How to Choose a Penetration Testing Company: UK Buyer's Guide
Choosing a penetration testing company comes down to who does the testing, how the work is scoped and what you receive afterwards. This guide covers the checks that matter for UK SMEs and mid-market organisations.
Key Takeaways
- Check the testers, not just the company. Qualified, experienced individuals do the work, so ask who will be on your engagement.
- CREST membership is a useful quality signal. CHECK is the NCSC scheme for public sector and critical national infrastructure work, and is not required for private firms.
- Scoping decides the value. Agree targets, test type, timing and reporting format in writing before any work starts.
- A pen test is not a vulnerability scan. A scan lists known weaknesses automatically; a pen test attempts to exploit them with human judgement.
- Insist on retesting. A report only helps if you can show the findings were fixed.
To choose a penetration testing company, check who will actually carry out the work and what accreditation they hold. Then confirm that the scope, test type, reporting and retesting are agreed in writing, and that the company can explain its findings in plain English. Price matters, but a cheap test that misses your real exposure costs more in the end.
A penetration test is an authorised attempt to break into your systems using the tools and techniques an attacker would use. It gives you evidence of how your defences hold up on the day of the test. Buyers often struggle because the market is crowded and proposals look similar on paper.
The advice here draws on NCSC and CREST material, as at October 2026, and applies to organisations of every size. This guide sets out how to compare providers properly. It covers accreditations, the main test types, scoping, reports, retesting, the questions to ask and the red flags to watch for.
What a penetration test is and is not
The NCSC describes penetration testing as a way of gaining assurance in a system's security by trying to breach it. It stresses that a test only shows you are not vulnerable to known issues on the day it runs, and that it works best as a check on your own vulnerability management rather than as the main way of finding weaknesses. NCSC penetration testing guidance is worth reading before you speak to any provider.
That framing helps when you buy. You are not paying for a certificate of safety. You are paying for skilled people to test whether the weaknesses you already know about, and some you do not, can actually be exploited.
↑ Back to ContentsPenetration test vs vulnerability scan
The two are often confused, and some providers blur them in their sales material. Knowing the difference stops you paying penetration test prices for a scan.
| Point | Vulnerability scan | Penetration test |
|---|---|---|
| Method | Automated tool checks for known weaknesses | Skilled tester attempts to exploit weaknesses and chain them together |
| Output | List of potential issues, often with false positives | Verified findings with evidence and risk ratings |
| Frequency | Regular, often monthly or continuous | Periodic, such as annually or after major change |
| Human judgement | Minimal | Central to the work |
You need both. Scanning keeps routine exposure under control between tests. A pen test checks how far an attacker could get. If you are still building your baseline, a cyber security audit is often the better first step, because it shows what a test should concentrate on.
↑ Back to ContentsCREST, CHECK and other accreditations
Accreditation is the quickest filter, but it should not be the only one.
- CREST: an international accreditation body. CREST states that its member companies go through audit and accreditation, sign a code of conduct and agree to its complaints process, and it offers individual certifications for testers. Members are listed on the CREST marketplace. CREST runs separate schemes covering penetration testing, intelligence-led testing and application testing.
- CHECK: the NCSC scheme under which assessed companies test public sector and critical national infrastructure systems. The NCSC says non-public sector organisations do not need to use a CHECK provider. If you supply central government or handle OFFICIAL data for them, ask whether CHECK applies. NCSC CHECK information explains the requirements for buyers.
- Individual qualifications: the NCSC notes that CHECK team leaders and members must hold UK Cyber Security Council titles in security testing, as at October 2026. Ask what qualifications your named testers hold, whichever scheme the company belongs to.
Cyber Essentials is a different thing. It is a baseline certification for your own controls, not a testing accreditation. Our Cyber Essentials certification guide explains where it fits, and our Cyber Essentials service helps you prepare for it. Many smaller organisations get more value from fixing the basics first than from buying a test early.
↑ Back to ContentsBlack, grey and white box testing
These terms describe how much the tester knows before starting. A good provider will recommend one based on your goals instead of defaulting to the cheapest.
- Black box: the tester has no prior knowledge, like an outside attacker. It suits testing your external exposure but can spend much of the budget on discovery.
- Grey box: the tester has limited information, such as a standard user account. It is a common choice for web applications and internal networks because time goes on testing, not guessing.
- White box: the tester has full access to architecture, configuration or source code. It gives the deepest coverage and suits critical or custom-built applications.
The test target matters as much as the method. Common types include external infrastructure, internal network, web application, wireless, cloud configuration and social engineering. Be wary of a one-size-fits-all package that does not ask what you are trying to protect. If your estate is mostly Microsoft 365 and cloud services, say so, because a test of cloud configuration and identity controls will usually tell you more than a test of an office firewall.
↑ Back to ContentsScoping: where most tests succeed or fail
The NCSC advises involving risk owners, technical staff who know the system and a representative of the test team when scoping. The result should be a plan covering the following:
- Technical boundaries and the types of test
- Timeframe and effort, usually in resource days
- Scenarios or use cases, where relevant
- What the testers need, such as test accounts
- Compliance requirements, such as a customer or insurer request
- Reporting requirements, including how severity is rated
- Special conditions, such as out-of-hours testing for fragile systems
Agree who to contact if something breaks during testing. Testers aim to avoid disruption, but the NCSC is clear that unexpected reactions cannot be ruled out, so keep a technical contact available at short notice.
Share your existing vulnerability assessment or audit results. The NCSC recommends this so testers can check how accurate and complete your own picture is.
↑ Back to ContentsReporting and retesting
The report is the product you are buying. Ask for a sample, redacted if necessary, before you sign.
The NCSC says a good report includes the security issues found, a risk assessment for each, a method of resolution and an opinion on your vulnerability assessment process. Findings are rated high, medium, low or informational in CHECK reports, and CVSS scores may be added. Look for:
- An executive summary a non-technical director can act on
- Technical detail with evidence and steps to reproduce
- Clear, prioritised remediation advice
- A debrief call to walk through the findings
Retesting deserves its own line in the quote, and it should be priced separately if it is not included. After you fix the issues, the provider should verify the fixes and update the report. Ask whether retesting is included, how long it stays available and what it costs afterwards. Without it, you cannot show a customer, auditor or insurer that the problems were closed.
The NCSC also cautions against accepting a proposed fix without thought. Your own team remains responsible for risk decisions, and alternatives such as removing the software or adding controls may suit better.
↑ Back to ContentsHow to choose a penetration testing company: questions to ask
- Which accreditations does the company hold, and which qualifications do the named testers have?
- Will the people who present the proposal be the people who do the testing?
- How will you scope and price the test, and what happens if the scope changes?
- Which methodology do you follow, and how do you rate severity?
- Can I see a sample report?
- Is retesting included, and for how long?
- How do you protect our data, and how is it stored and deleted afterwards?
- What insurance do you carry, including professional indemnity?
- Can you test our specific technology, including cloud services and any unusual systems?
If you outsource IT, involve your provider early. A managed partner can share asset lists, patch status and architecture diagrams, which reduces testing time. Our managed IT support team regularly supports clients through test preparation and remediation. If you are weighing up suppliers more broadly, our guide to choosing an IT support company applies the same discipline.
↑ Back to ContentsRed flags to watch for
Walk away or push back if you see these
No named testers or qualifications, a fixed price offered before any scoping conversation, or a sample report that looks like a raw scanner export.
- A guarantee that you will be "secure" or "hack-proof" after the test
- Reluctance to provide a sample report or references from comparable organisations
- No written rules of engagement or authorisation letter
- Pressure to sign quickly with a discount that expires
- No retesting option, or retesting at an unspecified extra cost
- Subcontracting the work to unnamed third parties without telling you
- Vague answers about how your data and findings are stored
Also be sceptical of providers who sell fear in the first conversation. A sound proposal starts from your business, your data and your regulatory obligations.
Finally, think about what happens after the report arrives. Findings are only useful if someone owns the fixes. Detection tooling such as managed EDR can help close gaps that testers highlight on endpoints, and our cyber security for small business page outlines practical first steps for smaller teams.
↑ Back to ContentsConclusion: choosing a penetration testing company with confidence
How to choose a penetration testing company comes down to this: compare the testers' qualifications, test the provider's scoping questions, read a sample report and confirm retesting before you commit. Accreditation such as CREST is a helpful signal, and CHECK matters if you work with the public sector or critical national infrastructure. The scope and the quality of the report matter more than any logo.
If you want help deciding what to test, preparing your environment or acting on findings, talk to NetMonkeys.
↑ Back to ContentsFrequently Asked Questions (FAQs)
How do I choose a penetration testing company?
Start with accreditation and the qualifications of the named testers, then compare how each provider scopes the work. Ask for a sample report, confirm retesting is included, and check insurance and data handling. Choose the provider that asks the most useful questions about your business, not the one with the lowest day rate.
Do I need a CREST or CHECK penetration tester?
The NCSC states that non-public sector organisations do not need a CHECK provider. CHECK applies to public sector and critical national infrastructure work. CREST membership is not a legal requirement for private firms, but it is a recognised quality signal, and some customers or insurers may ask for it.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan uses automated tools to list known weaknesses, often with false positives. A penetration test uses skilled people to attempt to exploit weaknesses, chain them together and show real impact. Scans suit regular checking between tests; penetration tests suit periodic, deeper assurance, and most organisations benefit from doing both.
What is the difference between black, grey and white box testing?
Black box testers start with no knowledge, like an outside attacker. Grey box testers have limited access, such as a standard user account. White box testers have full information, including architecture or code. Grey box is common for applications because it uses the time on testing rather than discovery, while white box suits your most critical systems.
How often should a business have a penetration test?
Many organisations test annually and after significant change, such as a new application, a cloud migration or a network redesign. The right frequency depends on risk, customer or insurer requirements and how quickly your environment changes. Regular vulnerability scanning fills the gaps between tests, and you should ask your provider how often they recommend retesting for your circumstances.
What should a penetration test report include?
The NCSC says it should cover the issues found, a risk assessment for each, how to resolve them, and an opinion on your vulnerability assessment. Expect an executive summary, evidence, prioritised remediation advice and a debrief. Retesting should then confirm the fixes were applied and worked, so you hold evidence for customers, insurers and auditors.
Does a penetration test make us secure?
No. The NCSC notes a test shows you are not vulnerable to known issues on the day it runs. New weaknesses appear afterwards. Treat it as one part of an ongoing programme that includes patching, scanning, monitoring and staff awareness, with the test checking how well that programme is working.
Speak to a NetMonkeys specialist
Practical, plain-English IT advice for UK businesses, from our Manchester headquarters and our teams in London and Nottingham.
Book a conversation
