Our Pricing
- ✓Every price publishedNo "request a quote" wall before you can budget
- ✓Fixed before work startsThe scoping call sets the price and it does not move
- ✓Manual testing, senior testerNever a scanner report with a logo on it
- ✓Retest of fixed findings includedOn every penetration test
Not sure where to start?
Most companies come to us at one of three points. If you are early, start free and work up. There is no obligation to go further and we will tell you honestly if you do not need the next step yet.
Free external scan
You want to see what is exposed, at no cost
- External, non intrusive scan of your public footprint
- Run with Tenable Nessus, the full report sent to you
- Severity ratings and technical detail
- Results within 72 hours
Scan and report
You need something to hand to a board, an insurer or a client
- Everything in the free scan
- Web application, API exposure and AI endpoint configuration
- CVE based detection with risk categorisation
- Executive summary report as a PDF
Manual penetration test
You need proof of what can actually be broken
- A human attacking your environment, not a scanner
- Exploitation, business logic and attack chaining
- False positives removed before you see the report
- Remediation steps, debrief call and a free retest
Penetration testing
Most UK providers quote £3,750 to £6,250 for a standard test. Every price below includes scoping, manual testing, a full report with remediation steps, a debrief call and a free retest of fixed findings.
| Test | Typical scope | Time | Price |
|---|---|---|---|
| External networkInternet facing servers, firewalls, VPNs, exposed services | Up to 16 public IPs | 2 to 3 days | from £1,800 |
| Web applicationFull OWASP coverage, authenticated, business logic, APIs behind the app | One application, up to 2 user roles | 3 to 4 days | from £2,700 |
| Cloud configurationAWS, Azure or Microsoft 365 tenant review plus exposed workloads | One tenant or account | 3 days | from £2,700 |
| Internal networkAssumed breach from inside, Active Directory, lateral movement, privilege escalation | One site, up to 100 hosts | 4 to 5 days | from £3,600 |
| API or mobile appREST and GraphQL APIs, iOS and Android builds | One API or one app | 3 to 4 days | from £2,700 |
| Day rateFor anything not listed, red team exercises, or ongoing retained testing | Scoped with you | Per day | £900 to £1,100 |
Larger or more complex environments are quoted after a 20 minute scoping call, and the quote is fixed before work starts. You can build your own estimate on the penetration testing page.
Other one off work
All of it human led, manually validated and scoped to your environment before anyone quotes you. No green tick reports, no outsourced junior analysts.
| Service | What it is | Price |
|---|---|---|
| Secure by Design workshop | Architecture and threat modelling session with your engineering team | from £950 |
| Ransomware readiness assessment | How far an attacker would get, and what you would lose | £1,500 |
| SOC and SIEM deployment | Monitoring stood up and tuned to your environment | from £2,500 |
| Incident response | Called in when something has already happened | £250 per hour |
Phishing simulation
Phishy is our own platform. Email, QR, SMS and voice simulations, a board ready report, and no employee password is ever stored. Run it monthly, or let us run one campaign for you as a pilot.
| Plan | Covers | Monthly | Done for you pilot |
|---|---|---|---|
| StarterEmail and QR, full reporting | Up to 50 employees | £99 | £249 |
| BusinessEmail, QR, SMS and voice, email builder, AI emails, department breakdown | Up to 250 employees | £299 | £599 |
| ProEvery channel, AI emails per person, dark web scan. £399 covers 250 employees, then 80p each | 10 to 2,000 employees | from £399 | from £1,199 |
No annual contract required, cancel monthly plans any time, or pay yearly and get 2 months free. Full detail on the Phishy page.
Security retainers
These are service retainers, not software subscriptions. All work is delivered by senior security specialists, and monthly packages can be cancelled at any time.
Active Defence
For startups and growing teams
- External vulnerability management
- Monthly automated scanning
- Manual validation of critical issues
- Risk prioritisation and remediation guidance
- Monthly security report
- Email support
Continuous Security Partner
For scaling businesses and SaaS platforms
- Everything in Active Defence, plus:
- External and internal vulnerability management
- Authenticated testing
- Cloud security reviews on Azure and AWS
- Manual attack path analysis
- Quarterly targeted penetration testing
- Monthly strategy call, retesting included
Virtual Head of Security
For regulated, high risk or enterprise environments
- Full attack surface coverage
- Continuous vulnerability management
- Manual threat hunting
- Incident response support
- Security architecture and advisory
- Compliance support for ISO 27001, SOC 2 and HIPAA
- Executive security reporting
- Priority on demand response
Questions we get asked
Do you offer custom pricing?
Yes. Around 80% of companies need a tailored package, because scope rarely matches a template. The published prices are the honest starting point rather than a headline we walk you away from.
Can you test multiple applications or environments?
Yes. We scope based on the size of your environment, so multiple applications, several sites or a mix of cloud and on premise are all normal. That is what the day rate is for.
Is there a contract?
Monthly packages can be cancelled at any time. One off work is quoted, agreed and invoiced per engagement, with the price fixed before we start.
Why are you cheaper than the big providers?
Lower overhead, and the person scoping your test is the person running it. There is no sales layer and no junior analyst doing the work behind a senior name on the report.
Is the retest really included?
Yes, on every penetration test. Once you have fixed the findings we test them again and confirm in writing that they are closed, which is usually what an auditor or an insurer wants to see.
Will the report satisfy our auditor or insurer?
It is written for that purpose, with an executive summary, risk ratings and evidence, and it maps to what ISO 27001, PCI DSS and Cyber Essentials Plus assessors ask for. If your assessor wants something specific, tell us before we start and we will include it.
Ready to build a package that fits your business?
Complete the form or email us at [email protected] to book a consultation