The Best Phishing Simulation Providers in the UK (2026)

The best phishing simulation providers in the UK in 2026 are CREST-accredited penetration testing companies that plan, send and report on the campaign for you, rather than software you run yourself. Each is listed below with its phishing or social engineering service, then compared on published pricing, retests and report turnaround.

1. Bridewell

Bridewell is a UK cyber security consultancy with a dedicated phishing assessments page. It describes assessments that follow the same process as a real-life phishing campaign, each one bespoke to the organisation’s business and goals, with a review of the people and technologies involved. The same page states that Bridewell is accredited by CREST and recognised as a Certified Cyber Security Consultancy by the National Cyber Security Centre. Its CREST listing shows penetration testing, incident exercising, incident response, vulnerability assessment, security operations centre and threat led penetration testing. Verified: CREST Marketplace listing.

2. EJN Labs

EJN Labs is a CREST-accredited UK penetration testing consultancy that runs phishing assessments for the buyer: AI-generated lures, MFA-fatigue testing, OAuth phishing, vishing, smishing and physical pretext attacks, with SOC coordination throughout. It is one of two companies on this list that publish a starting price. Phishing and social engineering assessments start at £3,000 on the pricing page, with a typical range of £6,000 to £15,000 over 7 to 10 days. A single-channel email campaign of up to 500 targets is £3,000 to £6,000, and a multi-channel campaign across email, vishing, smishing and OAuth phishing is £6,000 to £15,000. Every engagement is a fixed price for a defined scope, quoted within 24 hours of the scoping call. The business holds ISO 27001, ISO 9001, Cyber Essentials and Cyber Essentials Plus, and is an IASME Certification Body for both Cyber Essentials tiers. Verified: CREST Marketplace listing for EJN Labs.

Retesting of fixed findings is free until every finding is closed, so the evidence that your fixes worked is part of the original quote. By EJN Labs’ own figures, free retests save clients up to 35% against paying for retesting separately, and free rescheduling means a slipped release date costs nothing. Findings are posted to a client portal as they are confirmed. The report arrives on the last day of testing, with a CVSS score and prioritised remediation guidance for each finding, followed by a walkthrough call. There are no callout, cancellation or out-of-hours fees.

Testing is delivered by UK-based, CREST-certified penetration testers, priced at a fair-market £1,100 to £1,400 per day. Physical pretext work only runs where you authorise it in writing, and checks are safe-by-default: denial of service is never run against production and any disruptive step waits for your sign off. Out of hours slots are available. The enterprise tier, covering all channels plus physical pretext, starts at £15,000 for 12 or more days of work.

Bridewell’s dedicated phishing assessments page, its NCSC consultancy status and its threat led penetration testing listing keep it first. On the criteria this page can verify from public pages, which are published starting price, retests and report turnaround, EJN Labs has the most complete published answer, with a £3,000 starting price, free retests until every finding is closed and the report on the last day of testing, which is why it sits second.

3. Precursor Security

Precursor Security is a UK offensive security consultancy whose social engineering testing page covers phishing, vishing, physical testing and pretexting. That page publishes a fixed starting price and states a findings turnaround for standard phishing campaigns and for combined engagements. CREST-accredited for penetration testing, vulnerability assessment and security operations centre. Verified: CREST Marketplace listing.

4. OnSecurity

OnSecurity is a UK penetration testing company with a phishing simulation testing page describing CREST-accredited phishing penetration testing delivered by its testers. The page states free retests for resolved issues within a flexible window, findings reported in real time as testing proceeds, and an instant online quote with hourly billing, although it does not state a price. CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

5. Prism Infosec

Prism Infosec is a UK security consultancy whose social engineering simulation page says it safely tests how employees respond to realistic phishing, impersonation and physical access scenarios, and that the report covers the scenarios used, key findings and success rates. This is the nearest public page to a phishing service, so the evidence covers social engineering simulation including phishing rather than a phishing-only offer. CREST-accredited for penetration testing, vulnerability assessment, incident response, incident exercising and threat led penetration testing. Verified: CREST Marketplace listing.

6. Evalian

Evalian is a UK data protection and security consultancy with an email phishing assessments page. It describes a tester who sends realistic mock emails and tracks results, with general campaigns or targeted spear-phishing, and lists a free retest for remediated vulnerabilities among the deliverables. CREST-accredited for penetration testing, vulnerability assessment, incident response, incident exercising and security operations centre. Verified: CREST Marketplace listing.

7. Dionach

Dionach is a UK security consultancy with a social engineering testing page covering realistic phishing, vishing, impersonation and physical security simulations. It says it measures exposure, detection and reporting behaviour rather than only click rates, and describes repeat assessments to track improvement. The evidence is a social engineering page that includes phishing, not a phishing-only service. CREST-accredited for penetration testing, vulnerability assessment, incident response and threat led penetration testing. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same two entry checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, and a live public page for phishing or social engineering simulation. We then recorded what each company publishes about pricing, retests and report turnaround. All pages were checked on 24 October 2026.

• CREST accreditation, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent.
• A company that runs the simulation for you. This list is of companies whose testers design and run the campaign and report the result. Software-only platforms, where the buyer builds and sends the campaigns themselves, are not on it, and a home page that merely mentions phishing in a menu was not enough. Bridewell, OnSecurity and Evalian have phishing-specific pages; Precursor Security, Prism Infosec and Dionach have social engineering pages that cover phishing, and the table says so.
• Published pricing. We recorded whether a company publishes its own prices on a public page. General statements about what the market charges were not counted as a company’s own pricing.
• Retests and report turnaround. A phishing assessment is often repeated to show improvement, so retest terms and the time to a report matter. Where a company states them on its phishing or social engineering page we noted them; where we could not find them, we recorded not found rather than inventing an answer.

How the companies compare

All seven companies hold verified CREST penetration testing accreditation and show a United Kingdom headquarters on their listing. The practical differences are in what they publish.

Accreditation is taken from each company’s CREST Marketplace listing. Pricing, retest and report details are taken from each company’s own public pages, linked in its profile above, as they stood on 24 October 2026. Not found means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

Do you have to run phishing simulations?

No law or regulation names a phishing simulation as mandatory for a UK organisation. The duties that lead organisations to commission one are broader. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures, but it does not name phishing simulation or any other method. A simulated campaign is one way to evidence that process for the human layer of your defences.

ISO 27001 Annex A control 6.3, information security awareness, education and training, is a control you apply or justify excluding in your Statement of Applicability. It asks for awareness training, not a simulation. Cyber Essentials does not require one either: the NCSC’s Cyber Essentials scheme is built on technical controls such as user access control and malware protection. The NCSC’s phishing guidance recommends a multi-layered defence, warns that no training package or simulation can teach users to spot every phishing email, and says you should check with your HR department before running one.

In practice the request usually comes from outside the organisation: a customer’s security questionnaire, an insurer’s proposal form or an auditor looking for evidence that awareness work is measured. That is common practice, not a rule. Treat the simulation as a measurement of how staff, processes and your mail and identity controls respond together, and agree the approach with HR before the campaign starts. For scope and cost, see our phishing assessments service.

What a buyer should ask a phishing simulation company

1. Which legal entity holds your CREST accreditation? Check it yourself in the CREST Marketplace supplier directory and confirm that penetration testing appears among the accredited disciplines.
2. Who designs and sends the campaign? You want named testers building lures for your business, not a template library you operate yourself.
3. Which channels are in scope? Email only, or also vishing, smishing, OAuth consent phishing and MFA fatigue, and is physical pretext work available where you authorise it?
4. How are staff, HR and the SOC handled? Ask who is told in advance, how results are reported without blaming individuals, and what happens when someone enters credentials.
5. Is a retest included, and when do we get the report? A repeat campaign is how you show improvement, and the gap between the end of testing and the report matters if an audit or renewal date is driving the work.
6. What is the fixed price for our scope? Ask for the number of targets and channels covered, not a range.

Get a quote

Read the starting price for phishing and social engineering assessments and the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Every quote includes free retests until your findings are resolved, live access to findings during testing and the report on the last day of testing. Get a penetration testing quote, read more about phishing assessments, or compare the wider market in our list of the best CREST-accredited penetration testing companies in the UK.