Almost no UK regulation says the words “you must have a penetration test”. That surprises people who have just been sent a security questionnaire with a box asking for their most recent one.
What the rules mostly say is that you have to test your security and be able to show you did. The method is left to you. A handful of regimes are specific, and if you are in one of those you will know about it, because the specificity comes with an auditor attached.
Here is the honest split for a small UK company. This is general information, not legal advice.
UK GDPR: test your measures, method up to you
Article 32 of the UK GDPR is the one that catches almost everybody, because it applies the moment you process personal data. Email addresses count. The operative limb is Article 32(1)(d), which requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures.
Read that again: a process for regularly testing. Not a penetration test, not an annual one, not an accredited one. The ICO's guide to data security lists vulnerability scanning and penetration testing as techniques you might use, and says the work can be done internally or externally. It does not fix a type of test or an interval, because the law does not. What is appropriate depends on what you process and the risk.
The ICO's security outcomes guidance adds the part people skip. Testing counts for less if you cannot show the results and what you did about them. A test report sitting in a folder with eleven unfixed mediums is worse evidence than a smaller test with a remediation log attached.
So for Article 32, an external test of your web app plus a record of what you fixed is defensible evidence. It is not the only defensible answer, and nobody can tell you it is mandatory, because it is not.
Cyber Essentials Plus is not a penetration test
This one causes the most confusion, usually because a procurement form asks for both and the buyer does not know they are different things.
Cyber Essentials certifies five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The base certification is a self-assessment with an independent audit, starting at £320 plus VAT and scaling with the size of the organisation. Cyber Essentials Plus covers the same five controls and adds independent technical testing to confirm they work in practice.
Note what the NCSC does not say. Its own description of Plus is “the same protections, but with more rigorous, independent technical testing”. The phrase “penetration test” does not appear. Plus is a pass or fail audit against a defined specification on a sample of your devices. A tester is not trying to think like an attacker or chain findings together. It answers “are these five controls switched on and working”.
A penetration test will not get you Cyber Essentials Plus, and Plus will not satisfy a customer who asked for a pen test. If a questionnaire asks for both, you need both. They cost different amounts and prove different things.
PCI DSS is the one that names it
If you store, process or transmit card data, PCI DSS v4 Requirement 11.4 is explicit. It calls for internal and external penetration testing at least annually and after any significant change, and if you use network segmentation to cut your scope, the segmentation needs testing too.
This is where our $495 test stops being the whole answer. An external web app test can be the external component. It is not internal testing, it is not segmentation testing, and it will not satisfy a QSA on its own. If you are in PCI scope, talk to your acquirer about which self-assessment questionnaire applies before you buy any testing, because the answer changes what you need.
Worth knowing: if you redirect to Stripe or a similar hosted checkout and card data never touches your servers, your scope is much smaller than you probably fear. Confirm that with your acquirer rather than assuming it.
Financial services: CBEST, and why it is not your problem
CBEST is threat intelligence-led testing run by the Bank of England, the PRA and the FCA. It is aimed at systemically important firms and financial market infrastructure, and participants are selected by the regulators. One Bank of England thematic letter describes a cycle covering 14 firms. STAR-FS extends threat-led testing to a wider set of firms.
If you are a fintech startup, CBEST is not a box you need to tick. It is worth naming only so you can recognise it in a questionnaire and say, accurately, that it does not apply to you. A CBEST engagement is a different species of exercise from anything on this site.
CREST, CHECK and who tests you
Some UK buyers do not ask whether you had a test. They ask who did it. CHECK is the NCSC scheme for providers testing UK public sector systems. CREST is the accreditation most commonly named in private-sector contracts and insurance questionnaires.
Be straight with yourself about this before you spend money. If a contract specifies a CREST-accredited or CHECK provider, an unaccredited test does not satisfy it no matter how good the findings are. Our test is not CREST accredited. For a seed-stage SaaS answering a questionnaire that asks for evidence of regular testing, that is usually fine. For a public sector framework or an enterprise contract that names a scheme, it is not, and you should buy the accredited engagement.
On the horizon for MSPs
The Cyber Security and Resilience Bill passed the House of Commons on 16 June 2026 and would extend the NIS Regulations 2018 to data centres, large load controllers and managed service providers. It was still moving through the Lords at the time of writing, so nothing in it binds you yet.
If you run an MSP, watch it. Check the bill's page for the current stage rather than trusting any summary, including this one.
What this means in practice
For most small UK companies, the real driver is not a regulator. It is a customer's security questionnaire, and the honest answer to “do we legally need a pen test” is usually no, while the answer to “do we need one to close this deal” is yes.
- Processing personal data only: Article 32(1)(d) wants regular testing and records. An external test plus a remediation log is good evidence.
- Asked for Cyber Essentials or Plus: buy that certification. A pen test is not a substitute.
- Taking card payments: PCI DSS 11.4 names penetration testing. Check your scope with your acquirer first.
- Contract names CREST or CHECK: use an accredited provider.
- Regulated financial services: your obligations come from your regulator, not from a blog post.
Prices on this site are in US dollars, which is worth factoring in if you are budgeting in sterling.
Where we fit
A $495 external test of your web app, with a human reviewing the output, is built for the common case: a small team that needs evidence of regular testing for a questionnaire or an Article 32 file, and wants to know what is actually exposed. The report is written to be handed to a customer.
It is not an accredited engagement, not internal network testing, and not a certification. If you are reading our SOC 2 post as well, the same logic applies there: the framework asks for testing, not for a specific badge.
The free scan shows what is visible on your domain right now, which is a reasonable place to start before you decide what you actually need to buy.