Penetration Testing Cost for UK Insurers, Brokers and MGAs (2026)

A penetration test for a UK insurer, broker or MGA typically costs £4,400 to £47,600 in the UK market. The low end is a single broker API. The high end is a claims and policy estate covering web platforms, APIs, the perimeter and internal networks. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for an insurance business?

Most insurance businesses fall into one of four scopes, typically costing between £4,400 and £47,600 in the UK market. The price depends on how many systems are tested and how many parties use each one, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Broker API integration	One broker, aggregator or reinsurance API: authentication, object-level access, rate and premium manipulation	4 to 5 days	£4,400 to £7,000
Broker or MGA portal	A portal with insurer, broker and customer data, plus the internet-facing services around it	7 to 8 days	£7,700 to £11,200
Quote-and-buy platform	A multi-role quote engine and buy flow with payment integration, its APIs and the perimeter	17 to 26 days	£18,700 to £36,400
Claims and policy estate	Claims and underwriting platforms, broker and reinsurance APIs, the perimeter and the internal network between underwriting, claims and finance	20 to 34 days	£22,000 to £47,600

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. In insurance the day count is moved by who can log in, which integrations exist, and how much of the estate sits behind a single login. Four things matter most.

• Parties on the platform. A portal used by insurer staff, brokers and policyholders has at least three roles, and each boundary has to be tested: one broker seeing another broker’s book, or a claimant seeing an adjuster’s notes.
• Integrations. Broker portals, MGA and aggregator connections, reinsurance data feeds and payment providers are APIs in their own right. See API penetration testing.
• Business logic. Rating inputs, delegated authority limits, quote expiry and claim amounts need tests written for your product rules, not just standard checks.
• Network and cloud. The number of internet-facing addresses, sites and Active Directory domains sets the length of the infrastructure work.

Tester grade is not a pricing factor, and neither is the size of the testing company. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a system added after the quote, a further broker or reinsurer integration, or a larger network than the one described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say who has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to get a firm price, and it makes quotes from different companies comparable.

1. Which systems are in scope: quote and buy, claims, underwriting, broker and reinsurance APIs, internal networks, cloud accounts.
2. For each web platform, the user roles and whether brokers, MGAs or policyholders log in.
3. For each API, roughly how many endpoints, and whether a specification is available.
4. For the perimeter and internal networks, the number of internet-facing addresses, sites and Active Directory domains.
5. Where claims data lives, and whether testing will be on a non-production copy or on production with restricted scope.
6. Who asked for the test, and the exact wording: a regulator-facing file, a managing agent, a client questionnaire or an insurance form.

Insurance organisations can use a CREST-accredited company or a CBEST provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document that triggered the request names an accreditation, say so when you ask for the quote.

Does an FCA, PRA or Lloyd’s rule set the price or the scope?

No. None of them names a penetration test, so the scope is yours to set. SYSC 15A says a firm must carry out scenario testing to assess its ability to remain within its impact tolerance. Lloyd’s Minimum Standard MS11 names technical penetration testing as an example of appropriate security testing for new systems. In practice, the systems behind your important business services are the sensible first scope.

How EJN Labs approaches pricing for insurance businesses

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated insurance penetration testing service. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test policy quote and buy flows, claims platforms, underwriting and policyholder apps, broker and reinsurance APIs, internal networks and cloud environments, with extra attention on the boundaries between insurer, broker and policyholder. Claims data is handled with care: testing runs on non-production environments with synthetic data, or on production with explicit approval from your data protection officer and a restricted scope.

Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for an insurance business?

Typically £4,400 to £47,600 in the UK market. A single broker API of 4 to 5 days is £4,400 to £7,000. A broker or MGA portal at 7 to 8 days is £7,700 to £11,200. A claims and policy estate of 20 to 34 days is £22,000 to £47,600. These ranges use UK day rates of £1,100 to £1,400.

Why does a broker portal cost more than a single API?

Because a portal has several user roles and a web interface as well as the API behind it. Each boundary between insurer staff, brokers and customers is tested separately, and the services around the portal are tested too. That is typically 7 to 8 days against 4 to 5 for one API.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

Can claims data stay out of the test?

Yes. EJN Labs tests claims systems on non-production environments with synthetic claims data, or on production with explicit approval from your data protection officer and a restricted scope. Tell the testing company which option you want when you ask for the quote, because it affects the plan.

How long does a penetration test take for an insurance business?

Between 4 and 34 testing days for the scopes in the table above. One broker API is typically 4 to 5 days, a broker or MGA portal is 7 to 8 days, and a claims and policy estate is 20 to 34 days. EJN Labs delivers the report on the last day of testing.

Get a fixed price for your insurance systems

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: FCA, PRA and Lloyd’s: Do Insurers Need a Penetration Test?, Best Penetration Testing Companies for UK Insurance Firms, penetration testing for UK insurance firms, penetration testing cost in the UK, API penetration testing and penetration testing under FCA operational resilience.