HOW TO HIRE · MARKETING, DESIGN & TECH

How to hire a cybersecurity consultant in the UK
The checks, the questions and the paperwork.

No licence applies to cybersecurity consultants. Here is why testing needs written authorisation, and what to ask.

  • Search and compare — no account needed
  • Nearest to you first
  • One score from Google, Trustpilot and Locufy reviews

THE 60-SECOND VERSION

Hiring a cybersecurity consultant in five steps

  1. Decide what you needA Cyber Essentials readiness check, a penetration test, policies or incident response.
  2. Authorise testing in writingSystems in scope, dates, times and methods, signed by someone with authority.
  3. Check qualificationsAsk which certifications the cybersecurity consultant holds for the work, and check them.
  4. Agree how findings are protectedWho sees the report, how it is sent and how test data is deleted.
  5. Plan the fixesA ranked findings report and who will fix each issue.

BEFORE YOU BOOK

Check before you book

No register applies

No law licenses cybersecurity consultants in England, Wales, Scotland or Northern Ireland. Industry certifications are voluntary; a scope, references and written authorisation are what matter.

Ask for an example report (anonymised) and a client you can contact.

Written authorisation (Computer Misuse Act 1990)

Section 1 of the Computer Misuse Act 1990 makes it an offence to access a computer's programs or data knowing the access is unauthorised. Cybersecurity testing is lawful only within the permission you give.

Sign a scope and authorisation letter listing systems, dates and methods; check you own or control everything in scope. legislation.gov.uk →

Cyber Essentials scheme

Cyber Essentials is the government-backed certification scheme from the National Cyber Security Centre, built on five technical controls. Many organisations require it of suppliers, and a cybersecurity consultant can prepare you for it.

If certification is the goal, ask the cybersecurity consultant to map the work to the five controls. ncsc.gov.uk →

Data seen during testing

Testing can expose personal data. The ICO expects it to be kept secure, and a cybersecurity consultant processing it on your behalf needs written terms that meet UK GDPR.

Agree how findings and any personal data seen are stored, sent and deleted. ico.org.uk →

VAT

Security testing and consultancy are standard-rated, so a registered cybersecurity consultant adds 20% to the test days, the findings report and any retest. Registration becomes compulsory once a cybersecurity consultant has VAT-taxable turnover over £90,000 in any rolling 12 months; from then VAT must be charged and shown as a separate line on the invoice.

Ask the cybersecurity consultant for the VAT number alongside the written authorisation, and for the test days, retest and VAT shown apart. gov.uk →

“What cybersecurity work have you done for organisations like mine?”

A good answer: Specific engagements, with the cybersecurity consultant's role explained.

“Which certifications do you hold for this cybersecurity work?”

A good answer: Named certifications you can check, matched to the task.

“What will you need us to authorise in writing before the consultant tests?”

A good answer: A scope letter: systems, dates, times, methods and emergency contacts.

“How will cybersecurity testing avoid disrupting our business?”

A good answer: Agreed windows, rate limits and a stop procedure.

“How will the cybersecurity findings be reported?”

A good answer: A ranked report with evidence, business impact and fixes, plus a debrief.

“How will the consultant protect data seen during testing?”

A good answer: Encrypted storage, limited access and deletion on a set date.

“Is a retest included after we fix the issues?”

A good answer: A clear yes or no, with the price.

Getting the quote right

  • Scope: systems, tests and dates
  • Who actually attends the test: the cybersecurity consultant named in the authorisation, an employed tester, or a subcontracted tester
  • Day rate and days, or a fixed fee
  • Findings report and debrief included
  • Retest and remediation work: included or extra
  • Data handling and deletion terms
  • The VAT number, with VAT at 20% on the test days and the retest

Walk away if

  • Offers to test without a signed scope
  • Wants to test systems you do not own or control
  • A report that is only an automated scan output
  • No plan to protect data seen in testing
  • Scare tactics to sell products
  • Will not name certifications
LOW
£413
TYPICAL
£550
HIGH
£750

What a cybersecurity consultant costs: £413–£750 per day

Cybersecurity consultants usually charge a day rate against a written scope; retests and remediation are often priced separately. Cybersecurity Consultant price guide →

Guide prices compiled by the Locufy team from published Irish and UK provider price lists and 2026/27 cost guides. Updated 2026.

KNOW WHAT TO LOOK FOR? NOW FIND ONE

Cybersecurity consultants near you, with the badges that matter shown

ID checked, trader status and one score from every review — on the card, before you message anyone. Nearest first. No account needed to look.

Or post the job free and let them come to you.

  1. ScopingSystems, risks, goals and authorisation agreed in writing.
  2. AssessmentControls reviewed or systems tested within the scope.
  3. FindingsA written report ranking risks with fixes.
  4. DebriefA walkthrough of findings and next steps.
  5. RetestFixed issues checked, if agreed.

Penetration test
An authorised simulated attack to find weaknesses.
Scope letter
The signed document saying what may be tested and when.
Vulnerability
A weakness an attacker could use.
Remediation
Fixing the problems found.
Phishing test
A simulated scam email to check staff awareness.
Cyber Essentials Plus
The version of Cyber Essentials with hands-on technical verification.

AFTER

When the job is done

File the report securelyIt is a map of your weaknesses; limit who has it.
Fix and retestWork through the ranked fixes and retest the serious ones.
Confirm data deletionAsk for written confirmation that test data has been deleted.
Your reviewReviews on Locufy come only from booked jobs, so yours counts. If the cybersecurity consultant fell short, use the make-it-right step first and they get the chance to put it right.

STEP 1Tell the cybersecurity consultant, in writingDescribe the fault and give a fair deadline to fix it. The Consumer Rights Act 2015 expects reasonable care and skill from the cybersecurity consultant as a trader, so you can insist on the work being put right or the bill cut.
STEP 2Use Locufy's make-it-right stepA rating under four stars asks whether the cybersecurity consultant should hear about it first. Agree, and the make-it-right step runs before your review appears.
STEP 3No regulator: use the consumer helplineFor advice on your rights against the cybersecurity consultant, or to report a trader who breaks the law, call Citizens Advice on 0808 223 1133 in England and Wales, Advice Direct Scotland on 0808 800 9060 or Consumerline on 0300 123 6262 in Northern Ireland.
STEP 4Claim the money backSmall claims is the last step against the cybersecurity consultant: the limit is £10,000 in England and Wales, £5,000 in Scotland (simple procedure) and £5,000 in Northern Ireland.

Hiring a cybersecurity consultant: questions people ask

No. No licence or register applies in any UK nation; certifications are voluntary.

Yes, with the system owner's authorisation. Unauthorised access is an offence under the Computer Misuse Act 1990, so sign a scope first.

A government-backed scheme setting five basic technical controls; many organisations ask suppliers to hold it.

Expect £413–£750 per day; £550 is typical. Specialism, certifications, scope and urgency (incident response) move the day rate. Our cybersecurity consultant price guide breaks the figures down, and your town above brings up cybersecurity consultants close by.

Only people who need it; it describes your weaknesses in detail.

Small reviews take one to five days; larger programmes run for weeks.

MORE GUIDES

More hiring guides in marketing, design & tech

How to hire: IT SupportHow to hire: Managed IT ServicesHow to hire: Network EngineerHow to hire: Cloud ConsultantHow to hire: Software DeveloperHow to hire: Data RecoveryHow to hire: AI / Machine Learning ConsultantHow to hire: Project ManagerAll 701 hiring guides →

Cybersecurity consultants near you

Cybersecurity consultants in LondonCybersecurity consultants in ManchesterCybersecurity consultants in BirminghamCybersecurity consultants in GlasgowCybersecurity consultants in BelfastAll cybersecurity consultants on Locufy →

Sources — checked October 2026

  1. Computer Misuse Act 1990, section 1 — unauthorised access
  2. NCSC — Cyber Essentials overview
  3. ICO — contracts between controllers and processors
  4. Consumer Rights Act 2015, section 49 — reasonable care and skill
  5. Citizens Advice — more help with a consumer issue
  6. gov.uk — make a court claim for money: court fees
  7. VAT rates — VAT rates for goods and services: standard rate 20% on most goods and services
  8. GOV.UK — Register for VAT: when to register