The Best Penetration Testing Companies for the UK Public Sector and Government Suppliers (2026)

The best penetration testing companies for the UK public sector and government suppliers in 2026 are listed below, led by NCC Group with EJN Labs second. Each holds CREST accreditation for penetration testing and publishes a government or public sector page, and each is compared on pricing, retests and report turnaround. Public sector organisations can use a CREST-accredited company or a CHECK company, depending on what their requirement states, so the list shows both.

1. NCC Group

NCC Group is a UK cyber security company with a dedicated public sector and government services page, which says it supports all central UK government departments and the wider public sector through Crown Commercial Service frameworks. The NCSC lists it as an NCSC-assured CHECK company. CREST-accredited for penetration testing, incident response, vulnerability assessment, security operations centre and threat intelligence. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy and a Crown Commercial Service supplier on G-Cloud, with a dedicated public sector penetration testing service covering citizen service portals, casework and case management systems, cross-government APIs, internal networks and Active Directory, cloud environments and phishing assessments. It is one of three companies on this list that publish their pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus, and is an IASME Certification Body for Cyber Essentials and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

Public sector organisations can use a CREST-accredited company or a CHECK company, and which one depends on what the requirement states. EJN Labs is CREST-accredited. It suits public bodies and suppliers to government whose requirement asks for a CREST-accredited penetration test, whether that is for a contract, a supplier due diligence request or an internal risk review. Where a requirement names CHECK, the CHECK companies are marked on this list. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your team can start fixing on day one. The report arrives on the last day of testing, the shortest stated turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold citizen or casework data. Production systems can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off, so public-facing services stay available. Out of hours or overnight slots are available. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to a prime contractor, a procurement team or an auditor.

NCC Group holds both CREST accreditation and CHECK status and has a dedicated government page, so it can meet either requirement, which keeps it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second.

3. Pen Test Partners

Pen Test Partners is a UK security consultancy whose CHECK penetration testing page describes testing for central government departments, local authorities, NHS bodies and arm’s-length bodies. The NCSC lists it as an NCSC-assured CHECK company. CREST-accredited for penetration testing, incident response, vulnerability assessment, application and mobile application security testing, and threat led penetration testing. Verified: CREST Marketplace listing.

4. Precursor Security

Precursor Security is a UK offensive security consultancy with a government and public sector page describing itself as a CREST-accredited provider for UK central and local government organisations, with services available through G-Cloud. It is one of three companies on this list that publish pricing: its cost page states engagements from £2,500 at approximately £1,200 per consultant day, with a 30-day retest, and its penetration testing page states a report within 5 working days of test completion. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

5. Claranet

Claranet is a managed services and cyber security company whose police penetration testing page describes CREST-accredited testing of police systems against NCSC CAF objectives. The NCSC lists it as an NCSC-assured CHECK company. CREST-accredited for penetration testing, security operations centre, vulnerability assessment, and application and mobile application security testing. Verified: CREST Marketplace listing for Claranet Cyber Security.

6. Dionach

Dionach is a UK cyber security consultancy with a government and public sector page covering how it helps those organisations understand cyber risk and secure complex digital environments. The NCSC lists it as an NCSC-assured CHECK company. CREST-accredited for penetration testing, incident response, vulnerability assessment and threat led penetration testing. Verified: CREST Marketplace listing.

7. Prism Infosec

Prism Infosec is a UK cyber security consultancy with a public sector and defence page that lists cyber security assessments and penetration testing among the ways it supports those organisations. The NCSC lists it as an NCSC-assured CHECK company. CREST-accredited for penetration testing, incident response, incident exercising, vulnerability assessment and threat led penetration testing. Verified: CREST Marketplace listing.

8. ProCheckUp

ProCheckUp is a long-established UK security consultancy with central government and local government sector pages, and a dedicated NCSC IT Health Checks service page. Its CREST listing shows 17 years of membership, with accreditations in penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

9. Sentrium

Sentrium is an independent UK penetration testing consultancy with a government penetration testing page aimed at protecting public services. It is the third company on this list with published pricing: its network penetration testing page gives an indicative range of £5,000 to £15,000, and its penetration testing page states retesting of high and critical findings for up to 30 days. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a public page showing government or public sector work. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry.
• Public sector evidence. A general penetration testing company was not enough. Each entry needed a public page showing government, local government, policing or wider public sector work. Well-known testing companies with no such page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• NCSC CHECK status. CHECK is a separate NCSC scheme, not part of CREST. We state a company is a CHECK company only where the NCSC publishes a CHECK page for it. If a company is not marked as one in this article, treat that as not shown on the NCSC pages we checked, and confirm with the company.
• Published pricing, retests and report turnaround. We recorded whether a company publishes its own prices, retest terms and report turnaround on a public page. General statements about what the market charges were not counted as a company’s own pricing. Where we could not find a term we recorded not found rather than inventing an answer.

How the companies compare

All nine companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have a public sector page. Five are also NCSC CHECK companies. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing, and CHECK status from the NCSC’s own page for each company. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do public sector organisations have to have a penetration test?

No single rule names a penetration test as mandatory for every public body or government supplier. What the rules do cover is who should carry one out. The NCSC’s guidance on using a CHECK provider says that for central government departments and their agencies, all systems processing data protectively marked OFFICIAL and above should be assessed by companies assured under CHECK. For other public sector bodies it strongly recommends that all systems be assessed by a CHECK company, unless the system’s risk owner explicitly advises otherwise. It also says that if your organisation is not public sector, penetration testing does not need to be conducted by a CHECK service provider.

So the choice between a CREST-accredited company and a CHECK company depends on what your requirement states. Where it names CHECK or an IT Health Check, use a CHECK company. Where it asks for a CREST-accredited penetration test, a CREST-accredited company such as EJN Labs meets it. Suppliers to government are in a different position, because the buyer’s contract sets the test, not a public rule. GovAssure is the scheme for assessing government critical systems against the NCSC’s Cyber Assessment Framework. The framework is outcome-based and asks for objective evidence that vulnerabilities are managed, and the NCSC’s penetration testing guidance describes a test as a method for gaining assurance in your vulnerability assessment and management processes.

For personal data, UK GDPR Article 32 requires appropriate security measures, including, as appropriate, a process for regularly testing, assessing and evaluating their effectiveness. A penetration test is one recognised way to evidence that process. In practice, a supplier is usually asked for an independent test report by the public body it sells to, in a tender, a security questionnaire or a contract schedule. Public bodies can buy EJN Labs testing through G-Cloud, as set out on our public sector penetration testing page.

What a public sector organisation should ask a penetration testing company

1. Does the requirement ask for a CHECK company or a CREST-accredited one? Ask the system’s risk owner or your security team first, then check the company in the NCSC’s CHECK information if it does. A CREST report is not a CHECK report.
2. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
3. Where are the testers based, and what vetting does our contract expect? Citizen and casework data may be visible during testing, so ask where the people doing the work are located and how findings are stored.
4. Is a retest included, and for how long? Audit and assurance reviews ask for evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. How will you keep live public services available? Ask how disruptive checks are handled on production systems and whether out of hours testing is offered.
6. How do we buy, and what is the fixed price for our scope? Ask whether the company is available through a framework such as G-Cloud, and ask for a day count and a day rate, not a range.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for the UK public sector and government suppliers.

Related: Council and Public Body Tenders: What a Penetration Test Requirement Asks For and Penetration Testing Cost for UK Councils and Public Bodies.