Penetration Testing Cost for UK Chemical and Process Sites (2026)

A penetration test for a UK chemical or process site typically costs £2,200 to £35,000 in the UK market. The low end is a short test of the internet-facing perimeter. The high end is a multi-system test covering web platforms, the perimeter and internal networks. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a chemical site?

Most chemical and process sites fall into one of four scopes, typically costing between £2,200 and £35,000 in the UK market. What you pay depends on how many systems are tested and how complex each one is, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Perimeter only	VPN gateways, remote-access services, exposed management interfaces and cloud consoles	2 to 3 days	£2,200 to £4,200
One web platform	A supplier portal, a laboratory platform or a plant-monitoring dashboard with a single user role	5 days	£5,500 to £7,000
One web platform plus the perimeter	The platform above, plus the internet-facing services around it	7 to 8 days	£7,700 to £11,200
Multi-system site test	A multi-role platform, a larger perimeter, and the corporate and site networks including the separation from the plant network	14 to 25 days	£15,400 to £35,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. Four things move the day count on a chemical site: how many systems are in scope, how many user roles each platform has, how large the network is, and how carefully the work has to be planned around the plant.

• Number of systems. A supplier portal, a laboratory platform and a plant-monitoring dashboard are three separate tests, even when one team runs all three.
• User roles. A supplier portal with supplier, buyer and quality-assurance roles takes longer than a single-role tool, because each boundary between roles has to be tested.
• Network size. The number of internet-facing addresses, sites and Active Directory domains sets the length of the infrastructure work.
• APIs and integrations. Interfaces between monitoring platforms, ERP systems and vendor feeds add time when they are tested in their own right. See API penetration testing.
• Plant-side planning. Anything that reaches towards the plant network needs a safe test plan agreed with your engineering team. That planning is part of scoping, and it is the main reason a site test should never be priced from a headline figure.

Tester grade is not a pricing factor, and neither is the size of the testing company. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

How is a site scoped when plant systems are involved?

Scope starts on the IT side: the perimeter, remote access, web platforms and the corporate network. Live control and safety systems are normally left out, and work near the plant network is planned separately. This keeps the day count predictable and follows the caution in the HSE’s own guidance for control systems.

The HSE publishes operational guidance, OG86, on cyber security for industrial automation and control systems. It lists penetration testing as an optional measure and warns that many real-time control and safety systems may be taken offline by testing. The HSE’s cyber security page describes OG86 as guidance that is freely available to COMAH operators on how compliance might be achieved.

For budgeting, this means two things. The test of your IT systems can be priced now from the table above. Any work that touches the plant network is priced after a scoping call with your engineers, once the safe test plan and change windows are known.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a system added after the quote, extra user roles, or a larger network than the one described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say who has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which systems are in scope: perimeter, web platforms, APIs, internal networks.
2. For each web platform, the number of user roles and whether it is shared with suppliers or customers.
3. For the perimeter, roughly how many internet-facing addresses and remote-access services you have.
4. For internal networks, the number of sites and whether corporate, laboratory and plant networks are separated.
5. Who asked for the test, and the exact wording: a customer review, an insurance form or your own COMAH cyber security work.
6. Any dates to avoid, such as shutdowns, batch runs or audits.

Chemicals organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document that triggered the request names an accreditation, say so when you ask for the quote.

How EJN Labs approaches pricing for chemical and process sites

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated chemicals and process industries service. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test from the IT side of the IT/OT boundary: supplier and vendor portals, laboratory platforms, plant-monitoring dashboards, APIs, the external perimeter and corporate and site networks. Live control systems and safety instrumented systems are left alone. Work that reaches towards OT or process-safety infrastructure only goes ahead against an agreed safe test plan, with your engineering team, defined change windows and a kill switch.

Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for a chemical site?

Typically £2,200 to £35,000 in the UK market. A perimeter-only test of 2 to 3 days is £2,200 to £4,200. One web platform at 5 days is £5,500 to £7,000. A multi-system site test of 14 to 25 days is £15,400 to £35,000. These ranges use UK day rates of £1,100 to £1,400.

Why is work near the plant network priced separately?

Because it needs a safe test plan agreed with your engineering team before the days can be counted. HSE guidance OG86 warns that many real-time control and safety systems may be taken offline by testing. The IT-side test can be priced straight away. Plant-side work is priced after a scoping call.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

How long does a penetration test take for a chemical site?

Between 2 and 25 testing days for the scopes in the table above. A perimeter test is typically 2 to 3 days, one web platform is 5 days, and a multi-system site test is 14 to 25 days. EJN Labs delivers the report on the last day of testing.

Can testing be scheduled around shutdowns and batch runs?

Yes. Tell the testing company about shutdowns, batch runs and audits when you ask for the quote. EJN Labs offers out of hours slots at no extra charge, and any work that reaches towards the plant network is tied to change windows agreed with your engineering team.

Get a fixed price for your site

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: COMAH and HSE OG86: Do UK Chemical Sites Need a Penetration Test?, Best Penetration Testing Companies for UK Chemicals and Process Industries, penetration testing for UK chemicals and process industries, penetration testing cost in the UK, web application penetration testing cost and network penetration testing cost.