What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For many UK cybersecurity consultancy and security-testing roles, published public-sector rate cards offer a practical benchmark of roughly £900–£1,500 per day. The rate depends on the service, seniority and scope: published examples range from £880 a day for a Level 4 consultant to £1,600 a day for red-team work or incident response and forensics. These are supplier-listed prices, not a single UK market tariff.
UK cybersecurity day-rate benchmarks
The clearest comparable public prices in the available examples are G-Cloud 14 supplier rate cards published in 2024. They show why it helps to compare like with like: an advisory role, a penetration test and an incident-response engagement are different services, even when prices are expressed per day.
As an Amazon Associate I earn from qualifying purchases.
| Service or role | Published rate | What the figure represents |
|---|---|---|
| Consultant, SFIA Level 4 | £880 per day | Akhter Computers Limited / Cyberfort Security Testing role-based G-Cloud 14 card, published in 2024. The card says exact pricing can depend on project complexity and commercial discount; its listed prices exclude VAT. |
| Check Team Member, SFIA Level 5 | £1,100 per day | Akhter Computers Limited / Cyberfort Security Testing role-based G-Cloud 14 card, published in 2024. |
| Check Team Leader, SFIA Level 6 | £1,210 per day | Akhter Computers Limited / Cyberfort Security Testing role-based G-Cloud 14 card, published in 2024. |
| Specialist Managing Cyber Consultant, SFIA Level 7 | £1,375 per day | Akhter Computers Limited / Cyberfort Security Testing role-based G-Cloud 14 card, published in 2024. |
| CREST penetration testing | £1,000 per day | A separate G-Cloud 14 supplier service rate card, published in 2024. |
| Cyber security and information assurance consultancy | £1,200 per day | A separate G-Cloud 14 supplier service rate card, published in 2024. |
| Red-team engagement; incident response and forensics | £1,600 per day | A separate G-Cloud 14 supplier service rate card, published in 2024. |
| Data security consultant | £425–£1,480 per day | TMC3 Limited’s supplier-specific G-Cloud 14 listing. Its broad band is not a market-wide range. |
| Central-government CHECK/CREST testing | £750–£1,500 per day | Advent IM’s G-Cloud 14 listing. |
Other examples on the separate 2024 G-Cloud 14 service card include £1,100 per day for NCSC CHECK health checks and social engineering, and £1,200 per day for technical information-security auditing, ISO 27001 consultancy, PCI-DSS consultancy and trusted advisory. Another G-Cloud 14 application-security pricing document lists a senior consultant at £1,500 per day and defines a working day as eight hours excluding travel and lunch.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat to expect for penetration testing
For penetration testing specifically, a September 2026 index of 30 published UK public-sector G-Cloud 14 rate cards reports a £1,000 median day rate, with a central band of £800–£1,200 and a full published spread of £480–£1,600. This is a benchmark of listed penetration-testing rates, not a survey of all UK consultancy transactions, and should not be applied to every cybersecurity service.
#1 Best Overall
Project fees can differ substantially even when comparing the same broad type of test. Stingrai’s September 2026 index reports published fixed prices of £3,750–£18,000 for a single web-application penetration test. The listed scopes run from 3–5 days to 6–12 days, so the totals are not interchangeable without checking what is tested and delivered. A day rate is not the project price.
Why one supplier’s rate can differ from another
- Service type: strategic advice, assurance, penetration testing, red-team work and incident response require different work and should be compared in separate groups.
- Role and seniority: the role-based 2024 rate card rises from £880 for a Level 4 consultant to £1,375 for a Level 7 specialist managing cyber consultant.
- Scope and effort: systems, applications, environments, workshops, reporting and retesting affect the days required. A narrow assignment is not comparable to a broad one.
- Required assurance: CHECK or CREST status, clearance, specialist experience and a named lead may affect which people can perform the work.
- Pricing basis and terms: a framework list rate, fixed-price package and negotiated commercial quote are not the same thing. Some suppliers may offer discounts for combined services or volume.
Public G-Cloud prices are useful reference points because they are published and unit-priced. They do not establish a representative average for privately negotiated contracts, freelancers, every UK region or every industry. A low price does not by itself prove poor quality, and a high price does not prove better quality; assess the credentials and assurance required for the defined work.
Rank #2
How to compare quotes fairly
Ask each supplier to answer the same questions in writing. That makes it easier to tell whether a lower day rate reflects a genuine saving or a narrower offer.
Quick Recap
- Define the work product and scope. List the systems, cloud environments, applications, hosts, tests and workshops involved. Specify expected deliverables and whether retesting or remediation support is included.
- Identify the people required. Ask for each consultant’s level and profile, plus any required CHECK or CREST status, clearance, specialist experience or named lead.
- Confirm billable days and follow-up. Ask whether discovery, reporting and follow-up are included in the quoted days, and what additional days cost.
- Check the working-day definition. Confirm the number of hours and whether travel time is billable. One 2024 G-Cloud 14 supplier card defines a working day as eight hours exclusive of travel and lunch; do not assume every supplier uses that definition.
- Get expenses and tax in writing. Confirm whether VAT, travel, mileage, subsistence and other expenses are included, and check the insurance terms. Supplier cards differ: one includes travel within the M25, charges travel outside it at department rates and includes professional indemnity insurance, while the Akhter/Cyberfort document says its prices exclude VAT.
- Clarify how the price was set. Ask whether it is a framework list price, a fixed-fee package or a negotiated commercial quote, and whether volume or bundled-work discounts apply.
- For a fixed fee, compare equivalent scope and days. Do not estimate the project total by multiplying a headline day rate alone; compare the work covered, duration, reporting and retest terms.
Sources and pricing context
- G-Cloud 14 service rate card with service-specific examples, including penetration testing, consultancy, red-team work and incident response.
- Akhter Computers Limited / Cyberfort Security Testing pricing, including SFIA-level rates and pricing terms.
- TMC3 Limited Data Security Consultant listing.
- Advent IM central-government CHECK/CREST testing listing.
- FullProxy application-security pricing document.
- Stingrai’s September 2026 UK penetration-testing rate-card index and published project-price examples.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
