The Best External Penetration Testing Companies in the UK (2026)

The best external penetration testing companies in the UK for 2026 are listed below. Each one holds a CREST penetration testing accreditation and publishes a public page for testing your internet-facing systems, and each is compared on published pricing, retests and report turnaround so you can shortlist quickly.

1. OnSecurity

OnSecurity is a UK penetration testing company with a dedicated external infrastructure penetration testing page describing ethical hacking of an organisation’s internet-facing systems and networks, including software flaws and ineffective firewall rules. That page states free retests for resolved issues within a flexible window and findings available instantly through its platform. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated external infrastructure penetration testing service that combines OSINT with manual exploitation of exposed services, weak SSL/TLS, leaked credentials, subdomain takeover and patch-level remote code execution. It is aligned to PTES, NIST SP 800-115, the OWASP Testing Guide and OSSTMM. It is one of two companies on this list that publish pricing. External infrastructure tests start from £3,500 on the pricing page, with a typical range of £6,500 to £12,000 over 3 to 5 days. Small covers up to about 60 IPs for £3,500 to £6,500, Growth covers 60 to 100 IPs for £6,500 to £12,000, and Enterprise covers 100 to 200 IPs for £12,000 to £22,000. Every engagement is a fixed price for a defined scope, quoted within 24 hours of the scoping call. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

Retesting of fixed findings is free until every finding is closed, with no time limit. By EJN Labs’ own figures, free retests save clients up to 35% against paying for retesting separately, and free rescheduling means a slipped release date costs nothing. Findings are posted to a client portal as they are confirmed. The report arrives on the last day of testing, the shortest stated turnaround on this list, with a CVSS score and prioritised remediation guidance for each finding, followed by a walkthrough call. There are no callout, cancellation or out-of-hours fees.

Testing is delivered by UK-based, CREST-certified penetration testers, priced at a fair-market £1,100 to £1,400 per day. Live internet-facing systems can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off. Out of hours or overnight slots are available.

OnSecurity’s dedicated external infrastructure page, free retests within a flexible window and instant access to findings through its platform keep it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, with a £3,500 starting price, free retests until every finding is closed and a report on the last day of testing, which is why it sits second.

3. Precursor Security

Precursor Security is a UK offensive security consultancy with a dedicated external network penetration testing page describing an internet-based attacker probing firewalls, VPN gateways, mail servers and the cloud perimeter. That page states a starting price and duration for a small scope, and remediation retesting included within the agreed window. Its penetration testing page states a report turnaround after test completion. CREST-accredited for penetration testing, security operations centre and vulnerability assessment. Verified: CREST Marketplace listing.

4. Sencode

Sencode is a UK penetration testing company whose network penetration testing page names external penetration testing as one of the two main types of network test. That page states a retest window, fixed-scope pricing after a short scoping call, and a typical report turnaround after testing is complete. This is a network page that covers the external side, not a page devoted to external testing alone. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

5. Evalian

Evalian is a UK data protection and security consultancy whose infrastructure penetration testing page describes external infrastructure testing of internet-facing systems, from what an attacker could reach and exploit from outside the network. The page states a free retest of remediations, and its penetration testing page states a report turnaround after completing the test. This page covers external and internal testing together. CREST-accredited for penetration testing, application security testing, vulnerability assessment, incident response and security operations centre. Verified: CREST Marketplace listing.

6. Bridewell

Bridewell is a UK cyber security services company whose infrastructure penetration testing page describes assessing an organisation’s network from an internal and external perspective. This page covers external and internal testing together, and we did not find pricing, retest or report turnaround terms on it. CREST-accredited for penetration testing, vulnerability assessment, threat led penetration testing, cyber audit, incident response and security operations centre. Verified: CREST Marketplace listing.

7. Sentrium

Sentrium is an independent UK penetration testing consultancy whose network and infrastructure penetration testing page sets out external assessments that examine a network’s perimeter defences from outside the organisation. Its penetration testing page states retesting of high and critical findings for a stated period after the test. This page covers external and internal testing together. CREST-accredited for penetration testing and cyber audit. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a live public page for external infrastructure penetration testing. Where a page covers external and internal testing together, its text had to name the external side. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 25 October 2026. Entries from three onwards are in no particular order.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• A public external testing page. A home page that lists penetration testing in a menu was not enough. Each entry needed its own public page that names external testing. Well-known testing companies without one are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices for external testing on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. An external test is often repeated after the exposed services are closed, and often by a customer or audit deadline. Where a company states its retest terms or report turnaround we noted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All seven companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have a public page naming external testing. Two have a page devoted to external testing alone, and the rest cover it within a network or infrastructure page. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are taken from each company’s own public pages, linked in its profile above, as they stood on 25 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do you have to have an external penetration test?

No rule names an external penetration test as mandatory for every organisation. The duties that lead teams to commission one are narrower or broader than that. If your internet-facing systems are part of a payment card environment, PCI DSS 4.0.1 requirement 11.4.3 requires external penetration testing at least once every 12 months and after significant change, and requirement 11.4.2 sets the same for internal testing. That applies to the cardholder data environment, not to every external system.

UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method, but testing what an attacker can reach from the internet is one recognised way to evidence that process. ISO 27001 does not require a penetration test either: Annex A 8.8 on management of technical vulnerabilities is apply-or-justify, and the ISO 27002 guidance for it lists periodic, documented penetration tests as one approach. The NCSC’s penetration testing guidance describes penetration testing as a method for gaining assurance in the security of an IT system by attempting to breach it.

Cyber Essentials Plus includes hands-on technical verification by an assessor, which the NCSC Cyber Essentials overview describes as independent testing of your systems. That is an assessor-led audit of five technical controls, not a penetration test, so it does not replace one. In practice the request for an external test usually comes from outside the team: an enterprise customer’s security questionnaire, a procurement panel, an auditor or a cyber insurer. For scope and cost, see our guide to network penetration testing cost and the pricing page.

What a buyer should ask an external penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Is the testing manual, and does it go beyond a scan? Ask how testers validate exposed services, weak encryption settings, default credentials and forgotten staging systems, because a scanner alone produces false positives and misses chained weaknesses.
3. How is the scope counted and confirmed? Ask whether it is priced by IP address, hostname or domain, how you will agree the list of targets, and what happens when discovery finds assets you did not know you had.
4. Is a retest included, and for how long? Customers and auditors ask for evidence that exposed services were closed, so a retest that is capped or charged separately changes the real price.
5. When do we get the report, and do we see findings before it? If a customer deadline is driving the test, the gap between the end of testing and the report matters, as does live access to findings.
6. Can you test our live systems safely? Ask how disruptive checks are handled, whether denial of service and brute-force lockouts are excluded, and what fixed price covers our scope.

Get a quote

Read the published day rate of £1,100 to £1,400 and the external infrastructure starting price of £3,500 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about external infrastructure penetration testing from EJN Labs.