Penetration Testing for Estate Agents: What UK Property Firms Should Test

Penetration testing for estate agents is a controlled attack on your systems by a qualified tester, run to find the weak points before a criminal does. For a property firm, that means testing the places where client data and client money meet: your email, your CRM, your website and the logins your staff use every day.

Agents rarely think of themselves as a cyber target. The figures say otherwise, and the cost of getting it wrong lands on buyers, sellers and landlords as well as on you.

Why are estate agents a target for cyber attacks?

Property firms hold a lot of valuable detail. A single agency can have passports, driving licences, bank details, mortgage information and tenancy records on file. Criminals can use that data for identity theft, ransomware or resale.

The trend is upward. According to Insurance Business, reported attacks on UK property services businesses rose 17% in the year to 31 December 2025, from 178 incidents to 208. The report credits the Information Commissioner’s Office as the source and Karis Insurance for the analysis.

Ravi Sejpal of Karis put the problem simply: property businesses “hold just as much detail about their client base as a bank would”. Few have bank-level security to match.

What does payment diversion fraud have to do with it?

This is the attack that hurts most. Criminals break into an email account, read the conversation between buyer, seller, solicitor and agent, then step in near completion with new bank details.

City of London Police and Action Fraud recorded 143 conveyancing fraud cases between April 2024 and March 2025. Losses came to £11.7 million, an average of £78,393 per case. Lloyds Bank has reported average losses of £47,000 for victims it has seen.

The attacker often only needs one compromised mailbox. That could be yours. A tester can check whether your email set-up lets that happen.

What does a penetration test of an estate agency cover?

The National Cyber Security Centre describes a penetration test as a way of gaining assurance in the security of an IT system by trying to breach it with the tools and techniques an attacker might use. For a typical agency, the scope often includes:

• Email and Microsoft 365 or Google Workspace. Weak sign-in rules, missing multi-factor authentication and risky forwarding rules are common ways in.
• Your external network. Anything facing the internet, such as remote access, firewalls and old servers. This is what an external network penetration test looks at.
• Your website and portals. Valuation forms, tenant logins and landlord dashboards all take personal data.
• Your CRM and property management software. Testers check who can see which records, and whether one stolen password opens everything.
• Staff and phone-based tricks. A phishing simulation shows how many people would click a fake portal login.
• Branch Wi-Fi and devices. Shared office networks and laptops that travel between viewings.

How is it different from a vulnerability scan?

Because the two get mixed up, here is the difference. A scan is automated and finds known flaws. A penetration test adds a human who chains those flaws together, the way a real attacker would. The NCSC also notes that a test only shows your position on the day it runs. Tests are often a year or more apart, so you still need regular patching in between.

How often should penetration testing for estate agents happen?

Once a year is a sensible baseline for penetration testing for estate agents. Test again after a big change, such as moving to a new CRM, opening a branch or switching email platforms. If you have been told about a breach at a supplier, check your own exposure too.

Does insurance cover a cyber attack on an estate agency?

Do not assume it does. Paul Offley, compliance officer at The Guild of Property Professionals, has warned agents that professional indemnity insurers have stopped covering cyber, so cover is largely excluded from PI policies. Separate cyber insurance is the usual answer. Insurers often ask what testing you have done, which is covered in our guide on cyber insurance and penetration testing.

What should penetration testing for estate agents cost?

There is no fixed price, because the work depends on scope. The main factors are how many systems are in scope, how many branches you run and how deep the test goes. The NCSC notes that testing time is usually quoted in resource days, so a tight scope means a smaller bill. Because of that, ask every provider for a written scope and a fixed quote before you agree anything. Our guide to Cyber Essentials and penetration testing can also help you decide what to buy first.

What should the report tell you?

A good report is written for the person who has to act on it. Expect a short summary for the owner or director, then a list of findings ranked by risk. Each finding should say what was found, how it could be abused and how to fix it. For an agency, that might read as “any member of staff can log in from abroad with no second step” rather than a wall of technical output. If you cannot explain the top three findings to your branch managers after reading the report, ask the tester to rewrite it.

What can you do before a test?

Some quick wins are worth doing now, so the tester spends time on harder problems. Turn on multi-factor authentication for every mailbox. Remove accounts for staff who have left, and check who can see client records. Also agree a rule that bank details are never changed on the strength of an email alone. Staff should call a known number first, every time. Penetration testing for estate agents works best when these basics are already in place, because the tester can then focus on subtler weaknesses.

Finally, tell your IT provider and any software suppliers about the test. They may need to allow the testing traffic, and they will want to know whether the results touch their systems.

How do you get the most from a test?

1. Set the scope first. List your systems, branches and suppliers. The NCSC advises involving risk owners and the technical staff who know the systems.
2. Name a contact. Someone needs to be reachable if the tester finds something urgent.
3. Ask for a plain report. You want findings ranked by risk, with clear fixes your IT provider can act on.
4. Retest. But fixing a problem is only half the job. Confirm the fix works.
5. Brief your team. Staff who know about fake invoices and changed bank details stop most of these attacks before any system fails.

If you would like a scoped test for your agency, Aardwolf Security offers UK penetration testing sized for smaller firms, and you can get in touch to talk it through.

Frequently asked questions

Is penetration testing a legal requirement for estate agents?

No. Agents are not directly regulated for cyber security in the way banks are. But you still hold personal data, so data protection law expects you to keep it secure. Testing is one way to show you have taken that seriously.

Will testing disrupt viewings and daily work?

Rarely. Most work happens in the background, and risky actions can be agreed in advance or run out of hours.

Can a small agency with one branch benefit?

Yes. A single mailbox compromise can divert a completion payment, whatever your size. A narrow scope focused on email and external systems keeps the effort sensible. Our piece on whether small businesses need penetration testing goes into more detail.

What should I do if a client says they were sent fake bank details?

Tell them to call their bank straight away on a number they trust and report it to Action Fraud. Then check your own mailboxes for unusual rules or sign-ins.