The Best Mobile App Penetration Testing Companies in the UK (2026)

The best mobile app penetration testing companies in the UK in 2026 are listed below. Each one holds a CREST penetration testing accreditation and runs a dedicated iOS and Android testing service, and each is compared on published pricing, retests and report turnaround, so you can build a shortlist before asking for quotes.

1. Pen Test Partners

Pen Test Partners is a UK security consultancy with a mobile application testing page covering iOS and Android apps. It states that its methodology follows the OWASP MASVS and MASTG, lists areas such as data storage analysis, tampering and reverse engineering, and biometric authentication bypass, and delivers a report with a risk rating for every issue. Its CREST listing shows long membership and accreditation for penetration testing and for mobile application security testing, the CREST discipline that assesses mobile apps specifically. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated mobile application penetration testing service for iOS and Android apps and the APIs behind them. Testing is manual and follows the OWASP Mobile Top 10 and OWASP MASVS, including Frida runtime instrumentation, SSL pinning bypass, biometric authentication bypass, an insecure storage audit and backend API testing. It is one of three companies on this list that publish pricing. Mobile app tests start from £4,500 and typically cost £7,500 to £14,000 over 5 to 10 days, according to the pricing page. Small, at £4,500 to £7,500, covers a single platform with basic authentication over a 5-day engagement. Growth, at £7,500 to £14,000, covers iOS and Android with biometric or payment SDKs over 8 to 10 days. Enterprise, from £14,000, covers complex logic at MASVS L2 over 12 to 15 days. Verified: CREST Marketplace listing for EJN Labs.

Every engagement is a fixed price for a defined scope, quoted within 24 hours of a 30-minute scoping call. The published day rate for its CREST-certified consultants is £1,100 to £1,400. Retesting of fixed findings is free until every finding is closed. By EJN Labs’ own figures, free retests save clients up to 35% against paying for retesting separately, and free rescheduling means a slipped release date costs nothing. There are no callout, cancellation or out-of-hours fees.

Findings are posted to a client portal as they are confirmed. The report arrives on the last day of testing, the shortest stated turnaround on this list, with CVSS-scored findings, remediation guidance and a signed letter of attestation. Testing is by UK-based, CREST-certified penetration testers, safe-by-default on production backends with no denial of service, and out of hours slots are available. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus.

Pen Test Partners keeps first place because its CREST listing shows a mobile application security testing accreditation as well as penetration testing, and a long CREST membership. On the criteria this page can check from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, with free retests until every finding is closed and a report on the last day of testing, which is why it sits second.

3. MDSec

MDSec is a UK security consultancy whose mobile security page lists assessment of mobile applications and backend services, mobile device build and configuration, mobile management technologies and mobile payment systems. The page notes that MDSec has published advisories, whitepapers and tools in this field, including the Mobile Application Hacker’s Handbook. CREST-accredited for penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

4. Precursor Security

Precursor Security is a UK offensive security consultancy with a mobile app penetration testing page covering iOS and Android against the OWASP Mobile Top 10, including Frida runtime manipulation and backend API interception. It publishes pricing: the page states fixed-price engagements with a starting price and a free retest of remediated critical and high findings within a stated window, and its penetration testing page states a report turnaround after test completion. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

5. WorkNest (incorporating Pentest People and Bulletproof)

WorkNest is the home of the Pentest People and Bulletproof penetration testing teams. Its mobile application penetration testing page states that the service covers Android and iOS platforms and that findings are published in a report on its GuardNest platform. CREST-accredited for penetration testing, vulnerability assessment, incident response and mobile application security testing. The brands have no standalone listings, so check the WorkNest Cyber entry. Verified: CREST Marketplace listing for WorkNest Cyber.

6. Evalian

Evalian is a UK data protection and security consultancy, a useful pairing for app owners who want testing and UK GDPR advice from one supplier. Its mobile app penetration testing page states that the service covers iOS and Android applications, with authenticated and unauthenticated testing, and a free retest for remediated issues. Its penetration testing page states a report turnaround after completing the test. CREST-accredited for penetration testing, vulnerability assessment, incident response, security operations centre and mobile application security testing. Verified: CREST Marketplace listing.

7. Sentrium

Sentrium is an independent UK penetration testing consultancy with a mobile app penetration testing page for applications built primarily for Android and iOS devices. That page gives an indicative cost range, and its penetration testing page states that retesting of high and critical findings is included for a limited period after the test. CREST-accredited for penetration testing and cyber audit. Verified: CREST Marketplace listing.

8. Sencode

Sencode is a UK penetration testing company with a mobile application penetration testing page that assesses iOS and Android apps against the OWASP MASVS and MASTG. That page states complimentary retesting with a stated retest window and a report turnaround after the testing phase ends. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a live, dedicated public page for mobile app penetration testing. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 24 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• A dedicated mobile app testing page. A home page that lists mobile testing in a menu was not enough. Each entry needed its own public page for iOS and Android testing. Well-known testing companies without one are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices for mobile testing on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A mobile team usually has to prove that findings were fixed, often before a release or a customer deadline. Where a company states its retest terms or report turnaround we noted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All eight companies show CREST penetration testing accreditation and a United Kingdom headquarters on their listing, and all have a dedicated mobile app testing page. Three of them, Pen Test Partners, WorkNest and Evalian, also show CREST’s separate mobile application security testing accreditation. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are taken from each company’s own public pages, linked in its profile above, as they stood on 24 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do you have to have a mobile app penetration test?

No rule names a mobile app penetration test as mandatory for every app. The duties that lead organisations to commission one are broader. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing. It does not name penetration testing as the method, but an app that handles personal data and its backend are in scope of that duty, and a penetration test is one recognised way to evidence it.

Where an app or its backend is part of a cardholder data environment, PCI DSS 4.0.1 requirements 11.4.2 and 11.4.3 require internal and external penetration testing at least once every 12 months and after significant change. Outside that environment, PCI DSS does not require a test of the app. ISO 27001 does not require a penetration test either. Its Annex A control 8.8 requires technical vulnerabilities to be identified and evaluated once you declare the control applicable, control 8.29 covers security testing in development and acceptance on the same apply-or-justify basis, and the ISO 27002 guidance for 8.8 lists periodic, documented penetration tests as one way to meet it.

In practice the request usually comes from outside the team: an enterprise customer’s security questionnaire, a procurement review or a cyber insurer. The OWASP Mobile Application Security Verification Standard (MASVS) is the common yardstick for what a mobile test should cover, but it is a standard that testers work to, not a law. For scope and price, see our guide to mobile application penetration testing.

What a buyer should ask a mobile app penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Do you test both iOS and Android, on real devices? Ask whether jailbroken and rooted handsets are used, and whether runtime instrumentation is part of every test or an extra.
3. Is the backend API in scope? A mobile app is only as secure as the server behind it, so ask whether API testing is inside the quote or a separate engagement.
4. Which standard do you test against, and at which level? Ask whether the report maps to OWASP MASVS and which verification level the quote assumes.
5. Is a retest included, and for how long? Customers and auditors ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
6. When do we get the report, and what is the fixed price for our scope? If a release date is driving the test, the gap between the end of testing and the report matters. Ask for a day count and a day rate, not a range.

Get a quote

Read the published day rate of £1,100 to £1,400 and the mobile app starting price on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about mobile application penetration testing.