This is the Q3 2026 edition of our UK list: who is trading, who is accredited, and what moved between July and September. It runs alongside our evergreen ranking rather than replacing it. If you want the standing view, use the main UK list; if you want to know what changed this quarter, you are in the right place.
The quarter's headline is consolidation. Pentest People, Bulletproof and Target Defence now trade as a single CREST-accredited entity under the WorkNest Secure brand, which removes two familiar names from UK shortlists and adds one larger one. At the smaller end, Solusec joins the list as a CREST-accredited Shropshire consultancy. Both changes are set out below with the registers we checked them against.
Accreditation remains the thing worth filtering on. CREST is the commercial baseline, CHECK is required for UK government and public-sector systems, and CBEST or STAR-FS applies to intelligence-led testing of Bank of England-regulated firms. Each profile carries the date we last verified it, so you can see how fresh any given entry is rather than taking the quarter stamp on this page as a claim about all of them.
Related: UK penetration testing companies (standing list) · CHECK pen testing companies · CBEST-accredited companies
July to September 2026
CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.
Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.
Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
Manchester-based independent cybersecurity consultancy with over 20 years of experience delivering CREST and CHECK-accredited penetration testing, red teaming, and compliance certification services.
CREST and CHECK-accredited UK penetration testing consultancy with CBEST approval, specialising in infrastructure, application, and simulated attack assessments across the public and private sectors.
CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.
Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors.
Award-winning Cheltenham-based cybersecurity consultancy with NCSC CHECK Green Light status and CREST approval, specialising in defence, government, and critical national infrastructure security.
CREST and CHECK-accredited European managed services provider delivering penetration testing with deep infrastructure and cloud hosting expertise.
CREST-accredited UK cyber security and data protection consultancy offering penetration testing, ISO consultancy, and managed SOC services from offices across the UK and Ireland.
The main UK list is the standing ranking and is updated continuously. This page is the Q3 2026 edition: the same providers, plus a record of what changed in the UK market between July and September 2026 and the registers we checked those changes against. Use the main list to shortlist, and this one to see what has moved since you last looked.
Both now trade as WorkNest Secure. WorkNest brought Pentest People, Bulletproof and Target Defence together under one brand in May 2026, and the CREST Marketplace lists the combined entity as WorkNest Cyber, comprising Bulletproof Cyber, Target Defence and Pentest People. The trading company is WorkNest Cyber Ltd, the renamed Pentest People Limited. Their old profiles on this site redirect to the WorkNest Secure listing.
CREST is the commercial baseline and the one to insist on. CHECK, run by the NCSC, is required for testing UK government and public-sector systems. CBEST is the Bank of England framework for intelligence-led testing of regulated financial institutions, with STAR-FS as the CREST-run equivalent. Cyber Essentials and ISO 27001 tell you about the provider's own security posture rather than their testing capability.
Providers are verified against the issuing register rather than their own marketing, and every profile shows the date it was last checked. Those dates vary: some entries were last verified earlier in 2026, and the quarter stamp on this page refers to the edition, not to a claim that every provider was re-checked in Q3.
No. Editorial scores are never for sale. A provider can pay for a clearly labelled Featured or partner placement, which is marked as a paid placement wherever it appears and does not change any provider's score or the order of the rest of the list.