The Best Penetration Testing Companies for UK Retail and E-commerce (2026)

The best penetration testing companies for UK retail and e-commerce in 2026 are listed below. Each one holds a verified CREST penetration testing accreditation and shows public evidence of working with retailers or online merchants, and each is compared on published pricing, retests and report turnaround.

1. Foregenix

Foregenix is a UK information security company with its roots in the payment card industry. Its PCI DSS compliance service states that Foregenix is a Qualified Security Assessor company qualified by the PCI Security Standards Council, working with clients from small retail merchants to large banks, and its e-commerce insights page sets out its work on hacked e-commerce sites. It is CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated retail and e-commerce penetration testing service covering storefronts, checkouts, merchant admin, loyalty apps and returns portals, including price and voucher logic, payment redirects, returns fraud, customer accounts and third-party scripts. It is one of three companies on this list that publish their pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001 and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

For a retailer, what the fixed price includes matters as much as the number. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked, which is what a PCI DSS assessor, an acquirer or a retail partner’s supplier questionnaire usually asks for, is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your developers or agency can start fixing on day one. The report arrives on the last day of testing, the shortest stated turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold customer accounts and order history. Production systems can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off. Out of hours or overnight slots are available so trading and customer service are not interrupted. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to an assessor, an insurer or a retail partner.

Foregenix’s standing as a PCI Qualified Security Assessor keeps it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second.

3. Precursor Security

Precursor Security is a UK offensive security consultancy with a published retail and e-commerce service that describes PCI DSS testing, ASV scanning and Magecart prevention. It is one of three companies on this list that publish pricing: its cost page states engagements from £2,500 at approximately £1,200 per consultant day, with a 30-day retest, and its penetration testing page states a report within 5 working days of test completion. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

4. Dionach

Dionach is a UK cyber security consultancy whose retail and e-commerce page describes helping retailers protect payment data and secure connected environments. CREST-accredited for penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

5. Sentrium

Sentrium is an independent UK penetration testing consultancy with dedicated retail and e-commerce penetration testing pages. It is the third company on this list to publish pricing: its cloud testing page gives an indicative range, and its penetration testing page states a free retest window of up to 30 days for high and critical findings. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

6. Sencode

Sencode is a UK penetration testing company with an e-commerce and retail page covering retail and e-commerce platforms. Its quote page states a free retest with a 6-month window and a final report within five working days of test completion. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

7. NCC Group

NCC Group is a UK-headquartered global cyber security company with a retail and consumer markets sector page. Its CREST listing shows accreditation for penetration testing, vulnerability assessment, incident response and security operations centre, among others. Verified: CREST Marketplace listing.

8. ProCheckUp

ProCheckUp is a long-established UK security consultancy whose CREST listing shows 17 years of membership. Its retail and e-commerce sector page describes security assessments of customer accounts, online transactions and payment processing. Its accreditations span penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and public evidence of work with retail or e-commerce businesses. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• Retail and e-commerce evidence. A general penetration testing company was not enough. Each entry needed a public page showing retail or e-commerce work: a dedicated sector service page, or a payment card industry qualification together with e-commerce work. Well-known testing companies with no such public page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A merchant usually has to show that findings were fixed, often before an assessment or renewal date. Where a company states its retest terms or report turnaround we quoted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All eight companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing, and have public retail or e-commerce evidence. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do retailers and e-commerce businesses have to have a penetration test?

For businesses that store, process or transmit payment card data, yes, but the requirement comes from the card industry standard rather than from UK law. The PCI Security Standards Council document library holds PCI DSS v4.0.1. Requirement 11.4.1 requires a documented penetration testing methodology based on an industry-accepted approach, 11.4.2 requires internal penetration testing at least once every 12 months and after significant change, and 11.4.3 requires external penetration testing on the same cycle. Requirement 11.4.4 requires exploitable vulnerabilities to be corrected and the testing repeated, and 11.4.5 requires segmentation testing where segmentation isolates the cardholder data environment.

Which of these sub-requirements apply to you depends on the self-assessment questionnaire (SAQ) or report on compliance that fits how you take payments. A quarterly external scan by an Approved Scanning Vendor (Requirement 11.3.2) is a different control and is not a penetration test, and Requirement 11.6.1 separately asks for payment-page tamper and change detection, which is where third-party checkout scripts sit. Outside card data, no UK rule names a penetration test for retailers. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method, but a test is one recognised way to evidence that process for customer accounts and order data. For scope and cost, see our guide to e-commerce penetration testing and our PCI DSS penetration testing page.

What a retailer should ask a penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Will the test be scoped to my SAQ or report on compliance, and will the report map findings to PCI DSS Requirement 11.4? An assessor will ask which sub-requirements the test was meant to satisfy.
3. Do you test business logic as well as the standard web checks? Price and voucher manipulation, checkout integrity, returns fraud and customer-account takeover are where retailers lose money, so ask how each is tested.
4. Is a retest included, and for how long? Requirement 11.4.4 expects testing to be repeated after correction, so a retest that is capped or charged separately changes the real price.
5. Can you test a live store without disrupting trading? Ask about out of hours testing, whether denial of service is ever run against production, and how third-party scripts on checkout pages are handled.
6. What is the fixed price for our scope, and when do we get the report? Ask for a day count and a day rate, not a range, and for the gap between the end of testing and delivery.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for UK retail and e-commerce.

Related: PCI DSS 4.0 Penetration Testing: What UK Retailers Must Change First and PCI DSS Penetration Testing Cost for UK Retailers and E-commerce.