The phrase “penetration testing” tends to conjure images of black-hooded hackers and enterprise security teams with six-figure budgets. Neither is accurate, and the gap between perception and reality is stopping a lot of UK small businesses from doing something genuinely useful for their security posture.
A penetration test — pen test — is simply a structured exercise where a security professional attempts to find and exploit vulnerabilities in your systems before a real attacker does. It produces a report you can act on. The price range starts lower than most business owners expect, and for certain types of businesses, it’s not optional so much as expected.
Here’s how to think about whether you need one, what it actually involves, and what to do with the results.
When a Pen Test Makes Sense
Not every small business needs a penetration test on the same schedule — and for some, other security foundations should come first. But a few situations make the case fairly clearly.
You handle customer data at any meaningful scale. If you’re processing personal information — names, addresses, payment details, health records — you have GDPR obligations and a real liability if you’re breached. A pen test helps you verify that your systems can withstand attack before the ICO finds out the hard way.
You take card payments online. PCI DSS, the card payment security standard, requires businesses above a certain transaction volume to conduct regular penetration testing. Many small businesses fall below the threshold for mandatory external tests but still benefit from doing one — and some payment processors now expect it regardless.
You’re bidding for public sector or enterprise contracts. Government frameworks and larger businesses increasingly want evidence of security testing from their suppliers. Cyber Essentials certification is the minimum floor; a pen test report gives you something more concrete to present.
You’ve recently launched a new web application or API. Applications are where vulnerabilities tend to cluster — authentication bypasses, injection flaws, insecure direct object references. If your business depends on a web app you’ve built, testing it before you scale up is considerably cheaper than dealing with a breach afterwards.
What a Pen Test Actually Covers
There are several types, and being clear about what you’re buying matters.
Vulnerability assessment is the cheaper, faster cousin of a pen test. Automated tools scan your systems for known vulnerabilities — unpatched software, misconfigured services, exposed ports — and produce a list. It tells you what’s exposed, not whether it’s actually exploitable. Useful, but not the same thing.
External pen test targets what’s visible from the internet: your website, web applications, email systems, VPN endpoints. This is the most common entry point for attackers, so it’s usually the first thing to test. For a typical small business with a website and a few internet-facing services, this is where to start.
Internal pen test simulates what happens if an attacker is already inside your network — either a malicious insider or an attacker who’s gained initial access. Less relevant if you’re a five-person team in a single office; more relevant if you have complex network infrastructure or remote access for lots of staff.
Web application pen test goes deep on a specific application: authentication, session management, input validation, API endpoints, business logic flaws. If you’ve built or commissioned a bespoke application, this is what you want.
What It Costs and Who Does It
UK pen testing costs have come down considerably as the market has matured. For a small business external test covering a handful of internet-facing services, you’re realistically looking at £1,500 to £5,000 depending on scope and the firm you hire. A focused web application test for a moderately complex app typically runs £3,000 to £8,000.
That’s a meaningful amount for a small business budget, but compare it to the alternative: the average cost of a cyber incident for a UK SME runs to tens of thousands of pounds once you factor in downtime, recovery, notification costs, and potential ICO fines.
The NCSC maintains a directory of CHECK-approved suppliers — firms that have been vetted for their methodology and quality. This is the right place to start when looking for a pen testing firm rather than going via a cold Google search.
For lower-budget needs, the Cyber Essentials Plus certification involves a hands-on technical assessment that covers some of the same ground as a basic external vulnerability assessment. It’s not a full pen test, but it gives you certified evidence of your baseline security posture and is significantly cheaper.
What Happens During and After
A reputable pen test firm will start with scoping — a call where you define exactly what systems are in scope, what’s off-limits, and what the success criteria are. You’ll sign a rules of engagement document that gives them legal authorisation to test your systems. This is non-negotiable; testing without it is just hacking.
The active testing phase typically runs two to five days depending on scope. Good testers operate stealthily to simulate real attacker behaviour, but they’re not trying to destroy your systems — the goal is discovery, not damage.
The output is a report that lists discovered vulnerabilities, their severity (critical, high, medium, low), evidence of exploitation where applicable, and remediation recommendations. A good report explains each finding in plain English, not just technical jargon. You should be able to hand it to whoever manages your systems and have them understand what needs fixing and in what order.
Follow-up retesting — where the firm checks that your fixes actually work — is worth building into the scope. Finding a vulnerability and patching it correctly are two different things.
Starting Without a Full Test
If a full pen test is out of reach right now, there are sensible intermediate steps.
The NCSC’s Cyber Action Plan at cyberaware.gov.uk produces a tailored checklist based on your answers about your business. It’s a free starting point.
Tools like Qualys Community Edition or Tenable Nessus Essentials let you run basic vulnerability scans against your own systems without cost. They don’t simulate an attacker, but they’ll surface obvious gaps like unpatched software or open services you didn’t know were running.
Getting Cyber Essentials certified first — around £300 for the basic self-assessed version — gives you a documented baseline and often satisfies the basic security requirements that contracts and insurance policies ask for.
Pen testing works best as a repeating exercise rather than a one-time event. Annually for most small businesses is reasonable; after significant changes to your systems (new application, cloud migration, new office network) is also a sensible trigger. The goal is to find the gaps before someone else does.