VAPT Testing Services: CREST-Accredited Vulnerability Assessment and Penetration Testing for UK Businesses
VAPT combines automated vulnerability scanning with manual penetration testing: broad coverage from automation, depth from human exploitation. EJN Labs is a certified CREST VAPT provider delivering a fixed-price, sector-aligned VAPT service across the UK. Suitable for ISO 27001, SOC 2 Type I/II, PCI DSS, and Cyber Essentials Plus compliance evidence.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
Imran SaghirProject Lead, SquareOne“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Dan WilcocksonCo-Founder, Celloriof automated-scan findings are false positives. Manual validation in VAPT strips them out, so your team only sees real risk.
Vulnerability scans give you breadth. Pen tests give you depth. VAPT combines both.
A pure vulnerability assessment runs Nessus / Qualys / Tenable / OpenVAS across your environment and surfaces hundreds of CVEs. The problem: 50-60% are false positives, dependent on context, or unexploitable. Engineers waste days triaging. Auditors see a hopeless pile of “Critical” findings.
VAPT (Vulnerability Assessment and Penetration Testing) flips the model: automated scanning for breadth (every IP, every endpoint, every service), then manual exploitation for depth (which findings are actually exploitable, what attack chains they enable, what business impact they have). The result is an audit-acceptable evidence pack for ISO 27001, SOC 2, PCI DSS, and Cyber Essentials Plus, not a noise dump.
WHAT VAPT INCLUDES
What VAPT Includes
Six layers of coverage spanning automated scan + manual exploitation. Network, application, cloud, and human attack surfaces.
External Vulnerability Assessment
Authenticated and unauthenticated scans of every public-facing IP and subdomain. CVE matching, version fingerprinting, configuration drift.
Internal Vulnerability Assessment
Internal network scan against patch level, weak service configuration, exposed admin panels, and credentialed misconfigurations.
Web Application Scan
Automated DAST against web applications: SQL injection, XSS, broken auth, insecure deserialization, dependency CVEs.
API & Cloud Configuration
Automated checks against API endpoints + cloud configuration baseline (CIS AWS / Azure / GCP Foundations Benchmark).
Manual Penetration Testing
Human-validated exploitation of the highest-priority findings. Attack chains built across multiple findings.
Business Logic Testing
Human-only attacks: authorization flaws, business-logic abuse, racing conditions, OAuth misconfigurations, payment flow attacks.
Network & AD Exploitation
Active Directory attacks (Kerberoasting, AS-REP, BloodHound), lateral movement, privilege escalation chains.
Compliance Evidence
PCI DSS Req 11.3 evidence, ISO 27001 Annex A.12.6.1, SOC 2 CC7.1, Cyber Essentials Plus boundary firewall.
Remediation Validation
Free retest of every remediated finding within 30 days, automated AND manual validation included.
Email Domain Posture
SPF / DKIM / DMARC validation, BIMI / MTA-STS posture, anti-phishing readiness.
Subdomain Takeover Sweep
Comprehensive dangling DNS check across the registered domain space. Safe proof-of-takeover where applicable.
Dark Web Credential Sweep
Cross-reference of company / employee email addresses against dark-web breach corpus.
METHODOLOGY
VAPT: From Discovery to Audit-Ready Evidence
Automated scan first for breadth. Manual exploitation for depth. Combined report for audit-grade compliance evidence.
Discovery + Scoping
Asset inventory, scope agreement, scanning tool selection, target prioritisation. Authenticated and unauthenticated scans configured.
Automated Vulnerability Assessment
Nessus / Qualys / Tenable / OpenVAS / DAST tools run across the agreed scope. Cloud configuration baseline assessed against CIS Benchmarks.
Manual Penetration Testing
High-priority findings validated by human exploitation. Attack chains built across multiple findings. Business logic and authorization flaws identified.
Report & Remediation
Audit-grade evidence pack mapped to ISO 27001, SOC 2, PCI DSS, Cyber Essentials Plus. Free retest within 30 days. Direct engineer access via portal.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a fixed VAPT quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonCo-Founder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
VAPT Reports Mapped to Every Framework
Findings tagged to specific control IDs in your compliance framework. Audit teams submit directly without translation.
ISO 27001 (Annex A)
A.12.6.1 vulnerability management, A.13 network security, A.14 secure development, control evidence ISO auditors accept.
SOC 2 Type I & II
CC7.1 vulnerability identification, CC6.6 logical access, CC7.2 monitoring evidence. Trust Services Criteria coverage.
PCI DSS
Req 11.3 application-layer testing, Req 11.2 vulnerability scanning evidence, Req 6.5 secure development assurance.
Cyber Essentials Plus
Boundary firewall + external scanning + internal client testing scope. IASME audit-grade evidence.
NHS DSPT
Asset 9 standard 7 evidence, vulnerability management workflow, patient-data perimeter.
FCA / PRA / DORA
Operational Resilience evidence, vulnerability management as Important Business Service control.
PRICING
Transparent VAPT Pricing
Pricing depends on IP count, application count, Active Directory and cloud scope. The day count flexes; the included deliverables stay the same across all engagements.
Depends on scope
Up to around 250 IP addresses and a single application. We scope roughly one working day per 100 basic IPs; hosts running many services take longer. Automated assessment plus targeted manual validation. Typically 5-7 working days.
Get a fixed quoteDepends on scope
Around 250 to 750 IP addresses across multiple applications. About a day per 100 basic IPs, more where hosts run many services. Combined automated assessment and manual penetration testing. Typically 8-12 working days.
Get a fixed quoteDepends on scope
750+ IP addresses with Active Directory and cloud scope. Roughly a day per 100 basic IPs, but a host running hundreds of services can take four days for every hundred IPs. Full VAPT with network and AD exploitation. Typically 12-15 working days.
Get a fixed quoteBY SECTOR
VAPT for Your Sector
Sector-specialist scoping for UK businesses with sector-specific compliance regimes and threat models.
Fintech & FCA-Regulated
FCA-regulated firms, Open Banking, payment APIs, PCI scoping.
Fintech sector pageSaaS Companies
Multi-tenant isolation, SSO/SAML/OIDC, customer-data perimeter, SOC 2 evidence.
SaaS sector pageLaw Firms
Privileged-data confidentiality, partner-tier scrutiny, SRA Cyber Standard alignment.
Law firm sector pageHealthcare
NHS DSPT, NHS DTAC, EHR integration, telehealth, patient-data PII.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, claims data, broker integrations, cyber underwriting evidence.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, SC-cleared testers available.
Public sector pageWHY EJN LABS
What You Actually Get
Six things that distinguish our service from automated scans and box-tick competitors.
What You Get From VAPT
Combined automated scan + manual exploitation across every layer, audit-grade evidence pack, and free retest until validated.
Automated for Breadth, Manual for Depth
We run the scanners then validate every priority finding manually. False positives eliminated. Real risk surfaced.
Audit-Grade Evidence Pack
Reports mapped to ISO 27001, SOC 2 Type I/II, PCI DSS Req 11.3, Cyber Essentials Plus, NHS DSPT, FCA Operational Resilience.
Free Retests Within 30 Days
Every remediated finding retested for free, automated AND manual validation included. No additional engagement fee.
UK CREST + IASME + ISO 27001 + ISO 9001
Independently accredited. Verifiable on the CREST marketplace. Reports accepted by FCA, NCSC, NHS, ICO, SOC 2 auditors, and cyber insurers.
Real Risk, Not False Positives
Automated scanners throw 50-60% false positives. We manually validate every priority finding, so your team only sees real, exploitable risk, not scanner noise.
FAQ
Frequently Asked
What does VAPT stand for?
VAPT stands for Vulnerability Assessment and Penetration Testing. It combines automated vulnerability scanning (broad coverage of CVEs and configurations) with manual penetration testing (deep exploitation and business-logic attacks). VAPT delivers audit-grade compliance evidence efficiently. New to the concept? Read our plain-English guide: what is VAPT testing.
How is VAPT different from a pure penetration test?
A pure penetration test focuses on manual exploitation. VAPT adds automated vulnerability assessment for breadth: every IP, every endpoint, every service is scanned, then high-priority findings are validated manually. This is faster and more cost-effective for compliance audits where evidence breadth matters.
How long does VAPT take?
Small engagements (≤30 IPs, single app) typically take 5-7 working days. Mid-market (30-100 IPs, multi-app) takes 8-12 days. Enterprise (100+ IPs, AD + cloud) takes 12-15 days. Test duration is determined during scoping.
How much does VAPT cost in the UK?
Small engagements £4,000-£7,000. Mid-market (most commonly commissioned) £7,000-£12,000. Enterprise £12,000-£22,000. All quotes are fixed-price after scoping. UK day rates for CREST-certified VAPT consultants are £1,100-£1,400 per day.
What scanning tools do you use?
Industry-standard tools including Nessus, Qualys, Tenable.io, OpenVAS, Burp Suite Pro, and Acunetix. We tailor tool selection to environment type: Nessus for traditional infrastructure, Burp for web apps, Tenable for cloud configuration. We never rely on a single tool.
Is VAPT acceptable for ISO 27001 audit?
Yes. VAPT directly addresses ISO 27001 Annex A.12.6.1 (technical vulnerability management) requirements. Our reports include a control-mapping summary that ISO auditors accept as evidence, without your team having to translate findings into ISO language.
Is VAPT acceptable for PCI DSS?
Yes. VAPT addresses PCI DSS Req 11.3 (application and network penetration testing) and Req 11.2 (vulnerability scanning). Our PCI DSS engagements specifically follow Req 11.3.x methodology with the additional rigor PCI auditors demand.
Is VAPT acceptable for SOC 2?
Yes. VAPT provides evidence for SOC 2 Trust Services Criteria CC7.1 (vulnerability identification), CC6.6 (logical access controls), and CC7.2 (monitoring of system components). Reports are submitted directly to your SOC 2 auditor.
Is VAPT enough for Cyber Essentials Plus?
VAPT supports the boundary firewall, external scanning, and client device testing scopes of Cyber Essentials Plus. We are an IASME Cyber Essentials Certifying Body; we can issue Cyber Essentials Plus certification directly following VAPT. Combined engagements (VAPT + CE+ certification) are available.
Do you provide remediation guidance?
Yes. Every finding ships with prioritised remediation guidance, CVSS scoring, business-impact context, and where applicable, configuration patches. For high-severity findings we include direct engineer access via our portal during remediation.
Are your testers UK-based and what certifications do they hold?
All VAPT testers are vetted UK-based engineers. Relevant certifications include CREST CRT and CCT (App and Inf), OSCP, OSCE, OSWE, and platform-specific specialisms. SC-cleared testers are available for public-sector and regulated-financial engagements.
Do you sign NDAs?
Yes. Standard NDA before any technical detail is shared. We operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses. Custom MSAs and AUP terms are accepted for enterprise and public-sector clients.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed VAPT quote in 24 hours
A CREST-certified VAPT consultant will contact you within one business day with a fixed price, a realistic timeline, and the named consultant. No sales pipeline.
