Ryvx

If you have asked two security firms to quote for testing your website, you have probably had two very different numbers back. This guide explains how UK pricing works, what drives it, and how to tell which kind of test you need.

Most firms charge by the day

A traditional penetration test is priced in tester days. Published UK guides for 2026 put the day rate for an accredited tester at roughly £900 to £1,800, with most figures between £1,000 and £1,400. The firm estimates how many days your site needs, multiplies, and adds VAT.

A small business website or a simple web app is usually scoped at 3 to 5 days. That puts a typical quote somewhere around £3,000 to £7,000 before VAT. A larger app with several user roles, an API and a payment flow can run to 10 days or more, and the same guides quote £10,000 and up for that kind of work.

What moves the price

Size matters less than you might think. A 200-page brochure site with no logins is quicker to test than a 10-page app where customers sign in, upload files and pay. The things that add days are logins and user roles, forms that store data, APIs, payment and checkout flows, and anything built specially for you rather than off the shelf.

Check whether the quote includes a retest. Some firms charge separately to confirm your fixes worked, and that can add a third or more to the bill.

When you need a full manual test

Some situations call for a full manual penetration test from an accredited firm, whatever it costs. If a contract, a regulator or a payment card standard names a specific kind of test or accreditation, buy exactly that. Ask the person requesting it what they will accept before you spend anything.

Many small businesses are not in that position. They want to know their website is not an easy target before a launch, after a redesign, or because an insurer or a customer asked whether it has been tested. For that, a multi-day manual test can be more than the job needs.

What Ryvx costs

A Ryvx Launch Security Review is £495 per site, fixed. Our AI testing tools work through your site the way an attacker would, and every finding has to come with working proof before it reaches the report. A person checks the report before you see it. You get it within 3 to 5 working days, with a plain summary for directors and full detail for your developer, and we retest once after you fix things.

Ryvx is not CREST accredited, and a review is not a replacement for a full manual penetration test where a contract or regulator requires one. No test can prove a site is secure. What you get is a dated report, with proof, that shows what was tested and what was found.

Not sure where you stand? The free website health check takes a read-only look at the basics on a site you own, and it shows you what a deeper test would add.