Starting a Penetration Testing Company in the UK

Starting a penetration testing company in the UK takes less money than most people expect and more paperwork than they hope: a limited company, insurance that covers the act of testing, terms you have actually read, written authorisation for every engagement, and a sample report good enough to send to a stranger. Certifications open doors, but the report is what wins the work.

The company and the money

You can test as a sole trader, but most organisations that buy testing, and most consultancies offering associate work, expect a limited company. Incorporating online has cost £100 since Companies House raised its fees on 1 February 2026, and every director appointed since 18 November 2025 must verify their identity with Companies House.

VAT registration becomes compulsory once taxable turnover passes £90,000 in any rolling twelve months, which a busy independent tester can reach in the first year. And if early income is associate work through your own company, the off-payroll working rules (IR35) decide whether you are taxed like an employee: public sector and medium or large private clients make that determination themselves, while for small private clients your own company does.

This is not legal or financial advice: have a solicitor read your terms and an accountant set up the company.

Insurance and first terms

Testing is one of the few kinds of consultancy where the work itself can cause the loss. A service that falls over under load, a lockout across a client's directory, a form submitted a thousand times into a live CRM: none of these needs negligence, and any of them can become a claim.

• Professional indemnity. The cover clients ask about most, usually £1 million to £5 million in our experience. Read the wording rather than the summary: you want authorised testing covered as an activity, not just advice, and you want to know what it says about outages you cause.
• Cyber insurance. For your own incident: a stolen laptop full of evidence, a compromised mailbox, the cost of telling clients.
• Public liability. For work on client premises, including physical testing.
• Employers' liability. Compulsory from your first employee, with at least £5 million of cover. A company whose only employee is an owner holding half or more of the shares is exempt.

Your first terms of business should tie scope to a statement of work, cap liability at a figure your insurance actually covers, have the client confirm it is entitled to authorise the testing, and say what happens to data at the end. A cap above your cover is a promise you cannot keep. Buyers will push back on all four, so decide in advance where you will bend.

Authorisation and the Computer Misuse Act

The Computer Misuse Act 1990 is why paperwork comes before tooling. Section 1 makes unauthorised access to computer material an offence, section 3 covers unauthorised acts that impair a computer, including reckless ones, and section 3A covers making or supplying articles for use in those offences. What separates a test from an offence is authorisation, and section 17(8) defines it narrowly: an act is unauthorised unless you are entitled to decide whether it may be done, or you have consent from someone who is.

That definition is the whole job of the authorisation letter. The person signing must be entitled to consent for every system in scope, which rules out some enthusiastic IT managers and every asset the client does not control: its SaaS providers, a supplier's API, shared hosting. Our penetration test authorisation letter template covers who can sign and what the letter must name.

The King's Speech on 13 May 2026 announced that the Act would be reformed, and in September 2026 a minister said the changes would come as soon as parliamentary time allows. As of October 2026 the law has not changed, and no defence for security research will make a signed letter less necessary for paid work. The Act also rules out one sales tactic: testing a prospect's website uninvited to show them what you found is unauthorised access, not marketing.

Certifications buyers ask for

For individuals, UK buyers most often name CREST and OffSec. CREST's penetration testing exams run from the Practitioner Security Analyst (CPSA) through the Registered Penetration Tester (CRT) to the Certified Tester exams in infrastructure and application (CCT INF and CCT APP). OSCP is widely recognised; passes since 1 November 2024 are issued as OSCP+, which expires after three years, while earlier OSCPs stay valid for life. The UK Cyber Security Council's Security Testing titles matter more each year, because CHECK now relies on them.

For the company, Cyber Essentials comes first. Under procurement policy note PPN 014, in effect from 24 February 2025, central government buyers apply it to contracts involving personal information or systems that handle OFFICIAL data, and plenty of private buyers have copied the question into their supplier forms. It is the cheapest credibility you will buy.

CHECK is not a first-year option. The NCSC asks for at least two penetration test reports carried out under the company's name, Cyber Essentials Plus on every system that stores or processes engagement information, a team eligible for SC clearance, and a Team Leader with a Security Testing title at Principal level or above. Our comparison of CHECK and CREST covers which your market needs.

A method and a report before the first client

The first serious question a buyer asks is whether they can see a sample report, and at launch the honest answer is usually no. Fix that before you need it.

1. Write the method. One page per type of test you sell: what you cover and in what order, what you will not do without agreement, what happens when you find something critical mid-test. Map web work to the OWASP Web Security Testing Guide and mobile work to MASVS so a buyer can check it against something public.
2. Fix a severity scale. Choose CVSS 3.1 or 4.0, decide how scores map to your levels and when you depart from them. Our guide to penetration testing severity levels has a starting table.
3. Build a sample report. Test a deliberately vulnerable application in your own lab and write it up for a fictional client, with an executive summary, scope, method, evidenced findings, remediation and a retest section. Starting from a free report template saves the formatting days.
4. Arrange review. A report checked only by its author has not been reviewed: swap reviews with another independent tester under a mutual NDA.

Where first clients come from

Rarely from a website in year one. First clients come from people who have seen your work, or who trust someone who has.

• People you have tested for or with. Developers, IT managers and security leads move jobs and take their opinions with them. Tell them you have started.
• Your former employer's clients, carefully. Many employment contracts in this industry carry non-solicitation clauses. Read yours before contacting anyone, and take nothing from your old firm's systems.
• Associate work for other consultancies. Steady days under someone else's name while you build your own, and a close look at how other firms report.
• IT support firms and MSPs. Their customers ask them for tests, and most would rather refer or resell than hire a tester.
• Compliance deadlines. SaaS companies facing an enterprise customer's questionnaire, merchants under PCI DSS, firms preparing for ISO 27001: they need a credible report by a date, and a small firm that answers the phone has an advantage.

Tooling on a solo budget

The tooling bill is smaller than the paperwork bill. Most infrastructure and Active Directory work runs on free and open-source tools, so spend where money saves days: a dedicated testing laptop with full-disk encryption, a cloud server with a fixed IP address for external work so clients can allowlist you and their monitoring can tell you from an attacker, and a password vault with a separate collection for each client's credentials. Check licences, because several free editions of commercial tools forbid commercial use.

Client data from day one

From the first engagement you will hold another organisation's weaknesses: findings, screenshots of live data, working credentials and network maps. Decide where that lives before the first client sends anything.

• One place, not five. Not a personal cloud drive or email threads. Wherever engagement data lives, it needs multi-factor authentication, encryption and a short list of who can reach it.
• Credentials end with the engagement. Delete them at the end and ask the client, in writing, to revoke the accounts.
• Register and contract. Unless you are exempt, pay the data protection fee to the Information Commission, which replaced the Information Commissioner's Office on 30 September 2026. Have a data processing agreement ready, because the first corporate client will ask for one; our guide to UK GDPR for penetration testing firms covers what it should say.