The Best Penetration Testing Companies for UK Chemicals and Process Industries (2026)

The best penetration testing companies for UK chemicals and process industries in 2026 are listed below. Each one holds a CREST penetration testing accreditation and shows public evidence of industrial, COMAH or process-sector work, and each is compared on published pricing, retests and report turnaround.

1. Arcanum Cyber

Arcanum is a UK cyber security consultancy with a dedicated cyber security page for COMAH sites that covers HSE OG86 compliance and the integration of cyber security with safety risk management. Its operational technology page describes its CREST accredited penetration testing team, and its penetration testing page says it can re-test key fixes if needed. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated chemicals and process industries penetration testing service covering supplier portals, laboratory platforms, plant-monitoring systems and formulation data, tested from the IT side of the IT/OT boundary. It is the only company on this list that publishes its pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001 and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

For a chemical or process business, what the fixed price includes matters as much as the number. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked, which is what a customer’s supplier assurance review or an insurer asks for, is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your IT team or managed provider can start fixing on day one. The report arrives on the last day of testing, the only stated report turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold formulation data and supplier information. EJN does not test live control systems or safety instrumented systems. Production systems on the IT side can be tested where required: checks are safe-by-default, denial of service is never run against production, and any work that reaches towards OT or process-safety infrastructure only goes ahead against an agreed safe test plan with your engineering team, defined change windows and a kill switch. Out of hours or overnight slots are available so plant and laboratory operations are not interrupted. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to a customer’s security team, an insurer or an auditor.

Arcanum’s dedicated COMAH sites page keeps it first on sector depth. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second.

3. Sapphire

Sapphire is a UK managed cyber security provider that publishes guidance for the sector, including OG86 cyber security for higher tier COMAH sites and a guide to the HSE’s OG86 guidance for industrial network security. CREST-accredited for penetration testing and security operations centre. Verified: CREST Marketplace listing.

4. WorkNest Cyber (incorporating Pentest People and Bulletproof)

WorkNest is a UK business whose cyber division absorbed Pentest People and Bulletproof. Its guide to operational technology penetration testing and the importance of OG86 explains the HSE guidance for industrial automation and control systems. The brands have no standalone listing, so check the WorkNest Cyber entry. CREST-accredited for penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing for WorkNest Cyber.

5. Cyphere

Cyphere is a UK penetration testing consultancy whose oil and gas cyber security page offers CREST accredited security assessments for OT/ICS and SCADA environments and names COMAH among the regimes it supports. Its home page states that it includes unlimited retests for 12 months for all critical and high risk issues. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

6. Dionach

Dionach is a UK cyber security consultancy with an oil and gas industry page that describes securing complex IT and OT environments and testing SCADA environments safely, alongside an OT, ICS and SCADA testing service. CREST-accredited for penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and public evidence of work in industrial, COMAH or process-sector security. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• Chemicals and process sector evidence. A general penetration testing company was not enough. Each entry needed a public page showing COMAH, OG86, OT or process-industry work: a COMAH sites page, a published guide to the HSE’s OG86 guidance, or an OT and SCADA page for a process industry such as oil and gas. Well-known testing companies with no such public page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices for penetration testing on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A process business usually has to show customers and insurers that findings were fixed, and often by an audit or renewal deadline. Where a company states its retest terms or report turnaround we quoted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All six companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have public COMAH, OG86 or process-industry evidence. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do chemicals and process industry sites have to have a penetration test?

No rule we could find names a penetration test as mandatory for a chemicals or process site. The duties that lead operators to commission one are broader. Regulation 5 of the Control of Major Accident Hazards Regulations 2015 requires every operator to take all measures necessary to prevent major accidents and to limit their consequences, and to demonstrate to the competent authority that it has done so. It does not mention cyber security or testing by name.

For control systems, the HSE publishes operational guidance OG86 on cyber security for industrial automation and control systems. On its cyber security page the HSE describes OG86 as guidance aimed primarily at HSE inspectors, which is also freely available to COMAH operators as useful guidance on how compliance might be achieved. That makes it guidance, not a requirement to run a penetration test, and it is about the control systems themselves. Most of the systems EJN tests in this sector sit on the IT side: supplier portals, laboratory platforms and plant-monitoring dashboards that hold employee, customer and supplier data. UK GDPR Article 32 applies to that data and requires, as appropriate, a process for regularly testing, assessing and evaluating the effectiveness of security measures. It does not name penetration testing, but a test is one recognised way to evidence that process.

In practice the request often comes from outside the site: a customer’s supplier assurance review or a cyber insurer. That is usually asked for, not required by law, and it varies by customer and policy. See also our guide to GDPR penetration testing.

What a chemicals or process organisation should ask a penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. What will you test, and what will you not touch? Ask where the line sits between IT systems and process control or safety instrumented systems, and who signs off any work that reaches towards them.
3. Where are the testers based, and who will see our data? Formulation data and supplier information may be visible during testing, so ask where the people doing the work are located and how findings are stored.
4. Is a retest included, and for how long? Customers and insurers ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. Can you test without disrupting the plant or laboratory? Ask about out of hours testing, change windows, and how disruptive checks are handled on live systems.
6. What is the fixed price for our scope? Ask for a day count and a day rate, not a range.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for UK chemicals and process industries.

Related: COMAH and HSE OG86: Do UK Chemical Sites Need a Penetration Test? and Penetration Testing Cost for UK Chemical and Process Sites.