Penetration testing for UK teams, ready for the questionnaire.
Manual web application and API testing for UK SaaS companies and agencies, priced in pounds, with a report set out for enterprise security reviews, ISO 27001 auditors and supplier questionnaires.
Who asks for testing, and what they want
The reader of a pentest report is rarely the engineer who fixes it. These are the readers we write for in this market.
| Who asks | What they usually look for | What the engagement gives you |
|---|---|---|
| Enterprise customer reviews | A recent independent test, its scope, and evidence that the findings were fixed. | A shareable summary with a fix-status ledger and a dated retest record. |
| Cyber Essentials and Cyber Essentials Plus | Five basic technical controls: firewalls, secure configuration, user access control, malware protection and security updates. Plus adds an independent technical audit. | Neither scheme is a web application pentest. Buyers who ask for both want the application itself tested as well, and that is the work we do. |
| ISO 27001:2022 | Technical vulnerability management (control 8.8) and security testing in development and acceptance (control 8.29). | Testing evidence for your auditor and a record of remediation. It is not a certification. |
| UK GDPR, Article 32 | A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational security measures. | Dated evidence that the application's access controls were tested and that fixes were verified. |
| Public-sector buyers | Some work requires a CHECK company, and some frameworks ask for CREST membership. | ZenoPentest holds neither. If your contract requires them, tell us at scoping and we will say so plainly. |
Not claimed: CREST membership · NCSC CHECK status · Cyber Essentials certification body status. If a contract requires one of these, tell us at scoping.
Prices in pounds sterling
Starting prices for the three packages. Your quote is fixed after a scoping call.
Compare the packagesFocused test
One web application or one API, before a release or a first customer review.
Product test
A multi-tenant SaaS product and its API, for enterprise reviews and audit evidence.
Release programme
Teams that ship every week and answer security reviews all year.
The hours we share
Your morning is our afternoon. The band shows the hours both offices are open, in UK time.
The practical side
- Invoices in pounds
- Invoices in sterling come from Zeno Ventures Pvt. Ltd., an Indian company. For UK business customers, VAT on services bought from abroad is usually accounted for by the customer under the reverse charge. Check with your adviser.
- Shared mornings
- Scoping calls, readouts and urgent-finding escalations are booked in the hours both offices are open: 09:00 to 12:30 UK time in winter, an hour longer in British Summer Time.
- Personal data
- We ask for test accounts, never real customer records. Where evidence could include personal data, the data-handling and transfer terms are agreed in the contract before testing.
- Paperwork before testing
- A statement of work and written authorisation from the system owner come first.
In more detail
What UK buyers usually ask for
UK software companies tend to meet penetration testing through a buyer. An enterprise prospect’s supplier questionnaire asks for a recent independent test. An ISO 27001 auditor asks how technical vulnerabilities are found and fixed. A public-sector framework asks for Cyber Essentials, and the buyer’s security team asks for a pentest as well.
These are different questions, and a good report answers the one in front of you. The summary states the scope, the dates, the method and the result in terms a reviewer can check. The detail gives your engineers the request, the response, the affected roles and a specific fix. After the retest, a new report version records which findings are fixed.
Cyber Essentials is not a pentest
Cyber Essentials is a government-backed scheme that covers five basic controls across an organisation’s devices and networks. Cyber Essentials Plus adds a hands-on technical audit of those controls. Both are useful and often required, but neither tests how your application decides who can see which data.
That is the gap a web application and API test fills. If your buyer has asked for Cyber Essentials and for a penetration test, they want both: your estate checked against the basics, and your product checked against the people who will try to misuse it.
CREST, CHECK and honest fit
Some UK buyers ask for CREST membership, and some government work needs a CHECK company. ZenoPentest does not claim either. Plenty of private-sector reviews care more about the scope, the method and the evidence than about a membership badge, but if your contract names one, it is a requirement, not a preference. Tell us at scoping and we will give you a straight answer.
Data protection
UK GDPR asks controllers and processors to test the effectiveness of their security measures regularly. A pentest provides dated evidence for one important measure, the application’s access controls, and shows that the fixes were verified. It is not a data protection assessment, and we do not present it as one.
We test with accounts and data you create for the purpose. Evidence is kept to what the report needs, and the data-handling terms are in the contract before testing begins.
- Standard international data transfer terms (UK IDTA or addendum)
- Standard payment schedule wording
Questions buyers ask
Are you CREST members or a CHECK company?
No. ZenoPentest does not claim CREST membership or CHECK status. Many private-sector buyers do not require either, and some public-sector work does. Tell us your buyer's requirement at scoping and we will tell you whether we fit.
Is Cyber Essentials Plus the same as a penetration test?
No. Cyber Essentials Plus checks five basic controls across your organisation's devices and networks. A web application pentest checks how your product handles roles, tenants, sessions and its API. Many UK buyers ask for both.
Will the prices include VAT?
Prices exclude VAT. Invoices come from an Indian company, so for UK business customers VAT is usually handled by you under the reverse charge. Your adviser can confirm this for your business.
Can you work to UK hours?
Calls are booked in the shared morning hours. Testing itself does not need you online, apart from a named contact who can be reached if we find something urgent.
Will you work on our contract and data processing terms?
Yes, we review your paper. Data-handling and international transfer terms are agreed before any testing starts; our own standard wording is being finalised.
Why is the sterling price not a straight conversion?
Prices are set for each market so they do not move with exchange rates. The package, the testing days and the report are the same in every currency.
Start with one product.
Tell us what you are shipping and who needs the report. You get scoping questions, then a fixed quote in your currency.