A customer or an insurer has asked for a penetration test, and now you are staring at quotes that range from a few hundred pounds to tens of thousands. The confusion is understandable, because three very different things are often described with the same words. A vulnerability scan, a penetration test and a red team exercise sit at different price points, answer different questions, and are appropriate at different stages of a company’s maturity. This guide explains each in plain English, what each costs, and how to work out what the person asking actually wants.
Vulnerability scanning: the automated health check
A vulnerability scan is an automated process that checks your systems, applications and networks against a database of known weaknesses and produces a list ranked by severity (ANSecurity). Think of it as a routine health check. It is fast, repeatable and cheap, which is exactly why it should be run often rather than once. The NCSC recommends building vulnerability scanning into routine practice, on a monthly or quarterly rhythm, so that new issues are caught soon after they appear.
A scan tells you what might be wrong. It does not confirm whether a weakness is genuinely exploitable, and it will produce false positives. For UK SMEs, scanning typically costs in the region of a few hundred to a couple of thousand pounds depending on scope, and often runs as a monthly subscription (Silver Lining). It is the workhorse of good hygiene, not a one-off event.
Penetration testing: a skilled human tries the door
A penetration test is a scoped, authorised exercise where a skilled tester attempts to exploit weaknesses the way a real attacker would, then confirms which ones actually work and what the impact would be. Where a scan lists potential issues, a pen test validates them and shows real-world consequences. That human judgement is the difference, and it is why a pen test costs more.
In the UK, credible penetration testing from a CREST-accredited provider is usually priced per consultant day, commonly around £1,000 to £1,500 a day, so a typical small-business engagement of three to five days lands roughly between £3,750 and £6,250 (Precursor Security). A basic external network test may sit lower, and a complex web application test higher. Most guidance suggests testing at least annually, and again after any significant change to your systems (Cyphere). For work touching government or critical infrastructure, buyers look for providers assured under the NCSC CHECK scheme.
Red teaming: testing whether you would even notice
A red team exercise is broader and more adversarial. Rather than finding as many vulnerabilities as possible, a red team picks a realistic objective, such as reaching a specific system or dataset, and tries to achieve it by any means, quietly, over an extended period. The point is not just to find holes. It is to test whether your people, processes and monitoring detect and respond to a genuine intrusion (NCC Group).
Red teaming assumes you already have mature detection and response in place, because there is little to learn from evading defences that are not there. It is expensive, time-consuming and appropriate for organisations at the top of their maturity curve, not for a firm that has not yet run its first scan. For most SMEs, red teaming is a later chapter, if it is relevant at all.
What a customer or insurer usually means
When a customer questionnaire or an insurer asks for a penetration test, they rarely want a full red team, and often they would be satisfied with less. In practice they are checking that you take security seriously and have had an independent set of eyes on your systems. Sometimes an external vulnerability assessment plus evidence of Cyber Essentials is enough. Before you commission anything, it is worth asking one question back: what specifically do you need to see? The answer usually saves money and points you to the right test.
It also pays to check whether they want the test repeated on a schedule, and whether they expect a specific accreditation such as CREST or the NCSC CHECK scheme. Getting those two details up front avoids commissioning a test that technically happened but does not satisfy the person who asked for it.
What actually drives the price
The wide range in quotes is not arbitrary. Penetration testing is priced mostly by consultant time, so the cost tracks the size and complexity of what you are asking to be tested (Cyphere). A single external network with a handful of internet-facing services is a short job. A large web application with many user roles, integrations and a complex login flow takes far longer to test properly. If a quote looks suspiciously cheap, it is usually because the scope is narrow or the work is really an automated scan wearing a pen test label. Be clear on scope, ask what is included, and treat the cheapest bid with the same caution you would apply to any professional service.
What a good report looks like
The deliverable matters as much as the test. A report you can actually use has a short executive summary a non-technical owner can read, a clear findings table that rates each issue by severity and shows the real-world impact, concrete remediation advice with an owner and a due date, and an offer to retest once you have fixed the important items. A list of raw scanner output with no prioritisation is not a penetration test report, whatever the invoice says. Insist on a business-readable summary and a retest, because fixing the findings is the entire point.
A simple rule of thumb
- Run vulnerability scanning continuously. It is cheap, and it keeps you honest between bigger exercises.
- Commission a penetration test annually, and after any significant system change, once your basic controls are in place.
- Consider red teaming only once detection and response are genuinely mature and you want to test them under pressure.
How this maps to the TrustOps Maturity Model
Scheduled vulnerability scanning is part of what moves a firm from Level 3 (Managed) to Level 4 (Measured). An annual penetration test is a hallmark of Level 5 (Optimised), alongside continuous monitoring and supplier reviews on a cadence. Red teaming only makes sense once you are securely at Level 5. TrustOps brokers penetration testing through a vetted, CREST-accredited white-label partner, and owns the scoping and the client-facing report, so you get an independent test without vendor hype or a hard sell.
If you are not sure where you stand today, the honest first move is to find out. Our free 15-minute assessment scores you out of 100 against the same six functions, shows your top five gaps, and gives you a maturity level you can act on, whether or not we ever speak again. Start with the free assessment at trustops.co.uk.
Sources
ANSecurity – Penetration Testing vs Vulnerability Scanning: What’s the Difference? https://www.ansecurity.com/penetration-testing-vs-vulnerability-scanning-whats-the-difference/
NCC Group – Pen Test, Red Team, or Bug Bounty? (red team objectives and scope): https://nccgroup.com/uk/research-blog/pentesting-v-red-teaming-v-bug-bounty
Precursor Security – Penetration Testing Cost UK (per-day and typical engagement pricing): https://www.precursorsecurity.com/services/offensive-security/penetration-testing/cost
Cyphere – What is Penetration Testing? (frequency and cost drivers): https://thecyphere.com/blog/what-is-penetration-testing/
NCSC – CHECK: penetration testing (assured providers for government and critical infrastructure): https://www.ncsc.gov.uk/information/check-penetration-testing
