The Best Penetration Testing Companies for UK Aviation (2026)

The best penetration testing companies for UK aviation in 2026 are listed below. Each one holds a CREST penetration testing accreditation and shows public evidence of work with airlines, airports or the wider aviation sector, and each is compared on published pricing, retests and report turnaround. The CAA’s ASSURE scheme is covered separately, because it needs an accredited ASSURE provider.

1. Arcanum Cyber Security

Arcanum Cyber Security is a UK cyber security consultancy and the one company on this list whose ASSURE status is announced by CREST: on 16 June 2022 CREST reported that Arcanum had been accredited as a supplier on the Civil Aviation Authority’s ASSURE scheme. Its CAA ASSURE audit page describes broad exposure to the aviation industry and experience with operational technology systems, and its penetration testing page states that it can re-test key fixes. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated aviation penetration testing service covering passenger booking and PNR systems, crew rostering portals, maintenance and engineering (MRO) record-keeping platforms, interline, GDS and OTA integrations, and airport ground operations. It tests the record-keeping platform, never a live aircraft system. It is the only company on this list that publishes its pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus, and is an IASME Certification Body for Cyber Essentials and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

For an airline, airport or aviation supplier, what the fixed price includes matters as much as the number. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked, which is what a partner’s security questionnaire or a supplier due diligence review asks for, is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your IT team or supplier can start fixing on day one. The report arrives on the last day of testing, the only stated turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold passenger records and crew personal data. Production systems can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off. Out of hours or overnight slots are available so booking, check-in and operations teams are not interrupted. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to a partner, a supplier or an auditor.

Aviation organisations can use an accredited ASSURE Cyber Supplier or a CREST-accredited penetration testing company, depending on what their requirement states. Where the CAA asks for an ASSURE audit, it comes from an accredited ASSURE Cyber Supplier. EJN Labs is CREST-accredited, and its place is the penetration testing around that audit: the booking, crew, maintenance-record and integration systems an audit may ask you to evidence. Arcanum’s ASSURE accreditation, confirmed by CREST, keeps it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second.

3. Pen Test Partners

Pen Test Partners is a UK security consultancy with a dedicated aviation security testing service covering aircraft passenger domain testing and airport network reviews, including segregation of Gatelink traffic from airport corporate networks. It also publishes a post on the ASSURE aviation cyber security testing scheme. CREST-accredited for penetration testing, vulnerability assessment, incident response, application security testing, mobile application security testing and threat led penetration testing. Verified: CREST Marketplace listing.

4. Prism Infosec

Prism Infosec is a UK cyber security consultancy that publishes a CAA ASSURE audits service page for aviation organisations regulated by the CAA under the Cyber Security Oversight Process for Aviation. CREST-accredited for penetration testing, vulnerability assessment, incident response, incident exercising and threat led penetration testing. Verified: CREST Marketplace listing.

5. Dionach

Dionach is a UK cyber security consultancy that publishes a CAA ASSURE auditing service page for aviation organisations. CREST-accredited for penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

6. Claranet Cyber Security

Claranet Cyber Security is the UK cyber security arm of Claranet and publishes an ASSURE cyber audit service page for airlines, airport operating businesses and air navigation service providers. CREST-accredited for penetration testing, vulnerability assessment, security operations centre, application security testing and mobile application security testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and public evidence of work in the aviation sector. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• Aviation sector evidence. A general penetration testing company was not enough. Each entry needed a public page showing aviation work: a dedicated aviation service page or a CAA ASSURE service page. We state ASSURE accreditation only where CREST confirms it. For every other company, check its status with the CAA before you buy an ASSURE audit. Well-known testing companies with no such public page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. An aviation organisation often has to show a partner, supplier or regulator that findings were fixed. Where a company states its retest terms or report turnaround we quoted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All six companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have public aviation sector evidence. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do aviation organisations have to have a penetration test?

No rule names a penetration test as mandatory for a UK aviation organisation. The CAA’s oversight route is CAP 1753, The Cyber Security Oversight Process for Aviation, and CREST explains that each organisation in scope of CAP 1753, when deemed applicable by the CAA, will need to procure an ASSURE cyber audit from an accredited ASSURE Cyber Supplier. That supplier performs the audit against the Cyber Assessment Framework for Aviation. An ASSURE audit is an audit of your controls, not a penetration test.

Other duties lead organisations to commission testing. Under regulation 10 of the Network and Information Systems Regulations 2018, an operator of an essential service must take appropriate and proportionate technical and organisational measures to manage risks to its network and information systems. Schedule 2 sets thresholds for aerodromes, air traffic services and air carriers, and the regulation does not name penetration testing. UK GDPR Article 32 adds a duty to implement appropriate security measures, including, as appropriate, a process for regularly testing, assessing and evaluating their effectiveness, which matters where booking and crew systems hold personal data.

In practice, airlines, airports, ground handlers and alliance partners commonly ask suppliers and technology vendors for independent penetration test evidence during onboarding and periodic security due diligence. That is common practice, not a rule. Confirm what the CAA expects of your organisation with your own CAA-facing compliance lead. For scope and cost, see our aviation penetration testing service.

What an aviation organisation should ask a penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Are you an accredited ASSURE Cyber Supplier, and if not, what will you test around the audit? An ASSURE audit must come from an accredited supplier, so ask each company plainly which side of that line it sits on and confirm the answer with the CAA.
3. Have you tested passenger booking, crew and maintenance-record systems before? Ask what a typical test covers, and where your testing stops at the boundary with interline, GDS and supplier systems.
4. Will any testing touch a live aircraft or operational system? Ask for it in writing, and for how disruptive checks are handled on live production systems.
5. Is a retest included, and for how long? Partners and suppliers ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
6. What is the fixed price for our scope, and when do we get the report? Ask for a day count and a day rate, not a range.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for UK aviation.

Related: CAA ASSURE and CAP 1753: Does UK Aviation Need a Penetration Test? and Penetration Testing Cost for UK Airlines, Airports and Aviation Suppliers.