Top Penetration Testing Companies In The UK In 2026
Dominic Tarn
Head Writer - ReVerb
10.23.2026
The strongest penetration testing companies UK buyers can shortlist in 2026 are NCC Group, Pen Test Partners and LRQA (formerly Nettitude). All three are NCSC CHECK certified, hold CREST penetration testing accreditation and are listed by CREST as assured providers for the Bank of England’s CBEST and STAR-FS threat-led testing schemes. That combination means they can cover everything from a routine web application test to a regulator-led red team. NCC Group brings the broadest technical bench, Pen Test Partners stands out for transport, maritime and OT work, and LRQA pairs testing with managed detection and compliance services.
This list of the Top Penetration Testing Companies In The UK In 2026 is for security leads, CTOs and compliance managers who need a UK-based tester for public sector, regulated or commercial work. Every firm here is headquartered in the UK. We checked each one against the CREST Marketplace and the NCSC’s CHECK listings, and we only state an accreditation where one of those sources confirms it. We then ranked firms on the depth of their verified accreditations, the range of testing they offer and how clearly their specialisms are evidenced.
UK Penetration Testing Companies At A Glance
Company
Headquarters
Best For
Verified Accreditations
NCC Group
Manchester
Large, multi-discipline programmes
CREST, CHECK, CBEST, STAR-FS
Pen Test Partners
Buckingham
Transport, maritime and OT testing
CREST, CHECK, CBEST, STAR-FS
LRQA
Birmingham
Testing plus managed security and compliance
CREST, CHECK, CBEST, STAR-FS
Prism Infosec
Cheltenham
Independent threat-led testing
CREST, CHECK, CBEST, STAR-FS
Cyberis Reply
Tewkesbury
Pragmatic testing with realistic fixes
CREST, CHECK, CBEST, STAR-FS
Claranet
London
Continuous testing alongside managed IT
CREST, CHECK
Bridewell
Reading
Critical national infrastructure and aviation
CREST, CHECK
JUMPSEC
London
Red teaming plus MDR
CREST, CHECK
WorkNest Secure (Pentest People and Bulletproof)
Chester
Mid-market testing with compliance support
CREST, CHECK, STAR-FS
Secarma
Manchester
Testing combined with Cyber Essentials
CREST
CREST, CHECK, CBEST, STAR-FS And Cyber Essentials Plus: The UK Buying Context
Most penetration testing UK buyers commission sits inside one of a handful of assurance schemes. Knowing which one applies to you narrows the shortlist quickly.
CREST Penetration Testing
CREST is an international not-for-profit body that accredits security companies and certifies individual testers. CREST penetration testing accreditation means the company’s processes, data handling and methodology have been assessed, and that it signs up to CREST’s codes of conduct. The CREST Marketplace lists each member’s accreditations, so you can confirm a claim in a minute rather than relying on a logo on a website.
CHECK Penetration Testing
CHECK is the NCSC’s scheme for testing public sector and critical national infrastructure (CNI) systems. CHECK penetration testing can only be delivered by NCSC-assured companies using cleared, qualified staff. If you are a government department, a public body or a CNI operator, CHECK is usually the standard you should ask for. Private companies can use CHECK firms too, but the NCSC points non-public organisations to its general guidance on commissioning a test.
CBEST And STAR-FS
CBEST is the regulator-led, threat intelligence-led assessment framework used by the Prudential Regulation Authority, the Bank of England’s FMI Directorate and the FCA since 2014. It uses two separately accredited providers, one for threat intelligence and one for penetration testing, and both must be CREST members. STAR-FS, launched with CREST in March 2024, is a threat-led testing framework for the wider UK financial sector that firms can start themselves or regulators can request. If you are a bank, insurer or market infrastructure provider, check the CREST Marketplace for “CBEST” or “STAR-FS” against a supplier’s name.
Cyber Essentials Plus
Cyber Essentials is the government-backed baseline certification, delivered through IASME as the NCSC’s partner. Cyber Essentials Plus covers the same five technical controls but adds hands-on technical verification by an assessor. It is not a penetration test, but many UK suppliers need it for public contracts, and several firms on this list are licensed assessors who can handle both pieces of work. For a fuller view of how testing maps to standards, see our guide to penetration testing for compliance.
Best Penetration Testing Companies In The UK In 2026
1. NCC Group — Manchester-Headquartered Tester With CHECK, CBEST And STAR-FS Coverage
NCC Group was founded in 1999, is headquartered in Spinningfields, Manchester, and says it has more than 1,800 security experts. It is listed on the London Stock Exchange. The NCSC lists it as assured for CHECK penetration testing as well as cyber incident response, incident exercising and resilience audit work.
Its CREST Marketplace entry is one of the most complete of any UK firm. It holds CREST accreditation for penetration testing, vulnerability assessment, threat intelligence, incident response and SOC services, and is listed as an assured provider for both the threat intelligence and the testing sides of CBEST and STAR-FS. That makes it one of the few firms that can cover a full regulator-led engagement under one roof.
Beyond standard infrastructure and application testing, NCC Group runs hardware and embedded security, cryptography reviews, container and network architecture assessments, and red, purple and black team exercises. It also offers continuous penetration testing for web apps, APIs and mobile apps that fits into agile release cycles, managed through its own client portal.
Best for: Large organisations and regulated firms that want one supplier for testing, threat intelligence and incident response.
2. Pen Test Partners — Buckingham Firm Known For Maritime, Aviation And OT Testing
Pen Test Partners has been testing since 2010 from its base near Buckingham, with an office in New York. The NCSC lists it as CHECK certified and assured for cyber incident response. On the CREST Marketplace it holds penetration testing, vulnerability assessment, application and mobile application security testing, and threat-led testing accreditations, and it is listed as an assured provider for CBEST, STAR-FS and the CAA’s ASSURE aviation scheme.
What sets the firm apart is its work on things that move. It tests ships, aircraft systems, vehicles and EV chargers, and offers dedicated OT, ICS and industrial IoT testing plus transport systems testing. Its public research blog regularly covers maritime, automotive, medical device and hardware hacking topics, which gives buyers a clear view of the team’s depth before they sign anything.
It also covers the mainstream: CHECK testing, PTaaS, AI testing, physical security, attack surface management, and Cyber Essentials and PCI DSS work as a Qualified Security Assessor.
Best for: Transport, maritime, manufacturing and OT-heavy organisations, plus financial firms needing CBEST or STAR-FS.
3. LRQA — Former Nettitude Team Combining Testing, MDR And Compliance
LRQA’s cyber practice is built on Nettitude, a UK firm founded in 2003 that Lloyd’s Register acquired in March 2018. The testing business now trades as LRQA, and the NCSC lists Nettitude Ltd, trading as LRQA, as a CHECK certified company covering the whole of the UK. LRQA Group’s registered office is in Birmingham.
The CREST Marketplace lists LRQA with accreditations across penetration testing, vulnerability assessment, application and mobile testing, threat intelligence, incident response and SOC, plus assured status for CBEST and STAR-FS on both the intelligence and testing sides. It is also a PCI DSS QSA and a Cyber Essentials assessor.
Its testing menu includes web, mobile and cloud testing, AI-assisted testing, PTaaS, red teaming, social engineering and purple teaming. Because LRQA also runs managed detection and response and supports ISO 27001, PCI DSS, DORA and SOC 2 programmes, it suits buyers who want test findings to feed straight into a wider assurance programme.
Best for: Organisations that want testing, compliance audits and managed security from one provider.
4. Prism Infosec — Independent Cheltenham Specialist In Threat-Led Testing
Prism Infosec has offered security services since 2006 and operates from Eagle Tower in Cheltenham. Founder Phil Robinson remains CEO. The NCSC lists the firm as CHECK certified, and the CREST Marketplace shows accreditations for penetration testing, vulnerability assessment, incident response, cyber advisory and threat-led testing, including the financial services variant.
Prism is listed as an assured provider for CBEST and STAR-FS penetration testing and for the CAA’s ASSURE scheme. It is also a PCI DSS QSA and an NCSC Cyber Advisor and Cyber Essentials assessor, which is a wide spread of credentials for a firm of its size.
Services run from infrastructure and cloud testing through red teaming and simulated attacks to incident response and managed SOC. Clients track live engagements through LuxisAI, Prism’s own platform for following test progress and findings in real time.
Best for: Financial services and public sector buyers who want a regulator-ready team without going to a large group.
5. Cyberis Reply — Tewkesbury Consultancy Focused On Realistic Remediation
Cyberis has worked with UK organisations since 2011 and is based in Tewkesbury, Gloucestershire. It is now part of the Reply group, which acquired it as part of its UK expansion, and the NCSC lists it as Cyberis Reply Limited with CHECK certified status.
On the CREST Marketplace, Cyberis holds penetration testing, vulnerability assessment, incident response and threat-led testing accreditations, and it is listed as an assured provider for CBEST and STAR-FS penetration testing. It also holds ISO 27001, ISO 9001 and Cyber Essentials Plus, and acts as a Cyber Essentials assessor.
Testing covers infrastructure, corporate networks, cloud, web and mobile applications and web services. The firm’s stated approach is practical: reports map likely attack paths for different threat actors, and if the ideal fix is not workable for a client, consultants help find an alternative rather than leave an impossible recommendation on the page. Each project gets a dedicated project manager, and the firm also runs ransomware defence audits and attack surface discovery.
Best for: Teams that want CHECK or STAR-FS grade testing with remediation advice they can actually act on.
6. Claranet — London Managed Services Group With A Large In-House Testing Team
Claranet is a London-based managed IT and cloud provider that built its security testing practice by acquisition. It bought Leeds penetration testing specialist Sec-1 in 2017 and ethical hacking training and testing firm NotSoSecure in 2018. The NCSC lists Claranet as CHECK certified.
Its CREST Marketplace entry covers penetration testing, vulnerability assessment, application and mobile application security testing, cyber audit and SOC services. It is also a PCI DSS QSA and a Cyber Essentials assessor, and holds Cyber Essentials Plus itself.
Claranet says it has more than 200 cyber security engineers and delivers around 10,000 days of penetration testing a year with its in-house offensive team. It also runs a continuous security testing service that tracks a changing attack surface, three UK SOCs and hands-on security training.
Best for: Organisations that already buy hosting or managed services and want testing, monitoring and training from the same supplier.
7. Bridewell — Reading Firm Serving Critical National Infrastructure And Aviation
Bridewell was founded in 2013 and is headquartered at Thames Tower in Reading. The NCSC describes it as a large organisation with more than 250 staff and lists it as assured for CHECK penetration testing, cyber incident response, incident exercising, resilience audit and Cyber Advisor services. Growth Capital Partners invested in the firm in 2021, and it has since opened US offices in Houston, New York and Orlando.
Bridewell’s CREST accreditations cover penetration testing, vulnerability assessment, threat-led testing, incident response, incident exercising and SOC. Its client base leans towards operators of essential services, and aviation is a clear focus, with airport case studies and work with the aviation information sharing community.
Alongside testing and red team assessments, it runs managed detection and response, data privacy services and 24/7 incident response, so test findings can be monitored afterwards by the same team.
Best for: CNI operators, airports and energy firms that need CHECK testing and a 24/7 response partner.
8. JUMPSEC — London Specialist In Red Teaming And Attack Surface Management
JUMPSEC was founded in 2012 and is based in Acton, west London. The NCSC lists it as CHECK certified and assured for cyber incident response and incident exercising. Its CREST accreditations include penetration testing, vulnerability assessment, incident response, SOC, threat-led testing and the newer AI-enabled penetration testing accreditation. It is also on the CAA’s ASSURE scheme.
Testing covers networks, web applications, cloud platforms including AWS, Azure, GCP and Microsoft 365, AI and LLM systems, and physical security. JUMPSEC’s red team offers threat-led exercises aligned to TIBER-EU, DORA and CREST frameworks, plus purple teaming and EDR efficacy assessments.
It also runs managed detection and response and continuous attack surface management, so findings from a test can be watched for regression afterwards.
Best for: Mid-sized and enterprise organisations that want adversary simulation and ongoing exposure monitoring from one team.
9. WorkNest Secure — Pentest People And Bulletproof Combined Under One Brand
WorkNest Secure brings together two well-known UK testers. Pentest People, a Leeds firm set up by the founders of RandomStorm, and Bulletproof were combined in 2025, and in May 2026 WorkNest launched them, alongside US firm Target Defense, as its WorkNest Secure division within Axiom GRC. The NCSC now lists Worknest Secure as CHECK certified.
The CREST Marketplace entry for the combined business shows penetration testing, vulnerability assessment, incident response, application and mobile application testing and threat-led testing accreditations, and lists it as an assured provider for STAR-FS penetration testing.
Services span application, network, cloud and API testing, red and purple teaming, EDR and XDR evaluation, managed SIEM and SOC, and compliance work for Cyber Essentials, ISO 27001, PCI DSS, DORA and SOC 2. Clients see findings and continuous scanning results through the GuardNest platform.
Best for: Mid-market organisations that want testing bundled with compliance and data protection support.
10. Secarma — Manchester Tester And Cyber Essentials Certification Body
Secarma is registered at Birley Fields in Manchester and holds CREST accreditation for penetration testing, vulnerability assessment and cyber audit. It is a Cyber Essentials certification body and assessor, and holds ISO 27001 and ISO 9001. We did not find Secarma on the NCSC’s CHECK list, so public sector buyers who need CHECK specifically should look higher up this list.
Its testing covers web, mobile and cloud applications, infrastructure and wireless, configuration reviews, red teaming and objective-led tests, plus testing of AI systems, LLMs, agents and chatbots. On the certification side it handles Cyber Essentials and Cyber Essentials Plus, IASME Cyber Assurance, the IoT Cyber Scheme and Defence Cyber Certification.
For buyers in the North West, Secarma is one of several local options; our list of cyber security companies in Manchester covers the wider regional market.
Best for: SMEs and defence supply chain firms that need a penetration test and Cyber Essentials Plus from one supplier.
Where Did Some Familiar UK Pen Testing Companies Go?
Several names that used to top lists of UK pen testing companies now sit inside larger groups, which is why they are not ranked separately here. Context Information Security, a London consultancy founded in 1998, was bought by Accenture in March 2020. Redscan was acquired by Kroll in 2021. MWR InfoSecurity joined F-Secure in 2018; that consulting team later sat within WithSecure, which sold it to Swedish investor Neqst in May 2025, and it now trades as Reversec. Reversec is listed by CREST as a CHECK, CBEST and STAR-FS provider, but it is no longer a UK-headquartered business.
How To Choose A UK Penetration Testing Company
Do You Need CHECK, CREST Or Both?
If you are a public body, a government supplier testing government systems or a CNI operator, ask for CHECK. For most commercial work, CREST accreditation is the practical baseline. Many firms hold both, and you can confirm each claim on the NCSC and CREST Marketplace websites before you send a brief.
Are You In Scope For CBEST Or STAR-FS?
Banks, insurers and financial market infrastructure firms may be asked by the PRA or FCA to complete a CBEST assessment, and STAR-FS is available to a wider range of financial firms. Only a small group of providers is listed for these schemes, and some are accredited for testing but not for the separate threat intelligence role. Check both if you need a single supplier for the whole assessment. For deeper adversary simulation outside these schemes, see our list of top red teaming companies.
Does The Firm Test What You Actually Run?
A strong web application team may have little experience with OT networks, aircraft systems or Microsoft 365 tenants. Ask for anonymised sample findings or research from the specific area you need tested, and ask who will be on the engagement rather than accepting a general capability statement.
What Will You Get In The Report?
Ask to see a sample report before you sign. A good report gives an executive summary, risk-rated findings with clear reproduction steps and remediation advice that fits your environment. Check whether retesting of fixed issues is included in the price and how quickly it can be booked.
One-Off Test Or Continuous Testing?
Annual tests suit stable environments and compliance cycles. If you ship code weekly or change cloud infrastructure often, a continuous or PTaaS model, which several firms on this list offer, can catch issues between formal tests. Our penetration testing cost guide explains how scope and delivery model affect price.
Frequently Asked Questions
How Do I Check If A Penetration Testing Company Is CREST Accredited?
Search the company’s name on the CREST Marketplace. Its entry lists each accreditation it holds, such as penetration testing, vulnerability assessment or threat-led testing, along with any partner schemes like CBEST and STAR-FS.
Is CHECK Penetration Testing Only For Government?
CHECK is designed for public sector bodies and critical national infrastructure. Private organisations can hire a CHECK company, and many do because it signals a high standard, but they do not need to request a formal CHECK test.
Is Cyber Essentials Plus The Same As A Penetration Test?
No. Cyber Essentials Plus verifies that five baseline controls are in place through technical checks by an assessor. A penetration test goes further, with testers actively trying to exploit weaknesses in the systems you put in scope.
How Often Should A UK Business Commission A Penetration Test?
At least once a year is a common baseline, and standards such as PCI DSS set their own testing requirements. You should also test after significant changes, such as a new application, a cloud migration or a major network redesign.
Conclusion
The UK market is unusual in how much of the buying decision can be checked against public registers. Start with the scheme you need, whether that is CREST, CHECK, CBEST or STAR-FS, confirm it on the CREST Marketplace or the NCSC site, and then choose between qualified firms on specialism, reporting quality and delivery model. NCC Group, Pen Test Partners and LRQA cover the widest ground, while Prism Infosec, Cyberis Reply and JUMPSEC offer strong regulated-sector capability with a more focused team.
If you want to feature your company on this list, email us or submit a form in the Top Choices section. After a thorough assessment, we’ll decide whether it’s a valuable addition.
