The Best Penetration Testing Companies for UK Healthcare (2026)

The best penetration testing companies for UK healthcare in 2026 are listed below. Each one holds a CREST penetration testing accreditation and shows public evidence of work for NHS suppliers, health technology firms or healthcare providers, and each is compared on published pricing, retests and report turnaround.

1. Dionach

Dionach is a UK cyber security consultancy with a dedicated healthcare sector page and a Data Security and Protection Toolkit service page. That page states that the Data Security Assessment Dionach delivers on behalf of NHS Digital provides external assurance for up to 15 requirements of the DSPT, and that its Cyber Risk Framework Workshop delivered on behalf of NHS Digital covers up to 6. CREST-accredited for penetration testing, incident response, vulnerability assessment and threat led penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated healthcare penetration testing service covering patient portals and electronic patient records, e-prescribing and online pharmacy, telehealth and digital triage, FHIR and HL7 integrations, medical device companion apps, cloud platforms and clinical networks. It is one of three companies on this list that publish pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

For a health technology supplier, what the fixed price includes matters as much as the number. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked, which is what an NHS buyer, a DTAC assessment or a due diligence questionnaire asks for, is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your engineers can start fixing on day one. The report arrives on the last day of testing, the shortest stated turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold patient data. Production systems can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off. Out of hours or overnight slots are available so clinical and administrative teams are not interrupted. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to an NHS buyer, an auditor or a customer’s security team.

Dionach’s work delivering DSPT external assurance on behalf of NHS Digital keeps it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second. Where a contract names an NCSC IT Health Check, use a provider approved for that scheme. Where it asks for a CREST-accredited penetration test, EJN Labs meets it.

3. Precursor Security

Precursor Security is a UK offensive security consultancy with a healthcare cyber security page describing specialist services for NHS trusts, private healthcare providers and medical technology companies. It also publishes pricing: that page states healthcare penetration testing from £3,750, and its cost page states engagements from £2,500 at approximately £1,200 per consultant day, with a 30-day retest. Its penetration testing page states a report within 5 working days of test completion. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

4. WorkNest Cyber (incorporating Pentest People and Bulletproof)

WorkNest Cyber is the UK cyber security business that now includes Pentest People and Bulletproof. Its site carries a guide to penetration testing for healthcare and NHS suppliers and an NHS DSP Toolkit consultancy service. CREST-accredited for penetration testing, incident response, vulnerability assessment and threat led penetration testing. Pentest People and Bulletproof have no standalone listing, so check the WorkNest Cyber entry. Verified: CREST Marketplace listing for WorkNest Cyber.

5. Sentrium

Sentrium is an independent UK penetration testing consultancy with a dedicated healthcare penetration testing page that names NHS trusts, private providers and digital health providers. Its penetration testing page states that retesting of high and critical findings is included for up to 30 days after the test. Its service pages give indicative price ranges by test type. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

6. Sencode

Sencode is a UK penetration testing company with a healthcare penetration testing page that covers DTAC and states that DTAC is an assessment framework rather than legislation. That page states complimentary retesting with a six month retest window and a report typically within 5 days of testing. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

7. Evalian

Evalian is a UK data protection and security consultancy with a cyber security for healthcare page that lists NHS DSPT compliance among the challenges it supports, a useful pairing for providers that want testing and information governance advice from one supplier. Its penetration testing page states a free retest and a report within seven days of completing the test. CREST-accredited for penetration testing, vulnerability assessment, incident response and security operations centre. Verified: CREST Marketplace listing.

8. ProCheckUp

ProCheckUp is a long-established UK security consultancy with a healthcare sector page that sets out the NHS Data Security and Protection Toolkit and the National Data Guardian’s data security standards. Its CREST listing shows 17 years of membership and names NCSC IT Health Checks among its services. Its accreditations span penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

9. NCC Group

NCC Group is a global cyber security company headquartered in the United Kingdom, with a health services cyber security page describing assessment and consulting services for hospitals and healthcare providers. Its CREST listing shows 19 years of membership, with accreditations across penetration testing, incident response, vulnerability assessment, security operations centre and threat led penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and public evidence of work in healthcare. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• Healthcare sector evidence. A general penetration testing company was not enough. Each entry needed a public page showing healthcare work: a dedicated healthcare or NHS service page, a Data Security and Protection Toolkit service, or healthcare named on its CREST listing. Well-known testing companies with no such public page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. An NHS buyer usually wants evidence that findings were fixed, and often by a procurement deadline. Where a company states its retest terms or report turnaround we quoted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All nine companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have public healthcare evidence. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do healthcare organisations have to have a penetration test?

No single rule requires every healthcare organisation to have a penetration test. Several NHS routes ask for one as evidence, and which applies depends on what you supply and what you connect to. The Digital Technology Assessment Criteria (DTAC) is described by NHS England as an assessment framework for care commissioners and providers to use when assuring digital health technology products, so it is a buyer requirement rather than law. In the DTAC form (version 2.0, February 2026), question C3.3 asks internet-based products for the summary report of an external penetration test that included the OWASP Top 10 from within the previous 12 months, and the pass criteria say the report must show no vulnerabilities scoring 7.0 or above on CVSS.

The Data Security and Protection Toolkit says that all organisations that have access to NHS patient data and systems must use it. What evidence your organisation type needs is set by the toolkit itself, so check the evidence items for your category rather than assuming a test is or is not required. For email, the secure email standard (DCB1596) says emails sent to and from health and social care organisations must meet it, and NHS England’s accreditation guidance says the self-management route requires a penetration test or IT Health Check. Organisations that adopt an already compliant service follow a different route, so check which applies to you.

Underneath sits UK GDPR Article 32, which requires a process for regularly testing, assessing and evaluating the effectiveness of security measures. It does not name penetration testing, but health data is special category data, and a test is a recognised way to evidence that process. Which provider you need depends on what your requirement states. Where a contract or an NHS network connection specifically requires an NCSC-approved IT Health Check, use a provider approved for that scheme. Where it asks for a CREST-accredited penetration test, a CREST-accredited company such as EJN Labs meets it. For pricing and scope, see our healthcare penetration testing page.

What a healthcare organisation should ask a penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Will the report meet what the NHS buyer asked for? If you are completing DTAC, ask whether the report covers the OWASP Top 10, is dated within the last 12 months, and shows each finding’s CVSS score so it can be submitted as the summary report.
3. Will real patient data be touched? Ask whether testing runs against non-production environments with synthetic data, and what happens if live records become visible.
4. Is a retest included, and for how long? A buyer will want evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. When do we get the report? If a procurement deadline or a Data Security and Protection Toolkit submission is driving the test, the gap between the end of testing and the report matters.
6. What is the fixed price for our scope? Ask for a day count and a day rate, not a range, and ask how testing will avoid disrupting clinical systems.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for UK healthcare.

Related: NHS DTAC Technical Security: Do You Need Cyber Essentials, CE Plus or a Penetration Test? and DSPT Penetration Testing Cost for UK Healthcare and NHS Suppliers.