Penetration Testing Cost for UK Accountancy and Professional Services Firms (2026)

A penetration test for a UK accountancy or professional services firm typically costs £1,100 to £32,200 in the UK market. The low end is a short test of the internal network. The high end is a whole-firm test covering the client portal, the perimeter and internal systems. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for an accountancy firm?

Most accountancy and professional services firms fall into one of five scopes, typically costing between £1,100 and £32,200 in the UK market. What you pay depends on how many systems are tested and how complex each one is, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Internal network and Active Directory	An assumed-breach test of a single-site firm: Active Directory, file-share scoping and separation between teams	1 to 3 days	£1,100 to £4,200
Perimeter only	Internet-facing services, VPN and remote-access gateways, and exposed management interfaces	2 to 3 days	£2,200 to £4,200
One client portal	A client portal with tax upload and document sharing, tested for client-to-client isolation and upload handling	5 days	£5,500 to £7,000
Portal plus accounting integrations	The portal above, plus the API that connects it to accounting software and practice systems	9 to 10 days	£9,900 to £14,000
Whole-firm test	A multi-role portal or audit data room, the external perimeter, and the internal network including partner, audit, tax and admin separation	13 to 23 days	£14,300 to £32,200

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. Five things move the day count at an accountancy firm: how many client-facing systems are in scope, how many user roles each has, how many integrations connect them, how large the network is, and how many sites and domains it spans.

• Number of systems. A client portal, an audit data room and a practice management platform are three separate tests, even when one IT contact looks after all three.
• User roles. A platform with client, staff, manager and partner roles takes longer than a single-role portal, because each boundary between roles has to be tested.
• Integrations. APIs that connect practice systems to cloud accounting software, bank feeds and HMRC submissions add time when they are tested in their own right. See API penetration testing.
• Network size. The number of hosts, sites and Active Directory domains sets the length of the infrastructure work. See internal network penetration testing.
• Cloud and email. A Microsoft 365 configuration review can sit beside the test. See Microsoft 365 security review.

Tester grade is not a pricing factor, and neither is the size of the testing company or of your firm. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

Does a client’s request change the price?

It changes the scope, not the day rate. A client’s questionnaire usually decides which systems must be covered and by when. Read the exact wording first, because a question about your client portal needs a very different test from a question about your office network.

No public rule makes a client’s request mandatory. UK GDPR Article 32(1)(d) separately requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures, and a penetration test is one way to evidence it. Cyber Essentials Plus, which some clients also ask for, is an assessor-led audit and is priced separately on the Cyber Essentials Plus page.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a system added after the quote, extra user roles, or a larger network than the one described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say which client has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which systems are in scope: client portal, data room, practice management, integrations, network.
2. For each web platform, the number of user roles and whether clients log in to it.
3. For the network, roughly how many hosts, how many sites, and how many Active Directory domains.
4. For Microsoft 365, whether conditional access and multi-factor authentication are in place.
5. Who asked for the test, and the exact wording of the questionnaire.
6. Any dates to avoid, such as filing deadlines or audit season.

Accountancy and professional services firms can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the client document names an accreditation, say so when you ask for the quote.

How EJN Labs approaches pricing for accountancy and professional services firms

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated accountancy and professional services service. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test client portals and tax upload, audit data rooms, practice management platforms, accounting and HMRC integrations, Microsoft 365 and the internal network, with client confidentiality as the starting point. Testing is safe by default on production, with no denial of service.

Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for an accountancy firm?

Typically £1,100 to £32,200 in the UK market. A perimeter-only test of 2 to 3 days is £2,200 to £4,200. One client portal at 5 days is £5,500 to £7,000. A whole-firm test of 13 to 23 days is £14,300 to £32,200. These ranges use UK day rates of £1,100 to £1,400.

Why is a client portal priced differently from the office network?

Because a portal is a web application with user roles, uploads and client-to-client boundaries to test, which takes more days. A client portal at 5 days is £5,500 to £7,000, while an internal network test for a single-site firm can be 1 to 3 days, at £1,100 to £4,200.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

How long does a penetration test take for an accountancy firm?

Between 1 and 23 testing days for the scopes in the table above. An internal network test is typically 1 to 3 days, one client portal is 5 days, and a whole-firm test is 13 to 23 days. EJN Labs delivers the report on the last day of testing.

Can testing avoid filing deadlines and audit season?

Yes. Tell the testing company about busy periods when you ask for the quote. EJN Labs offers out of hours slots at no extra charge, and testing is safe by default on production, with no denial of service, so client work can carry on.

Get a fixed price for your firm

Tell us which systems are in scope and which client has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Client Due Diligence: Does Your Accountancy Firm Need a Penetration Test?, Best Penetration Testing Companies for UK Accountancy and Professional Services Firms, penetration testing for accountancy and professional services, penetration testing cost in the UK, web application penetration testing cost and network penetration testing cost.