A cyber security assessment for a UK business of 20–500 people costs between £1,000 and £15,000 in 2026, depending on what is actually being assessed. The wide range exists because the phrase covers five different things. Here is what each one is, what it costs, and which one you probably need.
The five things people mean by "security assessment"
| Type | What it examines | Typical UK price (ex VAT) | Right for you when |
|---|---|---|---|
| Microsoft 365 security review | Tenant configuration: identity, Conditional Access, email security, sharing, device compliance | £1,000–£5,000 | You run on Microsoft 365 and have never had the tenant checked by someone independent |
| Cyber Essentials readiness | The five CE controls against your actual estate | £800–£2,500 plus the £320–£600 certificate fee | A customer, tender or insurer asks for the badge |
| Vulnerability assessment | Automated scan of external and internal systems for known weaknesses | £1,000–£3,000 | You have servers, VPNs or a website you host yourself |
| Penetration test | A human trying to break in, with a report of how they did | £4,000–£15,000 for a small scope | You build software, hold sensitive data, or a regulator requires it |
| Full security posture / gap assessment | Policies, people, process and technology against a framework (CIS, ISO 27001, NIST) | £5,000–£20,000 | You are preparing for ISO 27001 or an enterprise customer's supplier audit |
What drives the price
Scope, not company size. A 300-person firm entirely on Microsoft 365 with managed laptops is a smaller job than a 40-person firm with two on-premises servers, a legacy VPN and unmanaged phones. Who does the work. Large consultancies and MSPs charge £1,200–£2,000 a day and put a junior on the tools; independents with senior experience charge £800–£1,200 and do the work themselves. What you get at the end. A 60-page PDF of scanner output is cheap to produce and nearly worthless; a prioritised list of fixes with the exact settings, in the order to make them, is what you are paying for.
Questions to ask before you pay
- Is the price fixed, and what exactly is in and out of scope?
- Who, by name, will do the work, and what have they done before?
- Will you get the remediation steps, or just the findings?
- Can the same people fix what they find, and at what price?
- Will they re-check after the fixes, so you can show the improvement?
What we charge
Our Security Health Check is £1,250 fixed: two days, your Microsoft 365 tenant and devices, and a prioritised fix list you can act on the same week. If you want the fixes done, the Microsoft 365 Hardening Sprint starts at £3,500 and includes the re-check. Both prices are published because we think you should know the cost before the first call.
Before you buy any assessment, run the free Microsoft 365 security checklist. If you can tick all ten, you may not need one yet.