In-House vs Outsourced Penetration Testing Is the Wrong Question

Framing in-house vs outsourced penetration testing as a single choice is where most businesses go wrong. Here is the honest answer for most UK organisations: outsource the test itself. Do not outsource what happens after it. Keep remediation and follow-up in house. Bring in an independent tester only for the part that truly needs independence. Treat this as an either-or decision, and you end up in one of two bad places. Either you overspend on a team with too little work to do, or you underinvest and skip testing altogether.

Why the either-or framing is misleading

A penetration test is not your whole security programme. It is one input, run now and then, that checks whether your everyday defences hold up against a skilled attacker. The National Cyber Security Centre is explicit about this in its guidance on penetration testing. It describes the technique as a way to check and improve your own internal processes, not replace them.

That framing matters. It means the real question is not “who runs the test”, but “who owns fixing what the test finds”. Those can be, and often should be, two different answers.

Why full in-house rarely earns its keep

Building a dedicated internal offensive security team costs more than most people expect. Add up salary, National Insurance, pension, training and tooling licences, and one experienced UK hire typically costs well into six figures. One person cannot cover the role alone, either. Once you account for holiday and sick leave, you need at least two.

It is also hard to fill. Government research into the Cyber Security Skills in the UK Labour Market found that most cyber job postings ask for two to six years of experience. That narrows an already small pool. The same research found that around a fifth of UK businesses report a skills gap specifically in penetration testing. Unless your organisation has enough testing work to keep a permanent team busy every week, that fixed cost mostly buys idle time.

Why fully outsourced, with no internal ownership, also fails

The opposite mistake is treating an outsourced test as a once-a-year box to tick. You commission it, receive a report, then file it away. But a report nobody owns is close to worthless. The value of a penetration test sits in what changes afterwards, not in the exercise itself.

This is where a purely transactional relationship with an external provider breaks down. Someone inside the organisation needs to own triage. They need to prioritise the fixes and track them through to a retest. Outsource the testing by all means. Just never outsource that accountability.

What UK businesses are actually doing supports this middle path

The government’s Cyber Security Breaches Survey 2025/2026 found that only 13% of UK businesses had run a penetration test in the previous year. Yet medium-sized businesses lean heavily on external cyber security advice: 51% name an external provider as their main source, against 24% of micro businesses. In effect, businesses are already buying in the specialist testing while keeping day-to-day security decisions internal. That split is not an accident. It reflects where independence adds real value, and where local knowledge does instead.

How to structure the hybrid model in practice

In practice, this usually means three things working together. First, a named internal owner responsible for acting on findings, even if security is only part of their role. Second, a scoped, independent penetration test, run on a set schedule and after any significant change, by a provider with no stake in how the system was built. Third, a clear retest step, so fixes get verified rather than assumed.

Some businesses go further and treat testing as closer to continuous than annual. That changes the economics again. We cover that trade-off in our guide to penetration testing as a service versus traditional testing. It is worth reading once you have settled this question and are deciding on frequency next.

Whoever you commission, the quality of the test rests on the quality of their process. Our buyer’s guide to penetration testing methodology lists the questions worth putting to any provider before you sign.

Aardwolf Security runs independent, scoped penetration testing for UK businesses that want exactly this kind of arrangement. You get a genuine external test, paired with a report your own team can act on. If that sounds like what you need, get in touch and we can talk through the scope.

What this looks like for a small security function

Picture a business with one person carrying security responsibility alongside other IT duties. That describes a large share of UK small and mid-sized organisations. That person is not going to become a full penetration tester on top of everything else, and should not try to. Their job in this model is different. Agree the scope with an external provider. Receive the findings. Decide what gets fixed first, based on real business risk. Confirm the fix actually worked.

None of that requires offensive security skills. It requires judgement about your own systems, and enough authority to get a development team to prioritise a fix over a new feature. That is exactly the local knowledge an outsourced tester cannot bring on their own. The two roles complement each other because they are different skills.

Larger organisations can scale the same pattern up rather than replace it. A slightly bigger internal team owns triage and coordination across several product lines. It still commissions independent testing for the parts that need a genuinely external eye. The structure holds even as headcount grows. It also avoids a common failure mode: a growing security team quietly starts testing its own systems, simply because it now has the skill to do so, and loses the independence that made the arrangement useful in the first place.

Frequently asked questions

So is in-house vs outsourced penetration testing really a false choice?

Largely, yes. Most organisations benefit from outsourcing the test itself, for independence and breadth. They do better keeping ownership of remediation and follow-up internal, rather than picking one model for everything.

What should stay internal even if testing is outsourced?

Triage of findings, prioritisation against business risk, and tracking fixes through to a retest. An external provider can advise on all of this, but accountability works better sitting inside the organisation.

Does a hybrid approach cost more than picking one model?

Not usually. The internal side of a hybrid model can often be a part-time responsibility, not a dedicated hire. That keeps the fixed cost far below a full in-house testing team.

How often should the outsourced part of this happen?

At minimum, annually, and after any significant change to your systems. Businesses with frequent releases often move toward a more continuous testing arrangement instead of a single yearly engagement.

Is it a problem if the provider running the test also helps with remediation advice?

Not inherently, as long as the testing itself remains independent of the team that built the system. Keep the accountability for actually implementing fixes with your own staff, regardless of who advises on them.