Penetration Testing Cost for UK Councils and Public Bodies (2026)

A penetration test for a UK council or public body typically costs £2,200 to £47,600 in the UK market. The low end is a short test of the internet-facing perimeter. The high end is a council-wide test covering casework systems, APIs and the internal network. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a public sector organisation?

Most councils, arm’s-length bodies and government suppliers fall into one of five scopes, typically costing between £2,200 and £47,600 in the UK market. What you pay depends on how many systems are tested and how complex each one is, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Perimeter only	Internet-facing services, VPN and remote access, exposed management interfaces and cloud consoles	2 to 3 days	£2,200 to £4,200
One citizen portal	A single citizen-facing service with one user role, such as a licensing or planning portal	5 days	£5,500 to £7,000
Portal plus its API	The portal above, and the API behind it that connects to other bodies or identity providers	9 to 10 days	£9,900 to £14,000
Casework system plus internal network	A multi-role casework system, and the internal network and Active Directory behind it	9 to 15 days	£9,900 to £21,000
Council-wide test	A multi-role casework system, cross-government APIs, the external perimeter and the internal network	20 to 34 days	£22,000 to £47,600

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. On a public body’s estate, five things move the day count: how many services are in scope, how many user roles each one has, how many APIs connect to other bodies, how large the network is, and how the work has to be fitted around service hours.

• Number of services. A planning portal, a licensing portal and a benefits portal are three separate tests, even when one supplier built all three.
• User roles. A casework system with citizen, caseworker, manager and administrator roles takes longer than a single-role portal, because each boundary between roles has to be tested.
• APIs and integrations. Interfaces to other departments, identity providers and supplier systems add time when they are tested in their own right. See API penetration testing cost.
• Network size. The number of internet-facing addresses, sites and Active Directory domains sets the length of the infrastructure work.
• Service hours. A service that has to stay up during office hours may need testing in agreed windows. Out of hours slots are available.

Tester grade is not a pricing factor, and neither is the size of the testing company or of the public body. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

How does the tender wording affect the quote?

The accreditation named in the tender decides who can quote. The NCSC describes CHECK as the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks. Public sector organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited.

The Government Commercial Agency’s Cyber Security Services 3 agreement lists penetration testing among the services public buyers can shortlist suppliers for, and its template statement of requirements prompts a buyer to state the scope, test types and price format. The days in your tender specification are what a supplier prices, so a precise scope is the best way to get comparable bids. The comparison of CREST and CHECK covers the difference between the two.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a service added after the quote, extra user roles, or a larger network than the one described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and the wording of the tender or contract clause behind it. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to a firm price, and it makes bids from different companies comparable.

1. Which systems are in scope: portals, casework systems, APIs, cloud, internal networks.
2. For each web service, the number of user roles and whether citizens, staff or partner bodies use it.
3. For each API, roughly how many endpoints, and whether a specification such as OpenAPI is available.
4. For the perimeter, roughly how many internet-facing addresses and remote access services you have.
5. For internal networks, the number of sites and Active Directory domains.
6. The accreditation, reporting format and report date the tender asks for, in the buyer’s words.
7. Any dates to avoid, such as elections, peak service periods or audits.

How EJN Labs approaches pricing for public sector bodies

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated public sector service. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test citizen service portals, casework and case management systems, cross-government APIs, internal networks and Active Directory, cloud configuration, and staff phishing resilience. Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for a council?

Typically £2,200 to £47,600 in the UK market. A perimeter-only test of 2 to 3 days is £2,200 to £4,200. One citizen portal at 5 days is £5,500 to £7,000. A council-wide test of 20 to 34 days is £22,000 to £47,600. These ranges use UK day rates of £1,100 to £1,400.

Why do two quotes for the same tender differ so much?

Almost always because of the day count. The scope in the tender may leave room for interpretation, such as how many user roles are tested or whether the internal network is included. Ask each bidder for the days behind the price and compare those before comparing totals.

Does a CHECK requirement change the price?

It changes who can quote, not the way days are counted. Public sector organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Use the accreditation the tender names and compare day counts between bidders.

Is a retest included in the price?

With EJN Labs, yes. Retests are free until findings are resolved, so the report you hand to the buyer can show which findings are closed. Ask every other bidder to state in writing whether a retest is included, because it is one of the items most often charged separately.

Can a test run during office hours without disrupting a live service?

Yes. Testing is safe by default on production, with no denial of service, and out of hours slots are available if you prefer to test when demand is lowest. There are no out-of-hours, callout, cancellation or rescheduling fees. Tell us about service peaks when you ask for a quote.

Get a quote for your tender

Tell us which systems are in scope and what the tender says about accreditation. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Council and Public Body Tenders: What a Penetration Test Requirement Asks For, Best Penetration Testing Companies for the UK Public Sector and Government Suppliers, penetration testing for UK public sector and government suppliers, penetration testing cost in the UK, web application penetration testing cost and network penetration testing cost.