pentest People and Bulletproof) is a UK cyber security business with a cloud and container penetration testing page covering AWS, GCP and Azure environments as well as Docker and Kubernetes, aligned with CREST, OSSTMM, OWASP and NIST methodologies. CREST-accredited for penetration testing, vulnerability assessment, incident response, application security testing, mobile application security testing and threat led penetration testing. Verified: CREST Marketplace listing.

8. Sencode

Sencode is a UK penetration testing company with a dedicated cloud penetration testing page that includes AWS, Azure and Google Cloud reviews of configuration against security best practices. That page gives illustrative costs for cloud infrastructure tests of different lengths, complimentary retesting with a stated window, and a typical report turnaround after testing is complete. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a live, dedicated public page for cloud penetration testing. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 25 October 2026. The first entry is the company whose public material is most centred on cloud testing, EJN Labs is second, and entries from three onwards are in no particular order.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• A dedicated cloud page. A home page that lists cloud testing in a menu was not enough. Each entry needed its own public page for this service. Well-known testing companies without one are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A cloud team usually has to prove that findings were fixed, and often by a customer or audit deadline. Where a company states its retest terms or report turnaround we noted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All eight companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have a dedicated cloud page. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are taken from each company’s own public pages, linked in its profile above, as they stood on 25 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do you have to have a cloud penetration test?

No rule names a cloud penetration test as mandatory for every organisation. The duties that lead teams to commission one are narrower or broader than that. If your cardholder data environment runs in the cloud, PCI DSS 4.0.1 requirement 11.4.1 requires a documented penetration testing methodology based on an industry-accepted approach, and requirements 11.4.2 and 11.4.3 require internal and external penetration testing at least once every 12 months and after significant change. That applies to systems in the cardholder data environment, not to every cloud account.

UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method, but a test of the cloud environment that holds personal data is one recognised way to evidence that process. ISO 27001 does not require a penetration test either: Annex A 8.8 on management of technical vulnerabilities is apply-or-justify, and the ISO 27002 guidance for it lists periodic, documented penetration tests as one approach. The NCSC’s penetration testing guidance describes a penetration test as a method of gaining assurance in your vulnerability assessment and management processes.

Cloud platforms set their own permission rules, which are conditions for testing and not a requirement to test. AWS says customers can carry out penetration tests of their AWS infrastructure without prior approval for the services on its AWS penetration testing policy page, Microsoft publishes its penetration testing rules of engagement, and Google Cloud states in its Cloud Security FAQ that you are not required to contact it before a penetration test of your own project.

For EU financial entities, DORA (Regulation (EU) 2022/2554) Articles 24 to 26 set digital operational resilience testing duties, and Article 26 requires threat-led penetration testing at least every three years for entities their authority identifies. The European Banking Authority keeps the DORA technical standards on threat led penetration tests with the other operational resilience material. In practice the request for a cloud test usually comes from outside the team: an enterprise customer’s security questionnaire, a procurement panel, an auditor or a cyber insurer. For scope and cost, see our guide to penetration testing pricing.

What a buyer should ask a cloud penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Is the testing manual exploitation or a configuration review? Ask whether testers chain identity, storage and secrets findings into attack paths, because a posture scanner alone lists deviations without showing what is exploitable.
3. Which platforms and services are in scope? Ask how AWS accounts, Azure subscriptions or GCP projects are counted, and whether identity, containers, serverless functions and CI/CD trust paths are included in the price.
4. Is a retest included, and for how long? Customers and auditors ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. What access do you need and how is it controlled? Ask what read-only roles or test accounts are required, how credentials are handled, and how the platform owner’s testing rules are followed.
6. What is the fixed price for our scope, and when do we get the report? Ask for a day count and a day rate, not a range, and ask what a change of scope costs.

Get a quote

Read the published day rate of £1,100 to £1,400 and the cloud starting price of £4,500 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about cloud penetration testing from EJN Labs.