The Best Penetration Testing Companies for the UK Nuclear Supply Chain (2026)

The best penetration testing companies for the UK nuclear supply chain in 2026 are listed below. Each one holds a CREST penetration testing accreditation. Two show direct civil nuclear work and the rest are the closest match on critical national infrastructure and operational technology, and each is compared on published pricing, retests and report turnaround.

1. Bridewell

Bridewell is a UK cyber security and managed services company that lists Civil Nuclear among the industries it specialises in. Its CNI Cyber Security Summit 2025 roundup records a talk from a Deputy Chief Nuclear Inspector at the Office for Nuclear Regulation. This is direct sector evidence, although the public page is an industry listing and an event write-up rather than a dedicated nuclear service page. CREST-accredited for penetration testing, vulnerability assessment, incident response, incident exercising, security operations centre and threat led penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated nuclear supply chain penetration testing service for civil nuclear engineering, construction, maintenance and specialist technology suppliers. It tests the supplier’s own systems: engineering collaboration platforms, maintenance portals and controlled-document exchanges, from the IT side of any boundary with operational or site-security systems. It is the only company on this list that publishes its pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001 and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

For a nuclear supplier, what the fixed price includes matters as much as the number. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked, which is what a prime contractor or licensee’s supplier security questionnaire asks for, is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your IT team or managed provider can start fixing on day one. The report arrives on the last day of testing, the only stated report turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold controlled technical documents. EJN does not test live nuclear safety, control or site-security systems. Production systems on the IT side can be tested where required: checks are safe-by-default, denial of service is never run against production, and any work that reaches towards engineering equipment only goes ahead against an agreed safe test plan with your engineering team, defined change windows and a kill switch. Out of hours or overnight slots are available so project teams are not interrupted. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to a prime contractor, an insurer or an auditor.

Bridewell’s published civil nuclear specialism keeps it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second.

3. Pen Test Partners

Pen Test Partners is a UK security consultancy with a published session at the 3rd Annual Nuclear Industrial Control Cybersecurity and Resilience Conference, covering live industrial control system attacks and remote telemetry in the nuclear industry. This is direct sector evidence, although it is an event page rather than a nuclear service page. It also has an OT, ICS and IIoT security testing page. CREST-accredited for penetration testing, vulnerability assessment, incident response, application and mobile application security testing, and threat led penetration testing. Verified: CREST Marketplace listing.

4. Arcanum Cyber

Arcanum is a UK cyber security consultancy. Its public evidence is a critical national infrastructure page saying it is trusted by regulators, operators and their supply chains, rather than a nuclear page. It also has an operational technology page describing its CREST accredited penetration testing team, and its penetration testing page says it can re-test key fixes if needed. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

5. NCC Group

NCC Group is a global cyber security company. Its public evidence is an energy and utilities sector page covering operational technology security, rather than a nuclear page. CREST-accredited for penetration testing, vulnerability assessment, incident response, incident exercising, security operations centre, threat intelligence and threat led penetration testing. Verified: CREST Marketplace listing.

6. CyberLab

CyberLab is a UK cyber security company. Its public evidence is an OT penetration testing page citing consultants with direct experience in manufacturing, critical national infrastructure and industrial environments, rather than a nuclear page. Its penetration testing page lists a re-test among what is included. CREST-accredited for penetration testing and vulnerability assessment. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a public page showing relevant work. Few penetration testing companies publish evidence for the nuclear supply chain itself, so the list includes companies whose published work is the closest match, and each entry states what its evidence covers. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• Nuclear evidence, in two tiers. Direct evidence is a public page naming civil nuclear work: a civil nuclear industry listing, a nuclear event or a nuclear service page. Closest-match evidence is a public page on critical national infrastructure, operational technology or energy and utilities. Direct entries come first. Well-known testing companies with no such public page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices for penetration testing on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A nuclear supplier usually has to show a prime contractor that findings were fixed, often by a contract milestone. Where a company states its retest terms or report turnaround we quoted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All six companies hold verified CREST penetration testing accreditation and show a United Kingdom headquarters on their listing. Two have direct nuclear evidence and four are closest matches. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do nuclear supply chain organisations have to have a penetration test?

Neither the legislation nor the regulator’s supply chain page we reviewed names a penetration test as mandatory. Regulation 4 of the Nuclear Industries Security Regulations 2003 requires the responsible person for each nuclear premises to ensure there is an approved security plan in place at all times. That duty sits with the person responsible for the nuclear premises, not with every supplier.

Suppliers are caught by a different route. Regulation 22 applies to persons who have possession or control of sensitive nuclear information and are involved in activities on or in relation to a nuclear site or nuclear premises. The Office for Nuclear Regulation’s page on sensitive nuclear information in the supply chain says the regulations require responsible persons to maintain such security standards, procedures and arrangements as are necessary to minimise the risk of loss, theft or unauthorised disclosure of, or unauthorised access to, that information. ONR says it uses its Security Assessment Principles, which include Fundamental Security Principle 7 on cyber security and information assurance, to guide its judgements when assessing those arrangements.

So the duty is outcome-based. In practice, prime contractors and licensees usually ask suppliers for independent testing evidence on the systems used to exchange technical information; that is common practice rather than a rule we could find in the legislation. A requirement may specify a CREST-accredited company or a scheme-approved provider, depending on what it states. Where a requirement names a scheme, use a provider approved for it. Where it asks for a CREST-accredited penetration test, a CREST-accredited company such as EJN Labs meets it. Read the requirement before you buy.

What a nuclear supply chain organisation should ask a penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. What does our contract or prime contractor’s requirement actually state? Ask your customer whether it specifies a CREST-accredited company or a particular scheme, and make sure your supplier meets exactly that wording.
3. Where are the testers based, and who will see our data? Controlled technical documents may be visible during testing, so ask where the people doing the work are located and how findings are stored.
4. Is a retest included, and for how long? Prime contractors ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. What will you test, and what will you not touch? Ask where the line sits between your IT systems and any engineering or site systems, and who signs off any work that reaches towards them.
6. What is the fixed price for our scope? Ask for a day count and a day rate, not a range.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for the UK nuclear supply chain.

Related: Nuclear Supply Chain Vendors: The ONR CSIA Questions to Prepare For and Penetration Testing Cost for UK Nuclear Supply Chain Vendors.