Penetration testing day rate: Gcloud Pentest Rate Card
The Gcloud Pentest Rate Card carries 2 published figures read from 2 sources' own pages, under different breakdowns, so no one range is stated, read 11 November 2026.
2 of the 17 named sources read in full publish a figure; 15 publish none, read 11 November 2026.
By service-type and sfia-level
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| service-type cloud-security-assessment | 1,000 GBP (one figure) | one figure, no range | 1 |
| sfia-level set-strategy-inspire | 1,500 GBP (one figure) | one figure, no range | 1 |
Every figure, with its source
One row per published figure: the figure as the source's own page publishes it, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92301/21947 | 1,500 GBP | set-strategy-inspire | 2026-10-12 |
| Cloud Security Assessment - AWS, Azure, GCP - Digital Marketplace | 1,000 GBP | cloud-security-assessment | 2026-11-11 |
The sentence each figure was read from (2)
- https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92301/21947, read 2026-10-12:
Set Strategy/Inspire £1500 £1500 £1500 £1500 £1500 £1500
- Cloud Security Assessment - AWS, Azure, GCP - Digital Marketplace, read 2026-11-11:
Reduce cost and time to remediate with expert advice £1,000 to £1,500 a unit a day
Read in full, publishes no figure
15 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- CREST Penetration Testing - Digital Marketplace, read 2026-09-12: every candidate on the page was refused
- Cloud Penetration Testing - Digital Marketplace, read 2026-09-12: every candidate on the page was refused
- Continuous Penetration Testing - Digital Marketplace, read 2026-10-12: every candidate on the page was refused
- NCSC CHECK, CREST ITHCs and Penetration Testing, Central Government - Digital Marketplace, read 2026-09-12: read in full and no accepted figure on the page
- NCSC CHECK, CREST ITHCs and Penetration Testing, Local Government - Digital Marketplace, read 2026-09-12: read in full and no accepted figure on the page
- Network Penetration Testing - Digital Marketplace, read 2026-09-12: read in full and no accepted figure on the page
- Penetration Testing - Digital Marketplace, read 2026-09-12: every candidate on the page was refused
- Penetration Testing - Digital Marketplace, read 2026-09-12: every candidate on the page was refused
- Penetration Testing Services - Digital Marketplace, read 2026-09-12: read in full and no accepted figure on the page
- Penetration Testing and IT Health Check (ITHC) for Central Government - Digital Marketplace, read 2026-09-12: every candidate on the page was refused
- Penetration Testing and IT Health Check (ITHC) for NHS - Digital Marketplace, read 2026-09-12: every candidate on the page was refused
- Red Team / CREST/GCASE/GBEST/CBEST - Digital Marketplace, read 2026-09-12: read in full and no accepted figure on the page
- Search - Digital Marketplace, read 2026-11-11: read in full and no accepted figure on the page
- https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/719653/2133, read 2026-09-12: read in full and no accepted figure on the page
- https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/722447/2988, read 2026-09-12: every candidate on the page was refused
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
2 of the 17 named sources that could be read published a usable figure; 15 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in GBP (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 22 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per G-Cloud service in the penetration-testing category: the supplier, the service, the published unit price and unit ('a unit a day', per engagement), the framework lot and the pricing document behind it - all of it obliged onto a .gov.uk page as a condition of selling to government.
The derivation is the distribution nobody publishes: the median and range of the PUBLIC day rate, how it compares with the private index above, which suppliers publish a floor of zero (a rate card that hides the number), and the drift between framework generations.
22 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (17)
- CREST Penetration Testing - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Cloud Penetration Testing - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Cloud Security Assessment - AWS, Azure, GCP - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Continuous Penetration Testing - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- NCSC CHECK, CREST ITHCs and Penetration Testing, Central Government - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- NCSC CHECK, CREST ITHCs and Penetration Testing, Local Government - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Network Penetration Testing - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing Services - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing and IT Health Check (ITHC) for Central Government - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing and IT Health Check (ITHC) for NHS - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Red Team / CREST/GCASE/GBEST/CBEST - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- Search - Digital Marketplace(the publisher's own terms; quoted for reporting and comment)
- https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/719653/2133(the publisher's own terms; quoted for reporting and comment)
- https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/722447/2988(the publisher's own terms; quoted for reporting and comment)
- https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92301/21947(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
The Gcloud Pentest Rate Card carries 2 published figures read from 2 sources' own pages, under different breakdowns, so no one range is stated, read 11 November 2026.
2 of the 17 named sources read in full publish a figure; 15 publish none, read 11 November 2026.
Gcloud Pentest Rate Card, service-type cloud-security-assessment: median 1,000 GBP across 1 source, read 11 November 2026.
Gcloud Pentest Rate Card, sfia-level set-strategy-inspire: median 1,500 GBP across 1 source, read 11 November 2026.
Cite as: "penetrationtestingcost.co.uk Gcloud Pentest Rate Card", updated 2026-11-13, https://penetrationtestingcost.co.uk/datasets/gcloud-pentest-rate-card/.
Download the CSV (2 rows, computed 2026-11-13)
Get a pen test quote
Describe what needs testing; accredited providers quote your scope directly. Free, no obligation.
Questions this data answers
What does the UK public sector pay for a penetration testing day, by supplier and by SFIA level?
The Gcloud Pentest Rate Card carries 2 published figures read from 2 sources' own pages, under different breakdowns, so no one range is stated, read 11 November 2026.
Where do the figures in the Gcloud Pentest Rate Card come from?
Every figure is quoted from its source's own page and dated (last read 11 Nov 2026). 17 named sources were read and 2 publish a figure; the 15 that publish none are recorded as not published, never estimated.