Penetration Testing Cost for UK Nuclear Supply Chain Vendors (2026)

A penetration test for a UK nuclear supply chain vendor typically costs £2,200 to £35,000 in the UK market. The low end is a short test of the internet-facing perimeter and remote access. The high end covers a multi-role collaboration platform, its prime contractor API, the perimeter and the internal network. The price is the number of testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a nuclear supply chain vendor?

Most engineering, construction, maintenance and technology suppliers to the civil nuclear sector fall into one of five scopes, typically costing between £2,200 and £35,000 in the UK market. What you pay depends on how many of your own systems are tested and how complex each one is, because that sets the number of testing days. The table shows the typical range for each scope.

Scope	What is tested	Days	Typical UK cost
Perimeter and remote access	VPN gateways, vendor remote-access services, exposed management interfaces and cloud consoles	2 to 3 days	£2,200 to £4,200
Maintenance or contractor portal	A single-role portal for scheduling site visits, uploading method statements and tracking permits to work	5 days	£5,500 to £7,000
Controlled document exchange	A multi-role platform for drawings and specifications, with contractor, subcontractor and licensee reviewer roles	8 to 12 days	£8,800 to £16,800
Collaboration platform plus prime contractor API	An engineering collaboration platform, and the API that connects it to a prime contractor’s procurement or asset-management system	12 to 17 days	£13,200 to £23,800
Supplier-wide test	A multi-role platform, a prime contractor API, the external perimeter and the internal network, tested from the IT side	16 to 25 days	£17,600 to £35,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price?

The number of testing days drives the price, and the scope drives the number of days. For a nuclear supply chain vendor, five things move the day count: how many platforms are in scope, how many third-party roles each one separates, how many customer integrations exist, how large the network is, and how access to the platforms is provisioned.

• Number of platforms. A collaboration platform, a maintenance portal and a controlled-document exchange are three separate tests, even when one team runs them.
• Third-party roles. A platform that separates contractor, subcontractor and site-licensee reviewer roles takes longer than a single-role tool, because each boundary between roles has to be tested, along with watermarking, download logging and link expiry.
• Customer integrations. Interfaces to a prime contractor’s procurement, logistics or asset-management systems are tested as APIs in their own right. See API penetration testing cost.
• Network size. The number of internet-facing addresses, sites and Active Directory domains sets the length of the infrastructure work.
• Account provisioning. Third-party accounts that are created, expired and revoked add test cases, such as confirming a revoked permit cannot still authorise access.

Tester grade is not a pricing factor, and neither is the size of the testing company or of your own. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

How do licensee security expectations affect the price?

They shape the scope more than the day rate. The Office for Nuclear Regulation assesses licensees’ security plans against its Security Assessment Principles, which it describes as the foundation for outcome focussed regulation. The principles do not name a penetration test.

For suppliers, the relevant text is on supply chain management. The principles say dutyholders should evaluate and confirm that suppliers have the organisational and technical capability, capacity and culture to deliver items or services to the specification before placing any contract (SyDP 4.2 in the principles). In our experience, a licensee or prime contractor turns that into a supplier questionnaire or a contract clause, and a penetration test report on the supplier’s own systems is one of the documents that can answer it.

Regulation 4 of the Nuclear Industries Security Regulations 2003 sets out the approved security plan for each nuclear premises. It is the licensee’s plan, so your own scope comes from the customer’s wording, not from the regulation. Nuclear supply chain organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. The NCSC describes CHECK as the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a platform added after the quote, extra user roles, or a larger network than the one described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Send the list of systems you want tested and say which customer has asked for the evidence. A testing company needs a few facts about each system to count the days. Having them ready is the fastest way to a firm price, and it makes quotes from different companies comparable.

1. Which of your systems are in scope: collaboration platforms, maintenance portals, document exchange, APIs, remote access, internal network.
2. For each web platform, the number of user roles and which third parties use it.
3. For each customer integration, roughly how many endpoints, and whether an API specification is available.
4. For the perimeter, roughly how many internet-facing addresses and remote access services you have.
5. For the internal network, the number of sites and Active Directory domains.
6. Which licensee or prime contractor asked for the test, and the exact wording of the clause or questionnaire.
7. Any dates to avoid, such as outages, project milestones or customer audits.

How EJN Labs approaches pricing for the nuclear supply chain

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated nuclear supply chain service for civil nuclear engineering, construction, maintenance and specialist technology suppliers. We scope each of your systems by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test the supplier’s own systems: engineering collaboration platforms, maintenance and contractor portals, controlled document exchange, supplier and prime integrations, vendor remote access and the external perimeter, from the IT side of any boundary with operational or site-security systems. Live nuclear safety, control and site-security systems are out of scope. Any work that reaches towards them only goes ahead against an agreed safe test plan, with your engineering team, defined change windows and a kill switch.

Frequently Asked Questions

How much does a penetration test cost for a nuclear supply chain vendor?

Typically £2,200 to £35,000 in the UK market. A perimeter and remote access test of 2 to 3 days is £2,200 to £4,200. A controlled document exchange at 8 to 12 days is £8,800 to £16,800. A supplier-wide test of 16 to 25 days is £17,600 to £35,000. These ranges use UK day rates of £1,100 to £1,400.

Does the ONR require suppliers to have a penetration test?

The ONR’s Security Assessment Principles do not name a penetration test. They are written for licensees and other dutyholders, and they say dutyholders should evaluate and confirm supplier capability before placing a contract. What a supplier is asked for comes from the licensee or prime contractor, so read their wording.

Do you test nuclear safety or control systems?

No. Live nuclear safety, control and site-security systems are out of scope. The test covers your own systems, from the IT side of the boundary. Any work towards operational systems goes ahead only against an agreed safe test plan with your engineering team, defined change windows and a kill switch.

Does the testing company need to be CREST-accredited or a CHECK provider?

Nuclear supply chain organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Use the accreditation named in the licensee’s contract clause or supplier questionnaire, and ask the customer to confirm it if the wording is unclear.

Is a retest included in the price?

With EJN Labs, yes. Retests are free until findings are resolved, so the report you send to a customer can show which findings are closed. Ask every other company to state in writing whether a retest is included, because it is one of the items most often charged separately.

Get a quote for your systems

Tell us which systems are in scope and which customer has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Nuclear Supply Chain Vendors: The ONR CSIA Questions to Prepare For, Best Penetration Testing Companies for the UK Nuclear Supply Chain, penetration testing for the UK nuclear supply chain, penetration testing for energy and renewables, the NCSC Cyber Assessment Framework and penetration testing and penetration testing cost in the UK.