What CREST accreditation means for a pentest provider

CREST is one of the accreditations that UK buyers ask for most. It is a not-for-profit membership body that sets standards for the technical security industry, and its member companies are independently assessed to ensure they meet those standards.

Get a pentest quote Check our CREST listing

What's assessed

CREST is a not-for-profit membership body that sets standards for the technical security industry.

Membership is assessed at the company level, and members are re-audited periodically to keep their active status.

Quality processes

How engagements are scoped, tested and reported, and whether the provider's methodology and quality assurance stand up to independent review.

Information security

How the provider protects its own systems and handles the sensitive information that a penetration test produces about your environment.

Staff qualifications

The qualifications and experience of the people delivering the assessments, alongside the individual certifications the team holds.

Contracts and insurance

Contract management and professional indemnity insurance, so the provider can stand behind its work.

Complaints and conflicts

How the provider handles complaints and conflicts of interest, backed by an independent route to raise concerns if an engagement falls short.

Codes of Conduct

Member companies agree to and operate under CREST's Codes of Conduct and Ethics.

What It Doesn't Tell You

The limits of a company accreditation

Accreditation is achieved on an individual service basis. These are the things it leaves for you to check.

Who is assigned to your engagement
A company accreditation is not an assurance about the individual doing the work. Ask which certifications the named consultant holds, and which comparable environments they have tested. Our guide to choosing a provider covers the questions to ask.
How well the proposal fits your scope
Scoping alignment can vary between providers. Read the proposal to confirm what is in scope, how long testing runs and what you receive as deliverables.
Anything outside the accredited services
A provider can only claim CREST accreditation for the services on its certificate. Check that the accredited service matches what you are buying.
The capability of unaccredited providers
Providers without accreditation can be just as capable. They may not yet be at a scale where accreditation makes sense, but you have only their word for their processes.

CREST, CHECK and the Cyber Scheme

How the main UK schemes compare

The schemes overlap but answer different questions. Individual certifications are listed too, because they tell you about the person rather than the company.

Scheme	What it is	What is assessed	When buyers ask for it
CREST	A not-for-profit membership body that accredits companies and certifies individuals in technical security.	Companies: processes, methodology, data handling and quality assurance. Individuals take separate examinations (CPSA, CRT, CCT INF and CCT APP).	Widely recognised by UK buyers and commonly listed as an indicator of a suitable supplier, for example in NHS England's DSPT guidance (see our healthcare penetration testing page).
CHECK	The NCSC's scheme for companies authorised to test government and critical national infrastructure systems.	Companies are certified. Individuals hold CHECK Team Leader or Team Member status, which depends on a relevant CREST or Cyber Scheme certification.	Contracts for government or critical national infrastructure systems that specify CHECK.
The Cyber Scheme	An independent assessment body that accredits companies and certifies individuals (CSTM, CSTL Infrastructure and CSTL Application).	Companies: organisational security, qualifying personnel and adherence to the Cyber Scheme Code of Conduct. Individual examinations are separate.	Buyers who accept it alongside CREST. Its individual certifications are an equivalent route to CHECK status.
Individual certifications, such as OSCP, OSCE, CSTL, CCT, etc.	Practical examinations for individuals, such as compromising live machines in a proctored exam.	The person's technical skills and knowledge, not the company.	To determine a consultant's capabilities and knowledge.

Which accreditation a buyer is likely to ask for

The table below shows what we usually see in each sector.

Most private-sector buyers

CREST or Cyber Scheme company accreditation is the usual benchmark. CHECK is not normally needed unless a contract requirements says so, because it is aimed at government and critical national infrastructure work.

Public sector and critical national infrastructure

Check the contract, as some specify CHECK. Exploitr is a CREST member company and doesn't hold CHECK, and if your contract specifies it we will tell you upfront.

Healthcare suppliers

NHS England's DSPT guidance lists CREST, the Cyber Scheme and CHECK as indicators rather than requirements. See healthcare penetration testing for more details.

Financial services

CREST STAR and CBEST are intelligence-led testing for the financial sector, and Exploitr doesn't deliver them. For standard penetration testing of financial services applications and Fintech, see financial services penetration testing.

Audits and customer reviews

Audit frameworks and customer questionnaires set their own expectations. See our guidance on penetration testing for compliance.

How to verify a provider

A badge on a website is not verification, and these checks only take a few minutes.

Look the company up on the CREST Marketplace

Search for the provider's name on the CREST Marketplace rather than relying on a badge on their website. Check that the membership is current.

Check the accredited services

The Marketplace listing shows which services the company is accredited for. Confirm that penetration testing is listed, because a provider can only claim accreditation for the services on its certificate.

Ask about the named consultant

The listing tells you about the company. Ask which certifications the consultant on your job holds, and what comparable environments they have tested.

Ask who does the work

Check whether the people who scope and test your engagement are employees or subcontractors, and whether the proposal commits to it. At Exploitr the testing is manual and consultant-led.

Where Exploitr stands on each scheme

You can verify our CREST status on our CREST Marketplace listing. We list what we don't hold as plainly as what we do.

CREST member company

Since September 2026 Exploitr has been a CREST member company, accredited for penetration testing. Read the announcement for how we got there.

What we do not hold

Exploitr doesn't hold CHECK status, isn't accredited by the Cyber Scheme and doesn't currently deliver CREST STAR or CBEST engagements. If a government or critical national infrastructure contract specifies CHECK, we will tell you upfront. Penetration testing for Fintech is covered on our financial services page.

Common Questions

CREST penetration testing: frequently asked questions

Questions buyers ask when comparing accredited providers.

No. It isn't a legal requirement for penetration testing in general. Some buyers, contracts and frameworks name an accreditation such as CREST, CHECK or the Cyber Scheme, so check what yours specifies before you shortlist.

It means an independent body has checked the provider's processes, methodology, data handling, insurance and complaints procedures. The quality of the test itself still depends on the consultant, the scope, and the time allowed, so ask about all three.

Providers without accreditation can also be capable. With them, you rely on their own account of their processes rather than an independent assessment.

Company accreditation is assessed at organisation level. Individual CREST certifications, such as CPSA, CRT, CCT INF and CCT APP, are examinations that people sit. A company can employ individuals who hold CREST certifications without being a member company, so check both the company and the consultant.

Our CREST accreditation is for penetration testing, which is the service shown on our CREST Marketplace listing. We don't claim CREST accreditation for any other service.

Looking for CREST-accredited penetration testing?

Tell us what you need to test, and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. No obligation at any stage.

Request a Quote