Penetration Testing Cost for UK Care Providers and Care Software (2026)

A penetration test for a UK care provider or care software supplier typically costs £2,200 to £35,000 in the UK market. The low end is a short test of a provider’s internet-facing perimeter. The high end covers a care management platform, its mobile app, its API and the perimeter. The price is testing days multiplied by a day rate of £1,100 to £1,400.

What does a penetration test cost for a care provider?

Care providers and care software suppliers fall into five common scopes, typically costing between £2,200 to £35,000 in the UK market. A care home group or domiciliary agency mostly buys systems, so its test is usually the perimeter and office network. A supplier builds systems, so its test is the product. The table shows each scope.

Scope	What is tested	Days	Typical UK cost
Provider perimeter only	The internet-facing services of a care home group or domiciliary agency: remote access, email and web gateways, and any exposed rota or care-record logins	2 to 3 days	£2,200 to £4,200
Provider perimeter and office network	The perimeter plus the office and care-home network behind it, including the domain and shared devices that reach service-user records	3 to 6 days	£3,300 to £8,400
One care-plan or care management app	Care plans, risk assessments and daily notes, with boundaries between care worker, manager and family viewer, and emergency access overrides	8 to 12 days	£8,800 to £16,800
Care worker mobile app and its API	A home-visit app on handed-down tablets or phones: offline storage of service-user data, and the API it talks to	9 to 10 days	£9,900 to £14,000
Care software platform	A supplier’s care management web app, its mobile app, the API behind both, and the perimeter, with family and referral portals covered by the web scope	19 to 25 days	£20,900 to £35,000

These are market ranges, worked out from typical engagement lengths and UK day rates of £1,100 to £1,400. They are a guide for budgeting. The pricing page shows the engagement lengths for each type of test, and the quote form gives an exact fixed price for your scope.

What drives the price for a care home or domiciliary agency?

For a provider, the price is driven by how many sites and devices reach service-user records, not by software you built. The first rows of the table are the ones to start from. A provider that runs its own care-record or rota system, rather than a supplier’s, moves up to the application rows.

• Sites and addresses. The number of internet-facing addresses, care homes and offices sets the length of the infrastructure work.
• Shared and handed-down devices. Tablets and phones passed between care workers are a common route to service-user data, and the number of device types adds testing time.
• Rota and scheduling systems. Shift handover and scheduling tools used across sites and home visits are tested for staff permission boundaries and shift-note visibility.

What drives the price for a care software supplier?

For a supplier, the price follows the product: how many roles the platform has, how many apps and portals sit around it, and how many APIs connect to councils, the NHS and other care providers.

• Roles. Care worker, manager, family viewer and referral partner each see a different slice of a service user’s record. Relative-to-relative and service-user-to-service-user access are both tested.
• Family and referral portals. Next-of-kin portals and referral portals used by local authorities and the NHS add sharing links, document access and partner permissions.
• Mobile apps. A home-visit app adds offline data storage and the OWASP Mobile Top 10. See mobile application penetration testing.

Tester grade is not a pricing factor, and neither is the size of the testing company. Two quotes for the same scope should differ mainly in the number of days. If one quote is much lower, compare the day counts first.

Which rules shape the scope for social care?

Care providers with access to NHS patient data complete the Data Security and Protection Toolkit every year. The NHS describes the toolkit as an online self-assessment tool for organisations that have access to NHS patient data and systems. The current toolkit is aligned to the NCSC Cyber Assessment Framework, and its Guide 9, IT protection, is where the annual penetration test sits.

UK GDPR Article 32 applies to care records because they are special category data. Article 32(1)(d) calls for a process for regularly testing, assessing and evaluating the effectiveness of security measures. It does not name penetration testing as the method. Suppliers selling into the NHS and adult social care may also be asked for DTAC, which NHS England describes as an assessment framework for care commissioners and providers. DTAC is a buyer requirement, not law.

The DSPT penetration testing page covers the toolkit in detail, and the healthcare sector page covers clinical services.

What is included, and what costs extra?

A quote should cover scoping, testing, the report, a walkthrough of the findings and a retest. Ask every company you approach to confirm each of those in writing, because retests and out of hours work are the two items that most often appear later as extra charges.

With EJN Labs, the quote is a fixed price for a defined scope. It includes:

• Testing by UK-based, CREST-certified testers.
• Findings in a client portal as they are confirmed, each with a CVSS score.
• The report on the last day of testing, and a walkthrough call.
• Free retests until findings are resolved.
• Out of hours slots, with no out-of-hours, callout, cancellation or rescheduling fees.

What changes the price is a change of scope: a site, app or portal added after the quote, extra user roles, or an integration that was not described. If the scope grows, you get a new fixed price before any extra work starts.

How do you get a quote, and what will you be asked?

Say whether you run care services or build care software, and list the systems that hold service-user records. A testing company needs a few facts to count the days.

1. Whether you are a provider or a supplier, and your DSPT organisation type if you complete the toolkit.
2. Which systems are in scope: perimeter, care-plan or rota apps, portals, mobile apps, APIs and cloud accounts.
3. The roles each system has, such as care worker, manager, family viewer and referral partner.
4. How many sites, devices and internet-facing addresses are involved, and whether tablets are shared between staff.
5. Who asked for the test, such as a local authority, an NHS customer or your own DSPT work, and the exact wording.
6. Any dates to avoid, such as go-lives, inspections or busy rota periods.

Care providers and suppliers can use a CREST-accredited company or another provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document that triggered the request names an accreditation, say so when you ask for the quote.

How EJN Labs approaches pricing for social care

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated social care service for care homes, domiciliary care agencies and the software suppliers building platforms for the sector. We scope each system by what it does and who uses it, count the days, and give you one fixed price for the defined scope.

We test care-plan apps and care management platforms, family and referral portals, staff rota and scheduling systems, case management, care worker and family mobile apps, and service-user data in the cloud. The focus is service-user privacy, care record integrity, shared-device use, staff permission boundaries and emergency access overrides.

Testing is safe by default on production, with no denial of service. Retests are free until findings are resolved, so the price you agree covers the evidence that issues were fixed as well as the evidence that they were found.

Frequently Asked Questions

How much does a penetration test cost for a care home or care provider?

Typically £2,200 to £35,000 in the UK market across the five common scopes. A perimeter-only test of 2 to 3 days is £2,200 to £4,200. Adding the office network makes it 3 to 6 days at £3,300 to £8,400. A care software platform of 19 to 25 days is £20,900 to £35,000. These ranges use UK day rates of £1,100 to £1,400.

Does a domiciliary care agency need a penetration test?

It depends on who is asking. Care providers with access to NHS patient data complete the DSPT every year, and its IT protection standard, Guide 9, is where the annual test sits. Local authority or NHS customers may also ask for evidence. Check the exact wording of the request.

Why does a care software supplier pay more than a care home?

Because a supplier is testing a product and a provider is mostly testing its estate. A platform has several roles, apps and APIs sharing one record, each with boundaries to test. A care home group usually needs the perimeter and office network, which is 2 to 6 days.

Are family portals and mobile apps priced separately?

They are counted as separate testing days when they are separate systems. A family portal is usually covered within the web scope. A mobile app is a separate test of 5 days, and the API behind it adds 4 to 5 days. The table shows the combined totals.

Is a retest included in the price?

It depends on the company, so ask for it in writing. With EJN Labs, retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. The quote is a fixed price for a defined scope.

Get a fixed price for your care service or platform

Tell us whether you run care services or build care software, and which systems hold service-user records. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Cyber Essentials, Pen Testing and NHS Contracts: What Care Providers Need, Best Penetration Testing Companies for UK Social Care, penetration testing for UK social care providers and care software, DSPT penetration testing, patient portal penetration testing, penetration testing cost in the UK and mobile application penetration testing.