The Best Penetration Testing Companies for UK Social Care (2026)

The best penetration testing companies for UK social care in 2026 are listed below. Each one holds a CREST penetration testing accreditation and shows public evidence of work with care providers or the Data Security and Protection Toolkit, and each is compared on published pricing, retests and report turnaround.

1. Dionach

Dionach is a UK cyber security consultancy with a Data Security and Protection Toolkit service page that lists social care providers among the organisations it is ideal for. The same page states that the Data Security Assessment Dionach delivers on behalf of NHS Digital provides external assurance for up to 15 requirements of the DSPT. CREST-accredited for penetration testing, incident response, vulnerability assessment and threat led penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy with a dedicated social care penetration testing service for care homes, domiciliary care agencies and the software vendors building care platforms, covering care-plan apps, family and referral portals, staff rota systems, case management, care worker mobile apps, referral APIs and the cloud platforms behind them. It is the only company on this list that publishes its pricing. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

For a care provider or a care software supplier, what the fixed price includes matters as much as the number. Retesting of fixed findings is free until the issues are resolved, so the evidence that your fixes worked, which is what a commissioner, a local authority or a Data Security and Protection Toolkit assessor may ask for, is part of the original quote. Findings are delivered live to a client portal as they are confirmed, so your IT team or software supplier can start fixing on day one. The report arrives on the last day of testing, the only stated turnaround on this list. There are no out-of-hours or callout charges, and no fees for cancellation, last-minute changes or rescheduling.

Testing is delivered by UK-based, CREST-certified penetration testers, which matters when the systems in scope hold care plans, risk assessments and daily notes about vulnerable people. Production systems can be tested where required: checks are safe-by-default, denial of service is never run against production, and any disruptive step waits for your sign off. Testing windows are agreed around care delivery hours, and out of hours or overnight slots are available so care staff are not interrupted. Reports give each finding a CVSS score and prioritised remediation guidance, followed by a walkthrough call, and are written to be handed to a commissioner, an auditor or a customer’s security team.

Dionach’s Data Security and Protection Toolkit work for NHS Digital, and its page naming social care providers, keep it first. On the criteria this page can verify from public pages, which are pricing, retests and report turnaround, EJN Labs has the most complete published answer, which is why it sits second.

3. Wavenet (CyberGuard)

Wavenet is a UK technology and communications provider whose CyberGuard cyber security arm offers CREST penetration testing. Its Data Security and Protection Toolkit page addresses healthcare organisations, social care providers and third-party suppliers working with or within the NHS. CREST-accredited for penetration testing, application and mobile application security testing, incident response, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing for Wavenet CyberGuard.

4. Zenzero

Zenzero is a managed IT and cyber security provider with a care homes service page offering IT support for care homes and care organisations, alongside a penetration testing service. CREST-accredited for penetration testing and vulnerability assessment. Verified: CREST Marketplace listing.

5. Kroll (incorporating Redscan)

Kroll is a global risk advisory firm whose UK cyber practice absorbed Redscan. Redscan’s NHS Data Security and Protection Toolkit page explains the National Data Guardian’s data security standards that apply to organisations handling health and social care information, and its article on the secure email standard in health and social care covers the email standard care providers must meet. Kroll holds CREST accreditation for penetration testing, incident response and security operations centre. Redscan has no standalone listing, so check the Kroll entry. Verified: CREST Marketplace listing for Kroll LLC.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and public evidence of work with social care. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 7 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• Social care sector evidence. A general penetration testing company was not enough. Each entry needed a public page showing work with social care: a service page for care homes or care providers, or a Data Security and Protection Toolkit service that addresses care providers. Social care is a small niche among penetration testers, so evidence here is thinner than for larger sectors, and well-known testing companies with no such public page are not on this list, although they appear on our wider list of the best CREST-accredited penetration testing companies in the UK.
• Published pricing. We recorded whether a company publishes its own prices on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A care provider often has to show that findings were fixed before a toolkit submission or a commissioning review. Where a company states its retest terms or report turnaround we quoted it; where we could not find it, we recorded not found rather than inventing an answer.

How the companies compare

All five companies hold verified CREST penetration testing accreditation, show a United Kingdom headquarters on their listing except Kroll, and have public social care evidence. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are quoted from each company’s own public pages, linked in its profile above, as they stood on 7 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do social care providers have to have a penetration test?

No rule we found names a penetration test as mandatory for a care provider. The duties that lead providers and care software suppliers to commission one are about data security more broadly. The Data Security and Protection Toolkit says that all organisations that have access to NHS patient data and systems must use it. Government guidance on becoming a fully digitised care provider says a CQC-registered provider is fully digitised if it uses an assured digital social care record solution and meets the standards met level on the toolkit. What evidence your organisation type needs is set by the toolkit itself, so check the evidence items for your category rather than assuming a test is or is not required.

For suppliers of digital social care records, the assured solutions list is described as a list of solutions assured by NHS England, and each solution on it meets national standards for quality and security. Providers choosing a record system are pointed to that list, so assurance status is something your customers will look for. For email, the same government guidance on secure email for adult social care providers says you must use a secure email service that meets the secure email standard (DCB1596) when sending confidential or personal information.

Underneath sits UK GDPR Article 32, which requires a process for regularly testing, assessing and evaluating the effectiveness of security measures. It does not name penetration testing, but care records are special category data, and a test is a recognised way to evidence that process. In practice the request usually comes from outside the organisation: a commissioner, a local authority, a software customer or an insurer. For scope, see our social care penetration testing page.

What a social care organisation should ask a penetration testing company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. What does our Data Security and Protection Toolkit category ask for? Ask the company to read the evidence items for your category with you, so you buy only what is needed.
3. Will real service-user data be touched? Care plans, risk assessments and daily notes may be visible during testing, so ask whether testing uses synthetic data and how findings are stored.
4. Is a retest included, and for how long? A commissioner or customer will want evidence that findings were fixed, so a retest that is capped or charged separately changes the real price.
5. Can you test around care delivery hours? Ask about out of hours testing and how disruptive checks are handled on live systems, including shared tablets and rota systems.
6. What is the fixed price for our scope, and when do we get the report? Ask for a day count and a day rate, not a range, and the gap between the end of testing and the report.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, or read more about penetration testing for UK social care.

Related: Cyber Essentials, Pen Testing and NHS Contracts: What Care Providers Need and Penetration Testing Cost for UK Care Providers and Care Software.