What is CREST (Council of Registered Ethical Security Testers)
Simply put, CREST is an accreditation and certification body for the security industry. It sets standards for penetration testers and cyber security service providers and certifies consultants and consultancies against those standards. CREST offers a number of disciplines for potential companies to apply. Below is a list of those disciplines. This blog post is catered to one of those disciplines: CREST penetration testing.
- Penetration Testing (The focus of this blog post)
- Vulnerability Assessment
- Intelligence-Led Penetration Testing (CREST STAR)
- Threat Intelligence
- STAR-FS
- Cyber Security Incident Response
- SOC
What does CREST exist to do?
When searching for a penetration testing provider, you need complete confidence in their credentials. Consider CREST accreditation a ‘stamp of approval’ for a high-quality penetration test. Like many other accreditation bodies, CREST requires consultancies to adhere to a standard. It’s worth noting that the CREST accreditation standard has just undergone a significant overhaul and is now publicly available (for the first time). If you want to learn more about the standard, you can request a copy of the standard here.
CREST was established to address the industry’s need for more regulated penetration testing, a response to the risks posed by unregulated and potentially unqualified testers. Engaging with highly qualified CREST-approved testers who adhere to best practices and methodologies is becoming increasingly important; the usage of AI and cutting-edge offensive security capabilities, with an increasing focus on automation (By black-hat hackers, nation-states, etc) means that qualified, expert testers have never been more critical.
In 2025, CREST will have over 400 accredited member companies and thousands of certified penetration testers; the number of companies joining the CREST ranks is increasing year on year.
Looking for a CREST-Accredited Penetration Test provider?
Why Choose a CREST-Accredited Pen Testing Provider?
Opting for a CREST-accredited provider offers a multitude of benefits:
- Highly Trained Security Experts: CREST penetration testing is carried out by, or at least supervised by, expert consultant testers who must pass rigorous exams to prove their skill, knowledge, and competence. These consultants are typically highly trained experts with thousands of hours of penetration testing experience.
- Improved Customer Assurance: Your customers often require you to demonstrate the security and safety of their confidential data (The company must align to ISO 27001/9001 to obtain the accreditation). Using a CREST penetration testing provider proves that you chose vendors that adhere to security best practices. This can even provide a commercial advantage when bidding for contracts.
- Supports Regulatory Compliance: A CREST pen test directly supports information security requirements outlined in regulations such as GDPR, DPA 2018, ISO 27001, NIS Regulations, PCI DSS, and NHS DTAC. While some standards explicitly require penetration testing, others do so indirectly through the need to assess the effectiveness of security controls.
- Globally Recognised: While CREST is UK-based, its accreditation is valid and recognised worldwide. This is invaluable for companies with a global presence or those working with overseas clients. Conducting your penetration testing with a CREST pen test provider can assure your customers that qualified consultants have tested your digital assets.
- Peace of Mind: Engaging a CREST-accredited company means you can feel safe knowing their services meet a recognised industry standard. It signifies a commitment to professional standards, technical competence, and ethical conduct.
Are there risks associated with choosing an unaccredited company?
Businesses expose themselves to several risks when opting for penetration testing from non-accredited providers. Crucial vulnerabilities could be overlooked or misunderstood without recognised standards and professional oversight.
This is not to say that all unaccredited penetration test providers are risky, as many started without CREST accreditation and could have performed well. However, if you want assurance that the organisation’s practices have been vetted, choosing an accredited penetration test provider is best.
The CREST Penetration Testing Process: A Structured Approach
While specific methodologies may vary, CREST-accredited companies typically follow a structured process when engaging with a potential client:
- Preparation: This area focuses on the essential legal and operational aspects of penetration testing, such as confidentiality, handling sensitive information securely, and meeting privacy regulations. It emphasises creating a safe, compliant environment by clearly briefing clients and taking practical steps to protect their data.
- Scoping: Experts take the time to understand your specific requirements, define the scope of the test, gather necessary technical information, and obtain required access. This ensures the test is tailored to your unique environment and goals. Both non-technical and technical staff usually conduct the scoping phase.
- CREST Penetration Testing: Qualified testers manually (Including some automation methods) assess your systems using various penetration testing tools to identify security weaknesses and vulnerabilities. This goes beyond basic automated scans, providing deeper insights.
- Analysis and Exploitation: The results are interpreted, and (with your permission) any discovered vulnerabilities may be exploited to determine the potential impact a malicious actor could have.
- Detailed Penetration Test Report: Experts analyse the findings and present them in a comprehensive report. This report will list and categorise vulnerabilities (e.g., Critical, High, Medium, Low) and provide clear, actionable instructions on how to fix and strengthen your defences.
- Retest (Optional): After you’ve implemented the recommended remediations, you can conduct a retest to verify that the patches have been applied effectively and the security holes have been mitigated. Some companies will offer free retesting as part of the scoping phase, it is always worth checking if retesting is included in the proposal, for more details on what to look out for. Check out our ‘Penetration Testing Companies Guide‘
How to Choose the Right CREST Provider
Sencode has produced a penetration testing buyer’s guide. This buyer’s guide outlines key considerations for organisations selecting penetration testing services to protect against cyber threats effectively. To summarise the guidance:
- Experience and Expertise: Look for providers with a proven track record in your industry or sector: request case studies or references from similar organisations.
- Clear Communication: Good providers outline their processes, expectations, deliverables, and costs upfront. They avoid ambiguity by thoroughly discussing the scope and objectives of testing. Your impression of the company will start with an initial contact. Check out the vendor checklist in the buyer’s guide, which can help you keep track of your assessment of each company.
- Reporting Standards: Ensure your provider offers detailed reports that categorise vulnerabilities clearly (Critical, High, Medium, Low) and provide actionable remediation guidance.
- Retesting and Follow-up: Check if retesting is included or additional fees are incurred.
- Client Reviews and Reputation: Research testimonials, client feedback, and reviews to verify their reliability and customer satisfaction.
What type of Penetration Testing can be included in a CREST Penetration Test?
Many types of Penetration Testing can be conducted to the CREST standard (with the help of many external testing methodologies). You can find a list and a brief description of these below.
Web Application Penetration Testing
Web application penetration testing identifies vulnerabilities in online applications through detailed assessments based on OWASP guidelines.
Network Penetration Testing
Network penetration testing assesses internal and external network infrastructure to identify vulnerabilities, enabling organisations to strengthen their overall security.
VAPT
Vulnerability Assessment and Penetration Testing (VAPT) combines vulnerability scanning and penetration testing to provide comprehensive insights into digital asset vulnerabilities.
Mobile Penetration Testing
Mobile penetration testing includes static and dynamic analyses, following OWASP Mobile Application Security Verification Standards (MASVS).
Cloud Penetration Testing
Cloud penetration testing evaluates vulnerabilities in cloud infrastructures such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform.
API Penetration Testing
API penetration testing assesses both internal and external APIs by examining their endpoints for security vulnerabilities.
Ready to take action?
Ready to enhance your cyber security posture with a CREST penetration test? Here are your next steps:
- Request a Free Initial Consultation – Speak directly with our security experts to identify your unique requirements and set clear testing objectives.
- Arrange Your Scoping Call – We’ll clearly define the scope, discuss your business objectives, and create a tailored testing plan.
- Schedule Your CREST Penetration Test – Secure your testing dates and begin the journey to strengthened cybersecurity today.
Conclusion
In conclusion, CREST penetration testing is essential to understanding and mitigating your cyber security risks. By choosing a CREST-accredited provider, you’re not just getting a test; you’re gaining a trusted partner dedicated to strengthening your security posture and providing the confidence to navigate the complex cyber landscape. Don’t settle for anything less regarding the security of your valuable assets. Get in touch with us today and book a CREST Penetration Test.
CREST penetration testing refers to security assessments carried out by companies accredited by CREST (Council of Registered Ethical Security Testers). This accreditation ensures that the penetration tests are conducted by skilled professionals who follow recognised standards and best practices.
While it’s not legally mandatory, choosing a CREST-accredited company is highly recommended. Accreditation guarantees high-quality testing, demonstrates your commitment to best practices, and assures clients and stakeholders that your cybersecurity measures meet recognised industry standards.
Yes, CREST accreditations are internationally recognised. Although CREST originated in the UK, their standards and certifications are acknowledged and respected worldwide, making them ideal for businesses operating globally or with international clients.
Absolutely. CREST penetration testing directly supports compliance with security and privacy regulations, such as GDPR, DPA 2018, ISO 27001, NIS Regulations, PCI DSS, and NHS DTAC. Using a CREST-accredited provider helps demonstrate that you have taken appropriate steps to secure your organisation’s digital assets.
A third party has asked me if we conduct CREST Penetration Testing; what can I do?
If a third party asks about CREST penetration testing, your best course of action is to engage a CREST-accredited penetration testing provider. You can make sure to show clients, regulators, and stakeholders see that your security measures meet established professional standards. If you need help with this, please contact us for guidance.
Yes, CREST is based in the UK, with its international headquarters and UK regional office located in Coventry.