Penetration Testing Cost for UK Estate and Letting Agents (2026)

A penetration test for a UK estate or letting agency typically costs £3,300 to £35,000 in the UK market. The low end is a test of the agency’s internet-facing services and office network. The high end is a multi-branch estate covering a portal, the perimeter and internal networks. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for an estate or letting agency?

Most estate agencies, letting agents and property management firms fall into one of five scopes, typically costing between £3,300 and £35,000 in the UK market. What you pay depends on how many systems are tested and how many kinds of login each one has, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Agency perimeter and office network	Internet-facing services, remote access and email, plus a single-site office network with one Active Directory domain	3 to 6 days	£3,300 to £8,400
Tenant and landlord portal	One portal with tenant, landlord, agent and contractor roles, including the boundaries between them and the shared document store	8 to 12 days	£8,800 to £16,800
Agent and tenant mobile app	A viewing-booking or tenant app on iOS and Android, plus the API behind it	9 to 10 days	£9,900 to £14,000
Portal with rent payments and the perimeter	The portal above, the rent, deposit and fee payment API, and the internet-facing services around them	15 to 22 days	£16,500 to £30,800
Multi-branch group estate	A multi-role platform, the larger perimeter, and internal networks across branches, including separation between branches	14 to 25 days	£15,400 to £35,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. For a property business, five things move the day count more than anything else: the kinds of user, the number of branches, the payment flows, the mobile apps and the size of the network.

• Kinds of login. A portal with tenant, landlord, agent and contractor roles takes longer than a single-role tool, because every boundary between roles has to be tested, such as one tenant reaching another tenant’s agreement.
• Branches and managed portfolios. Property management software shared by several branches or landlords adds work, because the separation between them is tested in its own right.
• Payment flows. Rent, deposit and holding-fee collection means testing the payment API, and whether a changed payee or bank detail is flagged before funds move. See API penetration testing.
• Mobile apps. A viewing-booking or tenant app is tested on iOS and Android, along with what identity and referencing data it keeps on the device.
• Network size. The number of internet-facing addresses, office sites and Active Directory domains sets the length of the infrastructure work.

Tester grade is not a pricing factor, and neither is the size of the testing company or the agency. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a system added after the quote, extra user roles, or more branches than the ones described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say who has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which systems are in scope: perimeter, portals, property management software, payment APIs, mobile apps, cloud accounts, office networks.
2. For each portal, which roles exist (tenant, landlord, applicant, agent, contractor) and whether landlords or branches must be kept apart.
3. For payments, whether you take rent, deposits or holding fees online and which provider handles the card data.
4. For the perimeter, roughly how many internet-facing addresses and remote-access services you have.
5. For internal networks, the number of branch offices and Active Directory domains.
6. Who asked for the test, and the exact wording: an insurance form, a landlord or investor questionnaire, or your own data protection review.
7. Any dates to avoid, such as a renewal deadline, month-end rent runs or a branch opening.

Where does the request usually come from?

For an estate or letting agency it is usually a cyber insurance form. No law names a penetration test for property firms. One published cyber proposal form asks whether you conduct penetration tests of your network at least annually. Requirements vary by insurer and policy, so read your own form. Our guide to cyber insurance renewals that ask for penetration testing goes through the detail.

How EJN Labs approaches pricing for property businesses

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated property and proptech service. We scope each system by what it does and who logs in to it, count the days, and give you one fixed price for the defined scope.

We test tenant and landlord portals, listing and applicant systems, mortgage application portals, property management software, rent, deposit and fee payment flows, agent and tenant mobile apps and the cloud platforms behind them. Where possible we test against staging with synthetic tenant, landlord and payment data.

Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for an estate agency?

Typically £3,300 to £35,000 in the UK market. A perimeter and office network test of 3 to 6 days is £3,300 to £8,400. A tenant and landlord portal of 8 to 12 days is £8,800 to £16,800. A multi-branch group estate of 14 to 25 days is £15,400 to £35,000. These ranges use UK day rates of £1,100 to £1,400.

Why does a tenant and landlord portal cost more than a single-role tool?

Because every boundary between roles has to be tested. A portal with tenant, landlord, agent and contractor logins needs checks that one tenant cannot open another’s agreement and one landlord cannot see another’s statements. Those checks add days, which is why the portal row is 8 to 12 days.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

How long does a penetration test take for an estate agency?

Between 3 and 25 testing days for the scopes in the table above. A perimeter and office network test is typically 3 to 6 days, a mobile app with its API is 9 to 10 days, and a multi-branch group estate is 14 to 25 days. EJN Labs delivers the report on the last day of testing.

Can testing be scheduled around month-end rent runs?

Yes. Tell the testing company about rent runs, completions and renewal deadlines when you ask for the quote. EJN Labs offers out of hours slots at no extra charge, and testing is safe by default on production, with no denial of service.

Get a fixed price for your agency

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Estate Agent Cyber Insurance Renewal: Do You Need a Penetration Test?, Best Penetration Testing Companies for UK Property and Proptech, penetration testing for UK property and proptech, penetration testing cost in the UK, web application penetration testing cost and network penetration testing cost.