AI Penetration Testing in the UK: Pentest, Red Team or Architecture Review?

The Short Answer

Who to hire: for a penetration test of an LLM, RAG or AI agent application, a CREST-accredited testing firm with a dedicated AI testing service: in the UK that includes Pen Test Partners, NCC Group, Samurai Digital Security, FORTBRIDGE, EJN Labs, Risk Crew, Solusec and Cognisys. For a review of how the system is designed, before you test it, an AI architect.

What it costs: EJN Labs publishes £6,000–£12,000 for a chatbot or basic RAG system and £12,000–£25,000 for an agent system; Samurai prices at £1,350 per consultant day. What moves the price has the rest.

Which you need: a design review finds the problems a test will otherwise find late, and a penetration test proves the built system holds and gives your customer a certificate. Systems heading to enterprise or regulated buyers usually need both, review first.

Three Kinds of AI Security Engagement

“AI security testing” is sold under one name for three different jobs. Asking for the wrong one is the most common way to pay for a report that misses the risk you had.

The definitions are not mine. NIST describes AI red teaming as exercises to find adverse behaviour of a generative AI model or system and stress-test its safeguards (NIST AI 600-1). CREST’s AI testing standard takes the view that testing should cover the entire system, not just the underlying model (IT Brief, August 2026). And the NCSC’s guidelines put threat modelling under secure design and treat red teaming as a separate step before release.

In practice the expensive failures in RAG and agent systems are structural: a retrieval query with no tenant filter, an agent that acts with its own service account instead of the user’s permissions, a vector store that a deletion request never reaches. A pentest can find these if the tester happens to probe the right path; a design review finds them by reading where the boundary is supposed to be. AI agent authorization and multi-tenant RAG isolation show what that looks like.

UK Firms That Test AI Systems

Each firm below holds CREST accreditation for penetration testing, listed on the CREST Marketplace on 3 November 2026, and publishes an AI or LLM testing service. Grouped, not ranked.

Agent specialists. Some newer UK firms work only on AI agents. Comonad (London) red-teams agents against the permissions they actually hold: prompt injection, excessive tool permissions, missing approval steps. It does not list a CREST accreditation, so it suits design-stage testing rather than a customer certificate.

Three things to check in a proposal. CREST’s Security Testing of AI accreditation, launched in August 2026, is the one that covers testing AI systems; the “CREST AI Charter” some firms display is a pledge, and “AI-enabled penetration testing” means the tester uses AI, not that it tests it. Ask whether retrieval is tested with two tenants’ data loaded, since cross-tenant leaks only show up that way. And ask whether every tool an agent can call is in scope.

What AI Penetration Testing Costs

Prices published on providers’ own pages, read on 3 November 2026:

• EJN Labs: £6,000–£12,000 for a chatbot or basic RAG system, £12,000–£25,000 for an agent system or complex RAG, more for enterprise scope.
• Samurai Digital Security: £1,350 per consultant day for testing the application around AI features.
• Cognisys: £1,250 a day on its G-Cloud listing, a general testing rate rather than an AI-specific one.

No independent survey of UK AI testing prices exists yet. What moves the price is scope: the number of tools an agent can call, the number of data sources behind retrieval, whether tenants share the system, and whether the tester gets grey-box access (documentation and accounts) or tests blind. A design review first usually shortens the test, because the tester can be pointed at the paths that matter.

The UK Standards a Tester Should Know

• NCSC Guidelines for secure AI system development (November 2023): secure design, development, deployment, and operation.
• DSIT Code of Practice for the Cyber Security of AI (January 2025): 13 principles; it asks for independent security testers with skills relevant to AI systems.
• ETSI EN 304 223 (December 2025): the European standard built from the Code, with the same independent-testing provision.
• OWASP Top 10 for LLM Applications, 2026 edition and the OWASP Top 10 for Agentic Applications: the lists most test reports map findings to. The 2026 LLM edition renumbered several items, so check which edition a report cites.

The NCSC’s CHECK scheme, used for government systems, has no AI-specific scope.

Where an Architecture Review Fits

This is the part I do. An AI security and architecture review reads an LLM, RAG or agent system from the inside, before scale or an enterprise pilot, against the NCSC guidelines and the DSIT Code. It is not a penetration test, and when your customer needs a pentest certificate the report says so and lists what to fix before the tester arrives. Reviews are from £2,000, fixed in writing before work starts.

The worked example is a multi-tenant AI platform for pharmaceutical manufacturers: 26 security checks found 2 critical and 4 high issues, including a cross-tenant document leak, all fixed before the platform was approved for enterprise pilots. The case study has the detail. If you want to check your own system first, the LLM security checklist covers the 18 things a review starts with.

Frequently Asked Questions

Who does AI penetration testing in the UK?

Most UK AI penetration testing is done by CREST-accredited penetration testing firms that have added LLM, RAG and agent testing to their services, including Pen Test Partners, NCC Group, Samurai Digital Security, FORTBRIDGE, EJN Labs, Risk Crew, Solusec and Cognisys. Since August 2026 CREST also accredits firms for Security Testing of AI specifically. Check that the firm tests the whole system (prompts, retrieval, tools and APIs), not only the model.

How much does AI penetration testing cost in the UK?

Published UK prices, read on 3 November 2026: EJN Labs quotes £6,000-£12,000 for a chatbot or basic RAG system and £12,000-£25,000 for an agent system or complex RAG; Samurai Digital Security tests the application around AI features at £1,350 per consultant day. The cost rises with the number of tools an agent can call, the number of data sources behind retrieval, and whether multiple tenants share the system.

What is the difference between AI red teaming and AI penetration testing?

AI red teaming tests how the model behaves: whether it can be pushed into harmful, biased or unsafe output (NIST AI 600-1). AI penetration testing tests the whole application an attacker can reach: prompt injection that changes what the system does, data leaking through retrieval, and agents misusing their tools. A red team can pass a model that a pentest then breaks through its integrations.

Do I need a penetration test or an architecture review for my AI system?

Before launch or an enterprise pilot, a review of the design finds the structural problems: missing tenant filters, retrieval that ignores user permissions, agents with more access than the user. A penetration test then proves from the outside that the built system holds, and it is often the certificate an enterprise customer asks for. Most systems heading to regulated buyers need both, in that order.

Which UK standards apply to AI security testing?

The NCSC Guidelines for secure AI system development (November 2023), the DSIT Code of Practice for the Cyber Security of AI (January 2025), and the European standard that grew out of it, ETSI EN 304 223 (December 2025). Both the Code and the ETSI standard ask for independent security testers with skills relevant to AI. Testers usually report against the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications.