UK Penetration Testing Providers: Q3 2026
This is the Q3 2026 edition of our UK list: who is trading, who is accredited, and what moved between July and September. It runs alongside our evergreen ranking rather than replacing it. If you want the standing view, use the main UK list; if you want to know what changed this quarter, you are in the right place.
The quarter's headline is consolidation. Pentest People, Bulletproof and Target Defence now trade as a single CREST-accredited entity under the WorkNest Secure brand, which removes two familiar names from UK shortlists and adds one larger one. At the smaller end, Solusec joins the list as a CREST-accredited Shropshire consultancy. Both changes are set out below with the registers we checked them against.
Accreditation remains the thing worth filtering on. CREST is the commercial baseline, CHECK is required for UK government and public-sector systems, and CBEST or STAR-FS applies to intelligence-led testing of Bank of England-regulated firms. Each profile carries the date we last verified it, so you can see how fresh any given entry is rather than taking the quarter stamp on this page as a claim about all of them.
Related: UK penetration testing companies (standing list) · CHECK pen testing companies · CBEST-accredited companies
What changed this quarter
July to September 2026
- 21 Aug 2026WorkNest Secure listed. Pentest People, Bulletproof and Target Defence now trade as one entity, WorkNest Cyber Ltd, which is the renamed Pentest People Limited and holds CREST accreditation plus an NCSC CHECK Green Light listing. The separate Bulletproof and Pentest People profiles were retired and now redirect. Checked against the CREST Marketplace, the NCSC CHECK register and Companies House.
- 15 Aug 2026Solusec listed. A CREST-accredited consultancy in Albrighton, Shropshire, founded 2021, also holding Cyber Essentials and IASME Cyber Assurance. Checked against the CREST Marketplace and the IASME register.
- 1 Jul 2026LRQA and Nettitude consolidated to a single record. LRQA acquired Nettitude, and the current CREST member is LRQA, listed as formerly Nettitude, so the duplicate entry was withdrawn from the rankings.
SECFORCE
Canary Wharf-based adversary simulation and CBEST-aligned penetration testing consultancy, delivering CREST-accredited offensive security to UK financial services and other organisations with the most demanding requirements.
PwC Cyber Security
Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.
Dionach
Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.
WorkNest Secure
CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.
MDSec
Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.
Secarma
Manchester-based independent cybersecurity consultancy with over 20 years of experience delivering CREST and CHECK-accredited penetration testing, red teaming, and compliance certification services.
Cyberis
CREST and CHECK-accredited UK penetration testing consultancy with CBEST approval, specialising in infrastructure, application, and simulated attack assessments across the public and private sectors.
Aristi
CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.
Bridewell
Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors.
JUMPSEC
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
Salus Cyber
Award-winning Cheltenham-based cybersecurity consultancy with NCSC CHECK Green Light status and CREST approval, specialising in defence, government, and critical national infrastructure security.
UK Penetration Testing Providers: Q3 2026, FAQs
How is this different from your main UK list?+
The main UK list is the standing ranking and is updated continuously. This page is the Q3 2026 edition: the same providers, plus a record of what changed in the UK market between July and September 2026 and the registers we checked those changes against. Use the main list to shortlist, and this one to see what has moved since you last looked.
What happened to Pentest People and Bulletproof?+
Both now trade as WorkNest Secure. WorkNest brought Pentest People, Bulletproof and Target Defence together under one brand in May 2026, and the CREST Marketplace lists the combined entity as WorkNest Cyber, comprising Bulletproof Cyber, Target Defence and Pentest People. The trading company is WorkNest Cyber Ltd, the renamed Pentest People Limited. Their old profiles on this site redirect to the WorkNest Secure listing.
Which accreditations matter for a UK buyer in 2026?+
CREST is the commercial baseline and the one to insist on. CHECK, run by the NCSC, is required for testing UK government and public-sector systems. CBEST is the Bank of England framework for intelligence-led testing of regulated financial institutions, with STAR-FS as the CREST-run equivalent. Cyber Essentials and ISO 27001 tell you about the provider's own security posture rather than their testing capability.
How often is this list checked?+
Providers are verified against the issuing register rather than their own marketing, and every profile shows the date it was last checked. Those dates vary: some entries were last verified earlier in 2026, and the quarter stamp on this page refers to the edition, not to a claim that every provider was re-checked in Q3.
Can a provider pay to appear higher on this list?+
No. Editorial scores are never for sale. A provider can pay for a clearly labelled Featured or partner placement, which is marked as a paid placement wherever it appears and does not change any provider's score or the order of the rest of the list.