Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For many UK cybersecurity consultancy and security-testing roles, public rate cards show day rates of roughly £900–£1,500. The right comparison depends on the work: a 2026 index of public-sector penetration-testing cards puts that category’s median at £1,000 per day, while supplier examples for red-team work and incident response reach £1,600. These are published supplier prices, not a fixed UK-wide tariff or a reliable average for private contracts.
What do UK cybersecurity consultants charge per day?
There is no single UK day rate that fits every cyber security consultant. Public G-Cloud 14 rate cards published in 2024 show substantial variation by role and service. A 2026 index of 30 G-Cloud 14 penetration-testing rate cards offers a more focused benchmark for that particular service: a £1,000 median, a central band of £800–£1,200, and a full published spread of £480–£1,600. The index covers published public-sector rates, not all UK consultancy transactions or privately negotiated contracts. Stingrai’s 2026 penetration-testing index.
| Service or role | Published price | What the figure represents |
|---|---|---|
| Penetration testing | £1,000 per day median; £800–£1,200 central band | 2026 index of 30 UK public-sector G-Cloud 14 rate cards; full published spread £480–£1,600. Source. |
| CREST penetration testing | £1,000 per day | Supplier-listed G-Cloud 14 service price, published in 2024. Source. |
| Cyber security and information assurance consultancy | £1,200 per day | Supplier-listed G-Cloud 14 service price, published in 2024. Source. |
| Red-team engagement; incident response and forensics | £1,600 per day | Supplier-listed G-Cloud 14 service prices, published in 2024. Source. |
| Cyber testing roles by SFIA level | £880–£1,375 per day | Akhter Computers Limited / Cyberfort Security Testing G-Cloud 14 role card: Level 4 consultant £880; Level 5 Check Team Member £1,100; Level 6 Check Team Leader £1,210; Level 7 Specialist Managing Cyber Consultant £1,375. Listed prices exclude VAT. Source. |
| Data security consultant | £425–£1,480 per day | TMC3 Limited’s supplier-specific G-Cloud 14 listing. Source. |
| Central-government CHECK/CREST testing | £750–£1,500 per day | Advent IM’s G-Cloud 14 listing. Source. |
| Senior application-security consultant | £1,500 per day | FullProxy’s G-Cloud 14 application-security pricing document, published in 2024. It defines a working day as eight hours excluding travel and lunch. Source. |
Why rates differ by type of work
A penetration test, strategic advisory assignment, assurance review, red-team exercise and incident response engagement are different services. Their day rates should not be treated as interchangeable. The same G-Cloud 14 supplier card that lists CREST penetration testing at £1,000 per day gives rates of £1,100 for NCSC CHECK health checks and social engineering, and £1,200 for technical information-security auditing, ISO 27001 consultancy, PCI-DSS consultancy and trusted advisory. Red-team work and incident response/forensics are listed at £1,600 per day. Supplier rate card.
Role and seniority also matter. On the Akhter Computers Limited / Cyberfort card, the listed rate rises from £880 for a Level 4 consultant to £1,375 for a Level 7 specialist managing cyber consultant. That is a supplier’s role-based schedule, not evidence that every consultant at a given level will charge the same amount. The supplier says final pricing depends on project complexity and may reflect a commercial discount. Role card and pricing document.
#1 Best Overall
A wide range can also reflect scope, inclusions, and pricing format. TMC3’s £425–£1,480 per-day band is specific to its data-security consultant listing; it is not a low-to-high range for the whole UK market. Likewise, a framework list price, a fixed-fee package and a negotiated commercial quote are not directly equivalent.
What might a penetration test cost as a project?
A day rate is not a project price: the total also depends on how many days the agreed scope requires and what is included. Stingrai’s 2026 index reports published fixed prices of £3,750–£18,000 for a single web-application penetration test, with listed scopes ranging from 3–5 days to 6–12 days. Those figures illustrate why a quote is meaningful only alongside the defined test scope and duration; they are published supplier examples, not a universal price for every web application. Index and fixed-price examples.
Rank #2
For a fixed-fee quote, compare which applications, hosts, environments and tests are covered, the number of days allocated, and whether reporting, retesting and remediation support are included. A test of one defined application is not comparable to a wider engagement simply because both are described as a penetration test.
How to compare cybersecurity consultancy quotes
Ask every supplier to price the same work and state the same commercial terms. Use this checklist before comparing headline figures:
- Define the work product and scope. List the systems, cloud environments, applications and hosts in scope, along with tests, workshops, deliverables, retesting and any remediation support.
- Identify the people required. Confirm each consultant’s level and profile, including any required CHECK or CREST status, security clearance, specialist experience or named lead.
- Confirm billable days and follow-up. Ask whether discovery, reporting and follow-up count toward the quoted days, and what additional days cost.
- Specify the working day and travel treatment. Ask how many hours constitute a day and whether travel time is billable. One G-Cloud 14 rate card defines a consultant’s working day as “8 hours exclusive of travel and lunch.” Supplier rate card.
- Check VAT and expenses. Get written confirmation of VAT, travel, mileage, subsistence, other expenses and insurance. The Akhter/Cyberfort document says its listed prices exclude VAT; another G-Cloud card includes travel within the M25, charges travel outside it at department rates, and includes professional indemnity insurance. Terms vary by supplier. Akhter/Cyberfort pricing document; Supplier rate card.
- Ask what kind of price you are seeing. Establish whether it is a framework list price, a fixed-fee package or a negotiated commercial quote, and whether complexity, bundled work or volume changes the price. The Akhter/Cyberfort document notes that combined services can be packaged and that complexity and commercial discounts can affect final pricing. Pricing document.
How to use these figures when budgeting
- For a public-sector penetration-testing comparison, £1,000 per day is a useful 2026 midpoint benchmark from the published G-Cloud 14 index; its central band is £800–£1,200. Do not apply that benchmark automatically to advisory, incident response or every private-sector engagement.
- For other services, begin with rate cards for the same work type and level. Supplier examples include a £1,200 daily rate for cyber security and information assurance consultancy and £1,600 for red-team work and incident response/forensics.
- Use the total scoped fee as well as the day rate when budgeting. A lower daily rate can produce a higher project cost if the work takes more days or key deliverables are excluded.
- Do not infer quality from price alone. Match the required credentials and assurance to the work, then compare scope and terms on an equivalent basis.
The public cards cited here are supplier-specific G-Cloud 14 listings published in 2024, while the penetration-testing index was published in September 2026. Together they support published-price comparisons in those categories, but do not establish a representative rate for freelancers, privately negotiated consultancy, every UK region or every industry. Check the supplier’s current listing and written quote before committing, since rates and terms can change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
