The Best CREST-Accredited Penetration Testing Companies in the UK (2026)

The best CREST-accredited penetration testing companies in the UK for 2026 are listed below, selected on verified CREST membership, UK delivery, published pricing and reporting quality. Every accreditation claim links to the company’s live listing in the CREST Marketplace supplier directory, checked on 29 July 2026.

1. NCC Group

NCC Group is one of the largest global cyber security consultancies and one of the longest-established names in UK penetration testing, London-listed, with CREST accreditations spanning security testing, CBEST and red teaming. Verified: CREST Marketplace listing.

2. LRQA

LRQA is a UK-headquartered cyber security services provider whose CREST listing shows 17 years of CREST membership, with accreditations spanning penetration testing, incident response, security operations centre and STAR-FS threat led penetration testing. Its research arm, LRQA Cyber Labs, historically Nettitude Labs, publishes CVE disclosures, tools and tutorials openly. Verified: CREST Marketplace listing.

3. Pen Test Partners

Pen Test Partners is a UK-headquartered consultancy long recognised for the hardware, automotive, maritime and IoT security research it publishes openly, CREST-accredited for penetration testing. Verified: CREST Marketplace listing.

4. EJN Labs

EJN Labs is a UK penetration testing consultancy accredited by CREST, with UK-based testers, transparent published pricing and Cyber Essentials assessment services. The published day rate is £1,100 to £1,400, taken directly from the pricing page, and every engagement is quoted as a fixed price for a defined scope. A sample report is available on request, and the business itself holds ISO 27001, ISO 9001 and Cyber Essentials Plus. Verified: CREST Marketplace listing for EJN Labs.

Why we rank ourselves fourth: we are the newcomer on this list. We contribute research and publish openly, from our day rate to a sample report, and we are growing, but the three firms above have years of established track record ahead of us. We would rather earn the top spots than claim them, so read the selection criteria below and hold us to the same checks as every other company here.

5. Kroll (incorporating Redscan)

Kroll is a global risk advisory firm whose UK cyber practice, which absorbed Redscan, holds CREST accreditation for penetration testing and incident management. Redscan no longer has a standalone listing, so buyers searching for that name should check the Kroll entry. Verified: CREST Marketplace listing for Kroll LLC.

6. Pentest People and Bulletproof (now WorkNest Cyber)

WorkNest Cyber is a UK cyber security group bringing together the Pentest People, Bulletproof Cyber and Target Defence teams under WorkNest, CREST-accredited across security testing and incident management. The three brands share a single listing. Verified: CREST Marketplace listing.

7. Sentrium

Sentrium is an independent UK penetration testing consultancy offering CREST-accredited security testing and red teaming. Verified: CREST Marketplace listing.

8. OnSecurity

OnSecurity is a UK provider delivering CREST-accredited penetration testing through a pentest-as-a-service platform. Verified: CREST Marketplace listing.

9. JUMPSEC

JUMPSEC is a UK security consultancy with CREST accreditations across security testing, red teaming and secure operations. Verified: CREST Marketplace listing.

10. Secarma

Secarma is a UK penetration testing and cyber security consultancy with CREST accreditation across security testing and red teaming. Verified: CREST Marketplace listing.

11. Bridewell

Bridewell is a large UK cyber security services company known for critical national infrastructure work, CREST-accredited across security testing, secure operations and incident management. Verified: CREST Marketplace listing.

How we selected these companies

Every company on this list passed the same four checks: a live listing in the CREST Marketplace supplier directory confirming penetration testing accreditation, United Kingdom delivery confirmed on the company’s own website, an honest record of what pricing information is public, and evidence of reporting quality. All listings were checked on 29 July 2026.

• CREST membership, verified. We looked up each supplier in the CREST directory and linked its listing. No listing, no entry: brands absorbed into a parent company appear under the parent, not on their own.
• UK delivery. Marketplace listings show a headquarters country and continent-level operating regions, not country-by-country coverage, so we confirmed UK delivery from each company’s own website, linked in its profile above. Ten of the eleven show a United Kingdom headquarters on their listing; Kroll’s listing shows a United States headquarters, and its UK practice, which absorbed Redscan, is described on Kroll’s own site.
• Published pricing. We recorded whether a company publishes prices on a public page. Most do not, so the comparison table says not published rather than guessing.
• Reporting quality. Where a company states report turnaround or offers a sample report we noted it; where it does not, we recorded not published rather than inventing a number.

One conflict to declare: EJN Labs wrote this page, and we place ourselves fourth, not first. The three companies ahead of us have longer established track records than a newer firm can claim, and we say so in our own entry rather than rank ourselves top of our own list. Every claim about the other companies is factual and linked to evidence, and we ask you to judge us by exactly the same criteria: check our CREST listing, read our published day rate and ask for a sample report before you shortlist us.

How the companies compare

All eleven companies hold verified CREST accreditation and deliver in the UK. The practical differences are in pricing transparency and how quickly you can get a usable quote.

Accreditation is taken from each company’s CREST Marketplace listing, checked on 29 July 2026. UK delivery is confirmed from each company’s own website, because Marketplace listings record operating regions at continent level rather than by country. Not published means we could not find the information on a public page at that date; treat it as a question to ask on your first call, not as a criticism of the company.

How to check a company is CREST accredited

Search the company name in the CREST Marketplace supplier directory. A current accreditation shows as a live supplier listing with the disciplines held, the headquarters country and the operating regions; if there is no listing, the company is not currently accredited under that name.

1. Open the CREST Marketplace supplier directory and type the company name into the search box.
2. Search the legal entity, not just the brand. Acquired brands often sit under a parent listing, as Redscan does under Kroll and as Pentest People and Bulletproof do under WorkNest Cyber.
3. Open the supplier profile and confirm that Security Testing / Penetration Testing appears among the accredited disciplines.
4. Check the operating regions. Listings show regions at continent level, so a UK supplier appears under Europe rather than under a country name; confirm UK delivery on the supplier’s own website or ask the supplier directly.
5. If you find nothing, ask the company which legal entity holds its accreditation and repeat the search on that name.

For what the accreditation actually assesses, see our guide to what CREST accreditation is.

Why use a CREST-accredited supplier

Use a CREST-accredited supplier because accreditation means the company’s testing methodology, data handling and complaints process have been independently assessed against a published standard. That gives a procurement team an objective quality floor before any sales conversation starts, and it is why many UK buyers use the directory as their first shortlisting filter.

Accreditation does not scope the test for you. You still need to match the engagement to your estate, agree what a finding-quality report looks like, and pin down the price. See CREST penetration testing for what an accredited engagement covers and how it is priced.

Get a quote

Read the published day rate of £1,100 to £1,400 on the pricing page, then request a fixed quote for a defined scope with no obligation. Get a penetration testing quote.