What is a Penetration Test? A Plain-English Guide for UK SMEs
You've heard you should get a penetration test. Maybe a client asked for one. Maybe your insurer mentioned it. Maybe you read something about NIS2 and vulnerability management.
But what does a penetration test actually involve? How long does it take? How much does it cost? And do you actually need one?
This guide answers all of those questions in plain English — no jargon, no sales pitch.
What is a Penetration Test?
A penetration test (or "pentest") is a controlled, authorised attempt to hack into your systems — carried out by a security professional before a real attacker gets the chance to do it for free.
The goal is simple: find the weaknesses in your network, applications, or infrastructure before someone with bad intentions does. Then fix them.
Think of it like hiring a locksmith to try to break into your house — not to rob you, but to tell you which locks need replacing.
Penetration Test vs Vulnerability Scan — What's the Difference?
A vulnerability scan is automated. Software checks your systems against a database of known weaknesses and produces a list. Fast, cheap, but surface-level.
A penetration test is manual. A human tester actively tries to exploit vulnerabilities — chaining them together the way a real attacker would. It finds what automated tools miss.
What Does a Penetration Test Actually Involve?
A typical pentest for a small or medium business follows four phases:
Phase 1 — Reconnaissance
The tester maps your external attack surface: domains, IP addresses, open ports, public-facing services. This is what an attacker sees before they even try to get in.
Phase 2 — Scanning & Enumeration
Tools like Nmap identify running services, software versions, and potential entry points. The tester builds a picture of your infrastructure — looking for anything outdated, misconfigured, or exposed.
Phase 3 — Exploitation
This is the actual "hacking" phase. The tester attempts to exploit vulnerabilities to gain unauthorised access — escalate privileges, move laterally through the network, or access sensitive data. Everything is documented in real time.
Phase 4 — Reporting
You receive two deliverables: an executive summary (for management) and a technical report (for your IT team). Every finding is rated by severity, explained in plain language, and accompanied by a recommended fix.
Types of Penetration Tests
| Type | What it tests | Best for |
|---|---|---|
| Network Pentest | Internal and external network infrastructure | Most SMEs — good starting point |
| Web Application Pentest | Websites, web apps, APIs | eCommerce, SaaS, customer portals |
| Wireless Pentest | WiFi networks and access points | Offices with guest WiFi or BYOD |
| Social Engineering | Phishing, pretexting, staff awareness | Businesses with non-technical staff |
| Physical Pentest | Physical access controls | Data centres, server rooms |
How Much Does a Penetration Test Cost in the UK?
Costs vary significantly depending on scope and provider:
| Scope | Typical Cost (UK) | Duration |
|---|---|---|
| Small network (up to 20 hosts) | £800 – £2,000 | 1–2 days |
| Medium network (20–100 hosts) | £2,000 – £5,000 | 3–5 days |
| Web application (single app) | £1,500 – £4,000 | 2–4 days |
| Full infrastructure (network + web) | £4,000 – £10,000 | 5–10 days |
Do You Actually Need a Penetration Test?
You likely need one if any of the following apply:
- A client, partner, or insurer has asked for evidence of security testing
- You process sensitive customer data (financial, medical, personal)
- You operate in a regulated sector (finance, healthcare, legal)
- You're pursuing NIS2 compliance — Article 21 requires vulnerability handling and testing
- You've never had one and your business has been operating for more than a year
- You've recently made significant changes to your infrastructure
Penetration Testing and NIS2
NIS2 Article 21 requires organisations to implement "vulnerability handling and disclosure" as part of their security measures. While the directive doesn't mandate annual pentests by name, regulators and auditors increasingly expect them as evidence of a mature security programme.
For UK businesses supplying EU entities, a documented penetration test — with remediation evidence — is often requested as part of supplier due diligence.
Frequently Asked Questions
Will a pentest take my systems offline?
A professionally conducted pentest should not cause downtime. Your tester will agree a scope and rules of engagement in advance, including which systems are in scope and what actions are permitted.
How often should I get a penetration test?
Most SMEs should aim for an annual test, with additional tests after major infrastructure changes, new application deployments, or security incidents.
What's the difference between black box, grey box, and white box testing?
Black box — tester has no prior knowledge of your systems (simulates an external attacker). Grey box — tester has partial knowledge (simulates a compromised account or insider threat). White box — tester has full access to documentation, source code, and credentials (most thorough, best value for money).
Do I need to fix everything in the report?
Not necessarily — findings are rated by severity (Critical, High, Medium, Low). Critical and High findings should be remediated immediately. Medium and Low findings can be scheduled and risk-accepted where appropriate.
Ready to find out what attackers would find?
Fifth Ace delivers penetration testing and NIS2 compliance audits for UK businesses with 10 to 100 employees. Fixed price. Plain-English reports. No corporate overhead.
Get a Quote →Download our free NIS2 Readiness Checklist
Not sure where to start with NIS2? Take our free 5-minute self-assessment and get the PDF checklist straight to your inbox.
Download our free NIS2 Readiness Checklist →