Penetration Testing for UK Social Care Providers & Care Software
CREST-accredited penetration testing for care homes, domiciliary care agencies and the software vendors building social care platforms. Evidence for the DSPT and UK GDPR Article 32, across care-plan apps, family portals, staff rota systems and referral portals. Service-user-data-strict.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
months is how long a penetration test stays current under the DSPT’s CAF-aligned Guide 9 (IT protection) standard, which keeps an annual test.
What the DSPT & UK GDPR Expect from Social Care Providers
Data Security and Protection Toolkit. Care providers with access to NHS patient data complete the DSPT every year. The current toolkit is aligned to the NCSC Cyber Assessment Framework, and its Guide 9 (IT protection) keeps an annual penetration test of web servers, vulnerability scans and critical network infrastructure. NHS DSPT.
UK GDPR Article 32. Health and care data is special category data. Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method, but a test is the most direct evidence that your controls work. UK GDPR Article 32.
What is different about care systems. Social care platforms hold service-user records, not just accounts: care plans, risk assessments and daily notes shared across a rota of staff and family members. We test service-user privacy, care record integrity, shared-device use on handed-down tablets, staff permission boundaries and emergency access overrides, alongside the standard OWASP scope.
Who we test for. Care homes, domiciliary care agencies, community and residential care providers, and the software vendors building care-plan apps, family portals, staff rota systems and referral portals for the sector. For app-specific scope see our patient portal and mobile application pages. For clinical services see our healthcare penetration testing page.
SCOPE
What We Test for UK Social Care Providers & Care Software
Care-Plan Apps & Care Management Platforms
Care-plan applications and care management platforms holding service-user records, risk assessments and daily notes. Service-user-to-service-user access (IDOR), record integrity, staff permission boundaries between care worker, manager and family viewer, and emergency access overrides for out-of-hours situations.
Family Portals & Referral Portals
Family and next-of-kin portals, plus referral portals used by local authorities, the NHS and other care providers. Relative-to-relative access boundaries, referral partner permissions, and document or report sharing links.
Staff Rota & Scheduling Systems
Staff rota, shift handover and scheduling systems used across sites and domiciliary visits. Staff permission boundaries, shift note visibility, and the audit trail behind rota changes.
Case Management & Social Care Casework
Case management systems for social care casework, investigations and complaints. Case assignment controls, sensitive-note access, attachment permissions, and bulk export restrictions.
Care Worker & Family Mobile Apps
Mobile apps used by domiciliary care workers on home visits and by family members checking in remotely. Shared-device use on handed-down tablets, offline data storage, and OWASP Mobile Top 10 coverage.
Service-User Data in the Cloud
AWS, Azure and GCP configuration behind care platforms. Encryption at rest, IAM scoping, audit logging and multi-tenant boundaries where one platform serves several care providers.
Phishing Defence for Care Staff
Targeted phishing simulation against care home admin, finance and management staff, using care-sector lures such as supplier invoice fraud and local authority impersonation.
Referral & Care-System Integrations
Referral APIs, GP and pharmacy integrations, and the interfaces between your platform and other care systems. Object-level authorisation, consent scope and the trust boundary at each integration.
OUR PROCESS
From Scope to Attestation in 4-6 Weeks
Scoping Call
30-minute technical scoping call. Define attack surface, methodology, rules of engagement, safe testing windows around care delivery hours, and timeline. Fixed-price quote within 24 hours.
Active Testing
3-15 days of hands-on testing by CREST-certified pen testers, against non-production environments with synthetic service-user data wherever possible. Daily status updates.
Reporting
Executive summary plus full technical report with CVSS scores, reproduction steps, screenshots, and specific remediation. 60-minute walkthrough call.
Free Retest
After remediation, we retest at no extra charge. Letter of attestation provided for DSPT submission, UK GDPR evidence, or buyer due diligence.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST social care pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Aligned to Every Framework
Findings map to specific control references in each framework, so your audit team submits the report directly without translation work.
NHS DSPT
Evidence for Guide 9 (IT protection) of the CAF-aligned toolkit, which keeps an annual test.
UK GDPR
Article 32(1)(d) evidence that you regularly test the effectiveness of your security measures over special category data.
ISO 27001
Annex A 8.8 technical vulnerability management, once you declare that control applicable.
Cyber Essentials Plus
A separate audit, not a penetration test. Care-sector commissioners commonly ask for it alongside test evidence. Certified directly by us as an IASME certification body.
NCSC CAF
Objective evidence for vulnerability management outcomes behind the DSPT. The CAF does not require a pen test; testing is one form of evidence.
Local Authority Commissioning
Local authority and ICS commissioners commonly ask for evidence of penetration testing in framework tenders and due diligence. Requirements vary by commissioner.
PRICING
Indicative Engagement Pricing
Fixed-price quotes confirmed during scoping. Free retest, executive summary, walkthrough call, and letter of attestation included.
Depends on service + scope
External / web / API / mobile single-target engagement. CREST-certified delivery. Around 3 to 5 working days from kickoff to report.
Get a fixed quoteDepends on service + scope
Multi-target combined engagement (web + API + external + AD), or single complex target. Typically 7-10 days.
Get a fixed quoteDepends on service + scope
Full-stack engagement (multiple cloud accounts, hybrid AD, complex web + API + mobile). Typically 12-15+ days.
Get a fixed quoteWHY EJN LABS
What You Get From Social Care Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What does a social care test look at that a standard web app test does not?
Service-user-to-service-user access (IDOR) across care plans and case notes, role separation between care worker, manager, family viewer and referral partner, shared-device risks on handed-down tablets, and emergency access overrides used out of hours.
Which social care organisations do you test for?
Care homes, domiciliary care agencies, community and residential care providers, and the software vendors building care-plan apps, case management systems, family portals and referral portals for the sector.
How do you handle service-user data during testing?
We ask for a non-production environment with synthetic or fully pseudonymised service-user data. Production testing only goes ahead with explicit written approval and a restricted scope, given health and care data is special category data under UK GDPR.
Can you support our DSPT submission?
Yes. Our reports can include an appendix mapping each finding to the relevant DSPT and CAF outcomes, so your submission shows what was tested, what was found and what was fixed. See our DSPT penetration testing page.
Can you test our care-plan or scheduling app alongside our DSPT evidence?
Yes. We scope the care-plan, case management or scheduling app your staff use alongside the DSPT evidence you need, so one engagement produces a CVSS-scored technical report and the Guide 9 attestation your submission requires.
Do you test the mobile app our care workers use on home visits?
Yes. We test the companion mobile app against the OWASP Mobile Top 10: device storage of service-user data, offline caching on shared or handed-down devices, and the API it talks to. See our mobile application penetration testing page.
What happens if testing finds a live exposure of service-user data?
We do not exfiltrate service-user data. If testing surfaces a live exposure, we stop, tell your nominated contact straight away and support your data protection lead, who decides whether a report to the ICO is needed within 72 hours under UK GDPR Article 33.
What’s in the report?
Executive summary (board-ready), technical report with CVSS 3.1 scores, reproduction steps, screenshots, specific remediation guidance, and a 60-minute walkthrough call. Letter of attestation issued after free retest.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK-based CREST-certified testers matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get my Social Care pen test scope
A CREST-certified pen tester will contact you within one business day with a fixed price aligned to your DSPT and UK GDPR needs.
