Penetration Testing Tenders

See open penetration testing tenders and awarded contracts for the UK public sector.

Most of this work is bought as an IT health check. Councils, NHS trusts and central departments run an annual ITHC to keep a Public Services Network connection or to satisfy the NHS Data Security and Protection Toolkit, and the notice is titled that way rather than as penetration testing. Scope ranges from one web application to a whole estate.

There are 1,447 notices on record and 854 of them are awards. Buyers often appoint two or three CHECK accredited testers rather than one, then retender on a cycle.

1,418 results

Showing 261–280 of 1,418 results

Other topic pages covering nearby areas of public sector spend.

Frequently asked questions

Frequently asked questions about penetration testing, pen testing, ITHC, red team, vulnerability testing, ethical hacking, pentest in the UK public sector.

  • How do I find penetration testing contracts in the UK?

    Two ways in. Watch the portals for live ITHC and penetration testing notices, or move earlier and follow the buyers who retender on an annual cycle. Stotles pulls notices from 100+ portals and sits them next to the strategy documents and budget papers that show the work coming. Platform-wide, 2,145 notices are open right now. Start with what is open, then track the buyers behind it.

  • Is an IT health check the same thing as a penetration test?

    In practice, yes. An IT Health Check, written ITHC, is the UK public sector name for a scope-defined penetration test run once a year, usually to keep a Public Services Network connection or to meet the NHS Data Security and Protection Toolkit. Buyers ask for testers accredited under the NCSC CHECK scheme. Notice titles use the two terms interchangeably, so searching for one and not the other misses a large part of the market.

  • What CPV codes are used for penetration testing tenders?

    The two that recur are 72800000 (Computer audit and testing services) and 72254100 (Systems testing services). Plenty of notices are filed under the much broader parent IT services heading instead, and some carry no code at all. Alongside the keyword filter for this page, 72800000 appears on 112 notices and 72254100 on 38, so codes narrow the picture rather than describe it. Keywords do the work here.

  • How much penetration testing work is there, and how often does it come round?

    There are 1,447 notices on record for this filter, 854 of them awards and 55 still at the pre-tender stage. Six sit at the open stage, which is what an annual testing cycle looks like: small contracts, awarded quickly, then retendered. The awards are the more useful half. They show who tests for which buyer and when the current term runs out.

  • What should a supplier check before bidding for an ITHC?

    Accreditation first. Many notices restrict bidders to NCSC CHECK or equivalent accredited testers, and a lot of the work is called off a cyber security framework or a dynamic purchasing system rather than run as an open competition. Then read the scope, because an external infrastructure and web application test is a different job from a full estate review or a red team exercise. Platform-wide, 2 award notices were published in the last seven days, and recent awards are the quickest way to see how buyers word the requirement.

Win more Penetration Testing Tenders contracts with Stotles

Get Penetration Testing Tenders alerts, buyer intelligence and bid tools, all in one place.

Try for free