A one-off manual penetration test of a public-facing web application in the UK typically costs between £3,000 and £10,000 before VAT, depending on scope. Network, cloud, API and mobile tests, and larger or more complex applications, can cost more. Red team engagements cost the most. This guide shows typical UK price ranges by test type, what drives the price, and what a good quote should include.
Based in the US? See the US penetration testing cost guide, with prices in US dollars.
See Rootshell pricing for the full levels and what is included.
Last reviewed 9 November 2026. All prices are indicative, shown before VAT, and are not quotes.
Typical UK penetration testing prices in 2026
| Type of test | Typical UK range (before VAT) | What mostly sets the price |
|---|---|---|
| Web application, one public-facing application | £3,000 to £10,000 | Number of pages and user roles, authenticated or not, APIs |
| Larger or complex web application | £6,000 to £18,000 or more | Multiple roles, integrations, payments, single sign-on |
| External network or infrastructure | £3,000 to £7,000 | Number of IP addresses and services exposed |
| Cloud, API or mobile application | £3,500 to £25,000 | Size of the environment, endpoints, platforms covered |
| Red team engagement | £20,000 to £50,000 or more | Length, team size, objectives, social engineering |
| Continuous testing (Rootshell Core) | From £3,000 plus VAT a year | One public-facing web application, authenticated manual assessment, then a year of automated continuous testing |
These ranges are a summary of what UK providers publish and what Rootshell sees in the market. For comparison, traditional providers commonly charge £1,000 to £1,600 a day for manual testing, depending on the provider, the tester’s skill and the type of test.
What drives the cost of a penetration test
- Scope. The number of applications, IP addresses, user roles and APIs is the biggest factor.
- Depth. A test with testers logged in as a user (authenticated) takes longer than an outside-in test, and finds more.
- Complexity. Payments, integrations and custom business logic add testing time.
- Tester skill and accreditation. CREST registered and similarly accredited testers cost more than unaccredited freelancers, and many enterprise buyers ask for them.
- Retesting. Some providers include a retest, some limit it and some charge extra.
- Timing and reporting. Rush work and extra reporting for audits can add cost.
What a good quote should include, and what to watch for
- A written scope: what is in, what is out, and how many days are allocated.
- Who will do the work and what accreditations they hold.
- Whether testing is authenticated.
- What you receive at the end, and how: a PDF, a static portal or a live platform.
- Whether retests are included, and how many.
Watch for these gotchas
- A low day rate. A cheap day rate says little about quality. Ask what level of tester you are getting: their experience, accreditations and how much of the work they do themselves.
- The days creeping up. A low day rate can be offset by more days across the contract term. Ask for the total number of days and the total price, not just the rate.
- Charges for retesting. Confirming a fix is often charged by the day or limited to one round. Ask whether retests are free, how many are included, and whether they are remote.
- Scoping and reporting extras. Scoping calls, extra reporting for audits, out-of-hours work and changes to scope can all be added later. Ask what is not included.
Rootshell Core avoids this by being one fixed annual price for the application: the authenticated manual assessment, validated by our testers, 12 months of automated continuous testing, free remote retests, exploit intelligence for the whole contract term and the Rootshell Platform.
How is penetration testing priced now: day rate or fixed price?
Day rates are how traditional, one-off testing is usually priced: a number of days multiplied by a daily rate, with extras for retests and reporting. That works for providers selling testers’ time. It is less suited to continuous testing and PTaaS, where the service is more than testers’ time.
Rootshell prices Core as a fixed annual price scoped to your application, not by the day. The service uses AI to widen and speed up testing and includes an exposure management platform. Rootshell passes those efficiencies on to clients in the price.
- Free remote retests. Retests of issues found in Rootshell testing are free and done remotely, so confirming a fix does not add to the bill.
- Exploit intelligence for the whole contract term. Over the contract term, typically 12 months, every issue in the platform is checked against new and active exploits. The data is enriched as the threat changes, so issues are reprioritised and you fix what matters most first.
Whichever provider you compare, ask what the price includes and what you receive at the end, not only how many days are behind it.
One-off test or continuous testing?
A one-off test is accurate on the day it ends. New code and new exposure can appear the week after. Continuous penetration testing adds testing through the year. Rootshell Core starts from £3,000 plus VAT a year for one public-facing web application: an authenticated manual assessment, validated by our testers, followed by 12 months of automated, unauthenticated continuous testing on the Rootshell Platform, run daily, weekly or monthly. See Rootshell pricing, or read about web application penetration testing and penetration testing as a service.
Penetration testing cost: common questions
How much does a penetration test cost in the UK?
For a single public-facing web application, a one-off manual penetration test typically costs between £3,000 and £10,000 before VAT, depending on scope. Larger or more complex applications, cloud, API and mobile testing can cost considerably more, and red team engagements run higher still.
Why do penetration test prices vary so much?
Price follows scope and effort: the number of applications, IP addresses or user roles, how complex the environment is, whether testers are authenticated, how senior the testers are and whether retesting is included. A quote that does not explain the scope and the number of days is hard to compare.
Is a penetration test cheaper than a vulnerability scan?
A vulnerability scan costs less, but it does not replace a penetration test. A scan finds known weaknesses automatically. A penetration test adds human testers who confirm what is exploitable and explain the risk in your context.
Does the price include retesting?
It depends on the provider. Some include a retest, some limit it and some charge extra, so ask before you compare quotes. Rootshell includes free remote retests for issues found in Rootshell testing.
How much does continuous penetration testing cost?
Rootshell Core starts from £3,000 plus VAT a year for one public-facing web application. That covers an authenticated manual assessment validated by our testers, followed by 12 months of automated, unauthenticated continuous testing (daily, weekly or monthly), with exploit intelligence throughout the contract term, typically 12 months, so issues are reprioritised as the threat changes, and free remote retests.
Want a price for your own application? See pricing or book a scoping call. Prices exclude VAT.
