How accurate is the estimate?

The range covers the 25th to 75th percentile of NetSec pen-test quotes from 2024-2026. Around three-quarters of engagements land somewhere in the range. Outliers higher or lower depend on scope: a complex multi-tenant SaaS web app sits at the top of the web-app range, a single-page brochure site sits at the bottom.

Why don't you just publish a single price?

Pen testing is genuinely bespoke. A single price would either be too low (and we would have to revise on every engagement) or too high (and we would scare off legitimate buyers). The range gives you a defensible back-of-envelope figure before you book the scoping call.

Are these prices ex VAT?

Yes. All prices in the calculator are ex VAT. UK VAT at the standard rate applies on top.

Are NetSec testers CREST registered?

Yes. NetSec's lead testers are CREST Registered Penetration Testers. CREST registration is the UK industry standard for individual tester competence.

What happens after I book the scoping call?

We confirm the scope (number of apps, user roles, network subnets, cloud accounts), agree the test window, send a written quote and engagement letter, and book the test in. Most engagements start within 2-3 weeks of the scoping call.

CREST Registered Testing

Penetration Testing Cost Calculator

Free estimator for CREST-registered penetration tests across web app, network, mobile, cloud, API, wireless, and social-engineering categories.

Each range is the 25th to 75th percentile of NetSec quotes. Your scoping call confirms the actual figure.

Select the test categories in scope

Tick every test category your engagement might include. The estimate updates live. Each range is the 25th to 75th percentile of NetSec quotes, GBP ex VAT.

Web Application Test

£4,500 – £12,000

OWASP Top 10 + business-logic testing of a single web application or admin portal. Authenticated and unauthenticated test cases.

Typical duration: 5 – 15 working days

External Network Test

£2,500 – £7,500

Internet-facing perimeter test against the firm's public IP range and externally-exposed services.

Typical duration: 3 – 8 working days

Internal Network Test

£5,000 – £14,000

Internal network and Active Directory test simulating a foothold inside the firm's perimeter.

Typical duration: 5 – 15 working days

Mobile App Test

£5,500 – £13,000

iOS and/or Android application binary analysis, runtime testing, and back-end API testing.

Typical duration: 5 – 12 working days

Cloud Configuration Review

£3,500 – £9,500

AWS, Azure, or GCP tenant configuration review against CIS Benchmarks + provider-specific best practice.

Typical duration: 4 – 10 working days

API Security Test

£3,500 – £9,000

REST/GraphQL API security testing against OWASP API Security Top 10, with authenticated and unauthenticated test cases.

Typical duration: 4 – 10 working days

Wireless Network Test

£2,000 – £5,500

Wireless network security test including WPA2/WPA3 implementation, guest network isolation, and rogue AP detection.

Typical duration: 2 – 5 working days

Phishing / Social Engineering

£2,500 – £8,000

Targeted phishing campaign or vishing engagement to test the firm's human-layer detection and response.

Typical duration: 3 – 10 working days

Penetration Testing Cost Calculator

Select the test categories in scope

Web Application Test

External Network Test

Internal Network Test

Mobile App Test

Cloud Configuration Review

API Security Test

Wireless Network Test

Phishing / Social Engineering

Why CREST registration matters

Get the actual quote

Penetration Testing Cost Calculator

Select the test categories in scope

Web Application Test

External Network Test

Internal Network Test

Mobile App Test

Cloud Configuration Review

API Security Test

Wireless Network Test

Phishing / Social Engineering

Why CREST registration matters

Get the actual quote