Pen test scope
Red team engagement
Adversary simulation across full kill chain — phishing, initial access, persistence, lateral movement, exfiltration. Distinct from standard pen testing.
Small
10-20d
£10,000-£30,000 UK
Medium
20-40d
£20,000-£60,000 UK
Large
40-80d
£40,000-£120,000 UK
Standards typically applied
MITRE ATT&CKTIBER-EU (regulated finance)CBEST (UK financial sector)
Considerations that move the day count
- Senior or specialist consultants required — uses upper end of day-rate band
- CBEST / TIBER-EU engagements add reporting and stakeholder management overhead — typically 30-40% above base
- Purple team (defender-active) variants are gaining ground and price similarly to red team
- TIBER-EU and CBEST engagements often span 6+ months calendar time even though day count is lower
Source
MITRE ATT&CK + CBEST framework + TIBER-EU + Precursor Security 2026 scope ranges
Verified 2026-06-02
Other scopes