Short answer: penetration testing in the UK is priced by the number of tester days your scope needs. At Samurai Security our typical day rate is £1,350 per consultant day, lower for multi-day programmes and for clients on a retainer with more days. Use the calculator below for an indicative estimate: choose what you want tested and you will see the testing and reporting days and a from-price.
Penetration testing cost calculator
Choose what you want tested and adjust the sliders. The estimate is the indicative number of testing and reporting days multiplied by our typical day rate of £1,350 per consultant day.
This is an estimate only. A formal quote needs a short scoping call with us.
How the estimate works
- Price: the indicative number of days multiplied by our typical day rate of £1,350 per consultant day. The day rate reduces for multi-day programmes and retainers.
- Quoted in days: every quote states the number of consultant days, so you can see exactly what you are paying for.
- Days: each service has a starting point for a simple scope, made up of testing days plus reporting time. Larger or more complex scopes need more days.
- External infrastructure: 1 testing day for every 15 external IP addresses (1 to 15 is 1 day, 16 to 30 is 2 days, and so on), plus reporting time. Up to 15 IP addresses is 1 testing day and 1 reporting day, from £2,700.
- Internal infrastructure: testing days are driven by the number of devices: about 5 servers, 10 switches, 10 printers or VoIP phones, or 10 wireless access points per testing day, with a minimum of 1 testing day and 1 reporting day (from £2,700). The number of networks, subnet sizes and firewalls are recorded to help us scope but do not change the estimate. Internal tests are always confirmed at scoping.
- Web application: a simple public website with no login, up to 10 pages, starts at 1 testing day and 1 reporting day, from £2,700. An application with a login, up to 25 pages or functions and 2 user roles, starts at 2 testing days and 1 reporting day, from £4,050.
- Mobile application: one platform starts at 2 testing days and 1 reporting day, from £4,050, confirmed at scoping.
- APIs: 1 testing day for every 20 endpoints and methods in total (1 to 20 is 1 day, 21 to 40 is 2 days, and so on), plus reporting time. The number of separate base URLs does not add days. APIs are always confirmed at scoping.
- Cloud configuration reviews, build reviews and red team work are scoped individually.
- Final price after scoping: if your selections go beyond a simple starting point, combine several services, or include unusual, regulated or third-party systems, the calculator shows a from-price and we confirm the final price after a short scoping call.
- Retesting is scoped to the number of findings to re-verify and quoted up front.
- Reporting: we aim to deliver the report within 5 working days of testing finishing; very large engagements can take longer.
- Testing approach: human-led, hybrid (recommended) or Katana, our own AI-powered testing platform. The estimate is the same whichever you choose; hybrid or Katana can shorten turnaround where suitable.
This is an estimate only. A formal quote needs a short scoping call with us. Want a reference number? Save your estimate with your name and work email, then confirm your email to get one, and quote it when you call us. Or book a scoping call.
What decides how many days a penetration test needs?
Penetration testing is priced in tester days. The NCSC says the scoping document should state "the timeframe and the amount of effort necessary to deliver the testing - usually given in terms of resource days" (NCSC). Effort follows scope:
- Size: the number of IP addresses, hosts, applications, user roles or API endpoints.
- Type of test: external or internal network, web or mobile application, API, cloud, Active Directory or red team.
- Complexity: custom business logic, multiple integrations, cloud plus on-premises.
- Compliance: a test that must satisfy PCI DSS, CBEST or a client's contract may need extra evidence or specific testers.
- Delivery: on-site work, out-of-hours testing and tight deadlines add effort.
- Retesting: how many findings need re-verifying once you have fixed them.
- Testing approach: human-led, Katana or hybrid. With the client’s agreement, Katana can be used for suitable parts of the work, which can shorten turnaround.
Tell us what you need tested and we will come back with the days, the price and the dates.
Human-led, hybrid or Katana?
Katana is our own AI-powered testing platform, built and run by Samurai Security; it is not a third-party tool. Within a Samurai engagement, and with the client’s agreement, our consultants can use it for suitable external testing to speed up delivery; the engagement stays scoped and consultant-led. Our human testers add what automation can’t: creative, lateral thinking, chaining smaller weaknesses into real attack paths, and judgement on context-dependent findings such as business-logic flaws. That is why we usually recommend hybrid, but the choice is always yours. See our penetration testing services.
Is a cheap penetration test worth it?
Be wary of prices that look too low for the scope. CREST says penetration testing uses "a variety of manual techniques supported by automated tools" and that it "is often confused with Vulnerability Assessment" (CREST). The NCSC says the quality of a test is closely tied to the abilities of the testers (NCSC). An automated scan has value, but it is not a penetration test, so check how many tester days you are paying for and how much of the work is manual.
How do you compare penetration testing quotes?
- Divide the price by the tester days to get the effective day rate, then compare like with like.
- Check who is testing: ask for the testers' qualifications, such as CREST CRT, and whether the firm is on the CREST Marketplace.
- Ask how retesting is priced: included, a fixed fee, or scoped to the findings.
- Ask for a sample report and whether there is a debrief. The NCSC says "A debriefing can also be useful" (NCSC).
- Confirm the scope in writing, including exclusions.
For a full checklist, see how to choose a penetration testing provider.
How to use the calculator
- Choose what you want tested. Tick external infrastructure, internal infrastructure, web application, API or mobile application testing, or the services we scope individually.
- Describe your environment. Adjust the sliders, for example the number of external IP addresses, servers and switches, pages and user roles, or API endpoints.
- Choose a testing approach. Pick human-led, hybrid (recommended) or Katana. The estimate is the same whichever you choose.
- Read your estimate. See the indicative testing and reporting days for each service and a from-price at £1,350 per consultant day.
- Save it if you want a reference. Optionally save your estimate with your name and work email, then confirm your email within 1 hour to get a reference number.
- Book a scoping call. Book a short scoping call with us for a formal quote.
Frequently asked questions
How much does a penetration test cost in the UK? It depends on how many tester days your scope needs. Samurai Security's typical day rate is £1,350 per consultant day, lower for multi-day programmes and for clients on a retainer with more days, and every quote states the number of days. The smallest tests start at 1 testing day and 1 reporting day, from £2,700.
Is the penetration testing cost calculator free? Yes. It is free to use and you do not need to give any details to see an estimate. You only enter your name and work email if you want to save your estimate and get a reference number.
How is the estimate calculated? The calculator works out the indicative number of testing and reporting days for the services you choose and multiplies them by our typical day rate of £1,350 per consultant day. The day rate reduces for multi-day programmes and retainers.
Is the estimate a quote? No. It is an estimate only. A formal quote needs a short scoping call with us, and larger or more complex scopes are confirmed after scoping.
What is the smallest penetration test the calculator prices? An external test of up to 15 IP addresses, a simple public website with no login of up to 10 pages, or an internal test of up to 5 servers each starts at 1 testing day and 1 reporting day, from £2,700.
What decides how many days a test needs? The size and type of what is being tested, its complexity, any compliance requirements, delivery constraints such as out-of-hours work, retesting, and whether you choose human-led, Katana or hybrid testing.
Why are some penetration tests so cheap? Very low prices usually mean less manual testing. CREST describes penetration testing as manual techniques supported by automated tools, so check how many tester days you are paying for.
How is retesting priced? At Samurai Security, retesting is scoped to the number of findings to re-verify and quoted up front. Other providers price it differently, so ask before you sign.
How long does Samurai Security take to deliver a penetration test report? We aim to deliver the report within 5 working days of testing finishing; very large engagements can take longer.
How do I get a reference number for my estimate? Save your estimate with your name and work email, then confirm your email within 1 hour. We then show your reference and email it to you. Quote it when you call us.
Sources
All checked 28 October 2026.