Official pay data
Updated 9 October 2026
Salary guide
Official annual estimates for the whole country, mapped to the closest published occupation.
United Kingdom · gross annual earnings estimate
25th percentile
£42,761
Median
£54,647
75th percentile
£71,808
This ASHE benchmark covers full-time employee jobs, not self-employed income or part-time jobs. ASHE gross earnings include basic pay, overtime, incentive pay such as bonuses and commissions, shift premiums, and other cash pay. They are before deductions, exclude payments in kind, and are not take-home pay or the whole benefits package. Compare the benchmark with an offer on the same working-hours and annual-pay basis.
This is a country-level occupation benchmark, not a local offer estimate. Pay can differ by location, employer, duties, and working pattern.
Source: ONS, 2025-04-30. Mapped to Cyber security professionals; the occupation is broader than the page role. Figures are estimates, not advertised salaries.
This national benchmark uses the broader Cyber security professionals occupation. It is a useful comparison for a Penetration Tester because the role involves authorised simulated attacks to find and report security weaknesses. It is not a salary quote for every pen-testing post: assignments can vary by the systems tested, the employer and the working arrangement.
Benchmark fit
Penetration testing sits credibly within the Cyber security professionals benchmark because its central work is authorised security testing and vulnerability reporting. The benchmark remains broader than this exact role, so use it as a national comparison point rather than treating every cyber security job as a penetration-testing job.
Nearby titles: "Pen tester" and "ethical hacker" are occasional names for a penetration tester..
An occasional shared title does not make every ethical-hacking or adjacent cyber security role equivalent to penetration testing. Compare the actual authorised testing, reporting and risk-advice duties in the offer with the role described here.
Role scope
A Penetration Tester carries out authorised simulated cyberattacks to identify and report vulnerabilities in computer systems, networks, infrastructure and internet sites.
Conduct authorised tests using methods similar to real cyberattacks, with the aim of exposing weaknesses that criminals could exploit. · Identify and report vulnerabilities in systems, networks, infrastructure and websites. · Advise companies and clients on ways to minimise the risks associated with identified flaws. · Depending on the engagement or specialism, test networks, operating systems, web or mobile applications, cloud environments and APIs.
Reports that identify vulnerabilities found during authorised testing. · Advice for companies or clients on reducing the risks linked to security flaws.
Work may be carried out on site or remotely.
This is an occasional alternative name for a penetration tester, not proof that every role using the broader title has the same scope.
Read the range
When comparing offers, look for the substance of penetration-testing work: authorised simulated attacks, vulnerability reporting and advice on reducing risk. A role focused on these activities is a closer match than a cyber security post whose title alone sounds similar.
One quarter of employees earn below this figure.
Half of employees earn below this figure and half above it; it is not the arithmetic midpoint of the displayed range.
One quarter of employees earn above this figure.
Location
Supplementary regional medians are available for East, London, North West, Scotland, and Yorkshire and The Humber.
| Region | 25th percentile | Median | 75th percentile |
|---|---|---|---|
| East | Not published | £52,750 | Not published |
| London | Not published | £59,590 | Not published |
| North West | Not published | £51,954 | Not published |
| Scotland | Not published | £51,355 | Not published |
| Yorkshire and The Humber | Not published | £54,864 | Not published |
These figures supplement a country-level occupational benchmark; location, employer, duties and working pattern can differ between offers.
Beyond salary
Compare the offer on the same hours and annual-pay basis as the benchmark. Separate the fixed salary from any cash payment that depends on overtime, shifts, bonus rules or commission, then assess benefits on their own written terms.
Ask which part of the stated annual amount is basic pay rather than overtime, incentive pay, shift premiums or other cash pay.
If a bonus, commission, overtime payment or shift premium is offered, ask for its eligibility rules, calculation and whether it is guaranteed.
Ask separately about pension, health cover, leave and any equity, because payments in kind and the wider benefits package are not the same as gross earnings.
Employment model
Penetration testers may work in-house for larger companies, or through security consultancies and risk-management organisations serving external clients. Freelance contract work is also possible, but it is outside this employee-job benchmark.
Ask whether the role supports the employer's own system security function and what systems fall within the authorised testing scope.
Ask whether you will test vulnerabilities for external clients and how engagement scope is authorised.
Do not compare self-employed contract income directly with this full-time employee-job benchmark.
Offer review
Questions
Source
Source: ONS, 2025-04-30. The figures cover Cyber security professionals (2135) and full time employee jobs. Updated 9 October 2026. This broad occupation benchmark may not match every Penetration Tester vacancy.
Put the benchmark to work
Use the salary range as context. Tailor your CV around the experience that supports your target level.
