Do You Need a Penetration Test? A Plain Guide for UK Businesses

Do you need a penetration test? Usually yes, if you hold customer data, sell online, or answer to a regulator, a customer or an insurer. The law rarely says “you must”, but the rules around you often do. This guide shows which situations make a test a requirement, which make it a good idea, and which mean you can wait.

What is a penetration test, in one minute?

A penetration test is a controlled attack on your own systems. A skilled tester tries to break in the way a criminal would, then tells you what worked and how to fix it. You get a report, not a risk score from a tool.

That is different from a vulnerability scan, which is an automated sweep for known flaws. Our guide on penetration testing vs vulnerability scanning covers the gap in detail. For now, remember that a scan lists problems, while a test shows which ones an attacker can actually use.

Is a penetration test a legal requirement in the UK?

No single UK law makes every business get one. Some rules come close, though.

• UK GDPR: The ICO says the law “specifically requires you to have a process for regularly testing, assessing and evaluating the effectiveness” of your security measures. It names penetration testing and vulnerability scanning as ways to do that. It does not set a type of test or a frequency.
• PCI DSS: If you take card payments and handle card data, the standard asks for internal and external penetration testing at least once a year and after significant changes. This is the closest thing to a hard rule.
• Government and critical infrastructure: The NCSC runs the CHECK scheme for testing central government, public sector and critical national infrastructure systems. Private firms are not required to use a CHECK provider.

So the honest answer is mixed. Card handlers have a clear obligation. Everyone else has a general duty to test, and a test is the most convincing way to show you did.

Do you need a penetration test for Cyber Essentials?

Not for basic Cyber Essentials, and not strictly for Cyber Essentials Plus either. The NCSC describes Plus as independent technical testing that checks your controls work in practice. That is a narrow audit of five control areas, not an attempt to break in.

Many firms treat the two as a pair. Cyber Essentials proves the basics are in place. A penetration test shows what an attacker can do when the basics are not enough. We explain how they fit together in Cyber Essentials and penetration testing.

When do customers and insurers say you need a penetration test?

This is where most firms actually meet the question of whether they need a penetration test. Nobody passes a law, but a buyer sends a security questionnaire and one line reads “date of last independent penetration test”.

Common triggers include:

• A large customer or public sector tender asking for a recent test report.
• A cyber insurance renewal form that asks about testing.
• A supplier due diligence process before you handle someone else’s data.
• Standards such as ISO 27001 or SOC 2, where auditors expect evidence that you test your security.

If you are losing deals or paying more for cover because you cannot answer that question, you have your answer.

What changes in your business should trigger a test?

Time is not the only reason to test. Change is the bigger one. The NCSC points out that a test can only confirm that systems are not vulnerable to known issues on the day it runs. A new system introduces new problems, so test when you:

• launch a new website, web application, customer portal or API;
• move systems to the cloud or change your hosting;
• merge with another company and join two networks together;
• add remote access, a new VPN or a new wireless network;
• suffer an incident and want to know what else is exposed.

Our post on how often you should test gives more on timing.

Does a small business need a penetration test?

Often, yes, although the scope is smaller. A small firm may still need a penetration test for its website and email. Attackers do not check your headcount before they scan your website. Small firms also tend to have fewer people watching the systems, so a flaw can sit open for months.

A small business should spend its money where the risk sits: the website, the login page for staff email, and any system that holds customer data. We cover the cost-and-benefit side in our take on small businesses and security testing.

When can you safely wait?

Not every organisation needs a test this quarter. You can reasonably hold off if:

• you have no internet-facing systems and hold little sensitive data;
• basic controls such as patching, multi-factor authentication and backups are not yet in place, since a test would only list the obvious;
• nobody is asking, and nothing has changed in the last year.

In that case, fix the basics first. A test is an expensive way to learn that your patching is behind. The NCSC makes the same point: it frames penetration testing as assurance over your vulnerability management, not the main way to find weaknesses.

What should you ask before you buy one?

Once you decide to go ahead, a good scope matters more than a long report. The NCSC suggests your plan should cover the technical boundaries, test types, timeframe, any scenarios and reporting requirements. Be ready to say what you most want protected.

Ask the provider these questions:

• Who will do the testing, and what are their qualifications?
• Will the report rate each issue and say how to fix it?
• Is a retest included once you have made the fixes?
• How do you handle live systems, so nothing breaks during testing?

Poor scoping is the usual reason a test disappoints. We wrote up the common mistakes in why a weak scope of work costs you later.

Frequently asked questions

Is a penetration test the same as a security audit?

No. An audit checks your policies and controls against a standard. A penetration test checks whether someone can actually get past them.

How much does a penetration test cost?

It depends on scope, mostly the number of systems, applications and days of tester time. A single website costs far less than a full internal network. A fixed quote after a scoping call is the safest route.

Will a test disrupt my business?

A careful tester plans around live systems and agrees hours and limits with you first. The NCSC does note that no test can guarantee it will not cause unexpected effects, which is why scoping and a technical contact on your side matter.

Does a clean report mean we are secure?

No. It means the tester did not find a way in during the agreed window. Treat it as a snapshot and keep patching and monitoring between tests.

Do you need a penetration test now? Your next step

If any of the triggers above sound familiar, a short conversation is the quickest way to find out what you need. Aardwolf Security can offer scoped security testing matched to your actual risk, and you can get in touch with no obligation. Even if you do not, the checklist above is a fair way to decide for yourself.