Choose a penetration testing company on evidence about the people who will actually test your systems, how the company scopes and reports, and whether its accreditations match what your sector or customers require. Ask for named testers and their qualifications, a sample report and a clear scope, and check schemes such as CREST or CHECK where they are expected.
The UK market is crowded, and most providers describe themselves in similar terms. The useful differences are in who does the work, how much of it is manual, and what you get at the end. This article covers the accreditations and qualifications you will see, the questions worth asking and the warning signs. For the test itself, see what happens during a penetration test.
Executive Summary & Key Takeaways
- The tester matters more than the brand. The NCSC says the quality of a test is “closely linked to the abilities of the penetration testers involved”.
- CREST accreditation assesses a company’s processes and methodology. CHECK is the NCSC scheme for public sector and critical national infrastructure, and other organisations do not need it.
- Individual qualifications such as OSCP and CREST’s exams show hands-on skill, but ask who will actually be on your test.
- A sample report tells you more about a provider than any sales conversation.
- Independence matters. Testing by the team that built or runs the system weakens the evidence.
Start with why you need the test
Who will read the report shapes what you should buy. An auditor, a large customer’s security questionnaire, a regulator, an insurer and your own board may each expect different things. Some will ask for a particular accreditation, some for testing against a specific standard, and some only for independent evidence that serious issues have been found and fixed.
Settle this before you approach providers. It tells you whether a scheme such as CHECK is required, what the report needs to contain, and which type of test fits. If you are unsure about the last point, read which type of penetration test do we need.
Company accreditations and what they tell you
CREST
CREST is an international body that accredits cyber security companies and certifies individual professionals. To be accredited, a company submits evidence about its processes, service methodologies and data security practices, which CREST reviews before awarding membership, followed by a lighter annual renewal and periodic reassessment (CREST, retrieved 27 October 2026). CREST says its review covers areas such as quality processes, professional indemnity insurance, information security, complaint handling and conflict of interest policies. Accreditation is by discipline, so check that a company is accredited for the service you are buying, such as penetration testing rather than another discipline.
CHECK
CHECK is the NCSC scheme under which assured companies carry out authorised penetration tests of public sector and critical national infrastructure (CNI) systems. The NCSC says central government systems processing data marked OFFICIAL and above should be assessed by CHECK companies, and strongly recommends CHECK for other public sector bodies. It is also clear that if your organisation is not public sector, testing “does not need to be conducted by a CHECK service provider” (NCSC, retrieved 27 October 2026).
CHECK sets requirements for individuals too. Team Leaders must hold at least a Principal-level and Team Members at least a Practitioner-level Security Testing professional title from the UK Cyber Security Council, and both must hold valid SC clearance (NCSC, retrieved 27 October 2026).
CBEST and other regulator-led schemes
CBEST is the Bank of England, PRA and FCA framework for intelligence-led testing of systemically important financial firms and financial market infrastructures. The threat intelligence and penetration testing providers must be accredited for CBEST by the Bank of England and must be CREST members (Bank of England, retrieved 27 October 2026).
EU financial entities identified by their regulator must carry out threat-led penetration testing (TLPT) at least every three years under Article 26 of DORA. DORA does not name a single accreditation. Instead, Article 27 requires testers to be certified by an accreditation body in a Member State or to follow formal codes of conduct or ethical frameworks, to provide independent assurance or an audit report on how they manage the risks of testing, and to hold professional indemnity insurance (EUR-Lex, retrieved 27 October 2026). The supporting technical standard adds requirements such as references from previous red team assignments and minimum experience levels.
If one of these applies to you, your regulator will normally tell you, and the provider requirements are set by the scheme rather than by you. Falx supports firms through these programmes, including advising the internal control team that plans and oversees the test, while the testing itself is carried out by providers that meet the scheme’s requirements.
| model | Run by | What it assures | Who needs it |
|---|---|---|---|
| CREST | CREST | Company processes and methodology, by discipline | Anyone wanting an independent check on a provider; some customers and regulators ask for it |
| CHECK | NCSC | Company methodology plus named, cleared and qualified testers | Central government, public sector and CNI |
| CBEST | Bank of England, PRA and FCA | Intelligence-led testing by Bank of England-accredited CREST members | Systemically important UK financial firms selected by regulators |
| DORA TLPT | EU financial regulators | Threat-led testing by testers meeting DORA Article 27 | EU financial entities identified by their regulator |
Individual qualifications
Accreditation tells you about the company. Qualifications tell you about the people. The PCI DSS v4.0.1 guidance on choosing a tester makes the same point: certifications “may be an indication of the tester’s skill level and competence”, alongside prior experience such as years of testing and the type of engagements (PCI SSC, retrieved 27 October 2026).
The ones you will see most often:
- OSCP (OffSec Certified Professional): a hands-on exam in which candidates have 23 hours and 45 minutes to compromise machines in a lab network, then write a professional penetration test report (OffSec, retrieved 27 October 2026). Since OffSec introduced OSCP+, passing candidates receive both: OSCP+ expires after three years, while OSCP does not.
- CREST exams: the CREST Registered Penetration Tester (CRT) is an intermediate practical exam, and the CREST Certified Tester exams in infrastructure (CCT INF) and applications (CCT APP) are advanced exams with written and practical parts (CREST, retrieved 27 October 2026).
- UK Cyber Security Council professional titles: registration at Associate, Practitioner, Principal and Chartered levels, with the higher titles held against a specialism such as Security Testing (UK Cyber Security Council, retrieved 27 October 2026).
- CISSP: a broad certification covering how to lead and manage a security programme, including security assessment and testing as one of eight domains (ISC2, retrieved 27 October 2026). It is valuable for advisory work but is not a hands-on testing qualification.
Falx consultants hold OSCP and CISSP. Whoever you choose, ask which named people will do your test and what they hold, not what the company holds in aggregate.
Questions to ask before you sign
- Who will do the testing? Ask for names or profiles, their qualifications and recent experience with systems like yours. Ask whether any of the work is subcontracted.
- Can we see a sample report? A redacted report shows whether findings are evidenced, reproducible and prioritised, and whether the executive summary would make sense to your board.
- How much of the test is manual? Automated scanning has its place, but you are paying for a person to find what tools miss.
- How do you scope and price? A credible provider will ask detailed questions before quoting. For what drives the number, see what affects the cost of a penetration test.
- How do you handle our data? Ask how evidence, credentials and findings are stored, shared and deleted after the test. NIST’s testing guide treats data collection, storage, transmission and destruction as core parts of any assessment (NIST, retrieved 27 October 2026).
- What happens if you find something critical? You want it raised immediately, not saved for the report.
- What is included? Debrief, retest, report format and any compliance mapping should be stated in the proposal.
- Are you independent of the systems being tested? PCI DSS, for example, requires organisational independence of the tester for its internal and external tests (PCI SSC, retrieved 27 October 2026).
It is also reasonable to ask about the provider’s own security. Falx, for example, is Cyber Essentials Plus certified.
In-house or outsourced?
Some organisations have the skills to test in-house, and many standards allow it if the tester is qualified and independent of the system. Most smaller organisations outsource, because experienced testers are expensive to employ full time and a fresh pair of eyes is part of the value. Penetration testing is still relatively uncommon: 13% of UK businesses reported carrying out penetration testing in the previous 12 months (Cyber Security Breaches Survey 2025/2026, DSIT and Home Office, retrieved 27 October 2026). If you are commissioning a test, you are likely to be ahead of most.
Common mistakes
- Choosing on day rate alone. Fewer, cheaper days on the same scope usually means less manual testing.
- Asking for an accreditation you do not need. CHECK, for example, is aimed at the public sector and CNI. Requiring it elsewhere narrows your options without improving the test.
- Not asking who will be on the test. The people who appear in the sales meeting may not be the testers.
- Skipping the sample report. It is the clearest view of what you are actually buying.
- Using your IT provider to test its own work. Independence is part of what makes the evidence credible.
Frequently asked questions
Do we need a CREST-accredited company?
Not by law. CREST accreditation is useful independent evidence that a company’s processes have been assessed, and some customers or regulators ask for it. If no one in your audience requires it, judge providers on their testers, their methodology and their reports.
Should we change provider every year?
Not necessarily. Staying with one provider builds knowledge of your systems and makes year-on-year comparison easier. Changing occasionally brings a fresh perspective. A middle ground is to keep the provider and ask for different testers on the team.
Can our managed IT provider do our penetration testing?
They can if they have qualified testers, but independence is the issue. If the same organisation configures and maintains the systems, its testers are checking their own colleagues’ work. Many auditors and customers will prefer a separate provider.
Does the provider need to be based in the UK?
There is no general rule. Location matters if testing involves sensitive data, on-site work or schemes such as CHECK, which require cleared testers. Otherwise, focus on skills, data handling and whether you can contract and communicate easily.
Getting started
The best way to compare providers is to give each one the same clear brief: what you want tested, why, and who will read the report. Our penetration testing service starts with that scoping conversation, and you get a fixed price before any testing begins.
To talk through your requirements, talk to our team.
Jared Henderson
Writing about cyber security and technology at Falx.
