CREST

What CREST does

CREST (International) is a UK-registered not-for-profit accreditation and certification body serving the technical information security industry. Founded in 2006 and registered in Coventry, United Kingdom (company number 09805375), it accredits cybersecurity service providers and certifies individual practitioners across seven disciplines: penetration testing, vulnerability assessment, threat intelligence, incident response, security operations centres (SOC), security architecture, and threat-led penetration testing (STAR/STAR-FS). Its core "product" is not software but a body of published accreditation standards, professional certification exams (e.g., CPSA, CRT, CCT INF, CCT APP, CPIA, CCIM, CCSAM), maturity assessment tools (spreadsheet-based, scored 1–5), and the CREST Marketplace, a searchable online directory of accredited suppliers filterable by service, region, industry, and government scheme.

CREST serves three primary buyer groups—cybersecurity service providers seeking independent quality assurance, governments and regulators requiring standardized providers, and enterprise buyers procuring vetted services—plus individual practitioners pursuing credentials. Its accreditations are embedded in numerous regulated schemes, including UK Bank of England CBEST, NCSC CHECK/CIR/CIE, UK CAA ASSURE, UK Cabinet Office GBEST, Dubai DESC Cyber Force, EU ECB TIBER-EU, and HKMA iCAST. The organization reports over 500 member companies worldwide and more than 3,000 individuals holding CREST certifications, operating through regional councils across Asia, Australasia, Europe, Middle East & Africa, North America, and the UK.

The business model is member-funded and recurring. Revenue streams include annual membership subscriptions (£26,500 global / £7,500 regional), tiered entry statuses (Pathway at £250/year, Pathway+ at £1,500/year), one-time joining fees (£1,500–£25,000 by revenue tier), non-refundable application fees (£500–£1,200), professional certification exam fees, and additional accreditation subscriptions (e.g., OVS at £2,000/year, CIS Controls at £1,200/year). Go-to-market is consultative and relationship-based via membership applications, the marketplace, regional subscriptions, government/regulator programs, industry events (CRESTCon, BSides), and discipline communities. Discounts (50%) apply for low-income-country providers.

Name

CREST

Legal name

CREST (International)

Website

https://crest-approved.org

Company type

Private

Founded year

2006

Operating status

Operating

Headcount range

251–500 employees

Short description

CREST is a UK-based not-for-profit accreditation and certification body for the cybersecurity industry, accrediting 500+ service-provider members and certifying 3,000+ practitioners across penetration testing, incident response, SOC, and threat intelligence, serving providers, regulators, and enterprise buyers.

Ownership category

akta.pro rank

Product category

Cybersecurity Accreditation Services

NAICS

Educational Support Services (611710), Business Associations (813910), Testing Laboratories and Services (54138)

SIC

Services-Testing Laboratories (8734)

akta.pro primary industry

Information Technology (IT) & Cybersecurity Certifications (EDAAANAA)

akta.pro secondary industries

Penetration Testing, Red Team & Ethical Hacking (EDAOAIAH), Digital Assessment Platforms & Computer-Based Testing Authorities (EDADAFAK), Credential, Education & Professional License Verification (BPAKAEAI), Certification & Licensing Exam Management Platforms (EDAFADAG)

Keywords

• Cybersecurity accreditation services
• Penetration testing certification
• Incident response accreditation
• Threat intelligence certification
• Cyber service standards

Headquarters

HQ city

Slough

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales

Revenue model

1. Membership Subscriptions: Annual subscription fees charged to member companies. Global subscription covers all regions; regional subscriptions cover specific geographic areas (Americas, Asia, Australasia, EMEA). Fees are required to maintain CREST membership and access accreditation benefits.
2. Accreditation Application Fees: Non-refundable fees charged when organizations submit accreditation applications. Covers assessment of application, one resubmission if initial application fails, and administrative processing. Fees vary by accreditation type from £500 to £1,200 depending on discipline.
3. Joining Fees: One-time joining fees for new members based on annual revenue tiers. Revenue thresholds determine fees ranging from £1,500 for revenue below £1m to £25,000 for revenue above £50m. Applied only at initial membership, not for renewals or additional accreditations.
4. Professional Certifications: Revenue from CREST professional certification exams including CPSA, CRT, CCT INF, CCT APP, CPIA, CRIA, CCIM, CPTIA, CRTIA, CCTIM, CCRTS, CCSAM. Discounts available for Pathway/Pathway+ members and low-income countries.
5. Additional Accreditation Subscription Fees: Annual fees for specific accreditations beyond base membership: Mobile & Web Application Testing (OVS) at £2,000/year and CIS Controls Accreditation at £1,200/year.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels6 records

Core offering

CREST is an international not-for-profit accreditation and certification body for the cybersecurity industry. It accredits cybersecurity service provider companies across multiple technical disciplines (penetration testing, incident response, SOC, threat intelligence, security architecture) and certifies individual practitioners through professional examinations. CREST also operates a marketplace that connects organizations seeking cyber services with its community of accredited suppliers.

Product overview

CREST is a global accreditation and certification body for the cyber security industry, offering a multi-layered portfolio of accreditation programmes for organizations and professional certifications for individuals. The core offering consists of organizational accreditation across seven cyber security disciplines: Penetration Testing, Vulnerability Assessment, Threat Intelligence, Incident Response, Security Operations Centres (SOC), Security Architecture, and Threat-Led Penetration Testing (STAR/STAR-FS). Supporting the accreditation programmes are professional certifications for individuals at various career stages (Practitioner, Registered, and Certified levels) spanning penetration testing, intrusion analysis, incident management, red teaming, and threat intelligence. The portfolio also includes maturity assessment tools, an online marketplace for finding accredited suppliers, and the CREST CAMP capacity-building programme for developing markets. CREST serves over 500 member companies worldwide and manages government/regulator schemes including CBEST, TIBER-EU, ASSURE, NCSC CHECK, and Dubai Cyber Force.

Differentiator

Problem solved

Functional benefit

Brands

• CREST AI Charter: Industry framework establishing principles for the responsible use of artificial intelligence in cyber security services covering governance, transparency, accountability, and data protection.
• CREST CAMP
• CREST Marketplace

Products and services

• Organizational Accreditation Programme
• Professional Practitioner Certifications
• CREST Marketplace

Quantifiable outcome

• Over 500 member companies quality assured and accredited globally
• +2 more outcomes

Named customers5 records

Segments4 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

17 partnerships are on record, tiered flagship and core.

• NCC GroupflagshipStrategic or Co-development Partner · 24 June 2026NCC Group became a founding signatory of the CREST AI Charter, an industry framework establishing nine principles for the responsible use of artificial intelligence in cybersecurity services covering governance, transparency, accountability, and data protection.
• SynackcoreStrategic or Co-development Partner · 4 June 2026Synack expanded its partnership with CREST by adding two new certifications (CREST Certified Tester Infrastructure and CREST Certified Tester Application) to its Synack Red Team Pathways program. This gives CREST-certified security researchers a direct route to join the SRT community and adds third-party credentialing important for DORA, NIS2, and TIBER-EU compliance.
• AbacuscoreStrategic or Co-development Partner · 7 April 2026Abacus achieved CREST accreditation for its penetration testing services following independent audit between October 2025 and February 2026. The accreditation validates that Abacus meets technical, ethical, and legal standards for penetration testing, placing it among rare MSPs with this benchmark.
• UK Foreign, Commonwealth & Development Office (FCDO)flagshipStrategic or Co-development Partner · 1 September 2024CREST CAMP (Cyber Accelerated Maturity Programme) is funded by UK FCDO, targeting 11 countries from September 2024 to March 2025 to improve cybersecurity maturity and private sector involvement through mentoring, training, and accreditation pathways.
• UK Department of Foreign Affairs and Trade (DFAT)flagshipStrategic or Co-development PartnerCREST CAMP supported by DFAT alongside FCDO and EBRD as international donor partners funding capacity-building programs across 14+ countries.
• European Bank for Reconstruction and Development (EBRD)flagshipStrategic or Co-development PartnerCREST CAMP supported by EBRD as international donor partner alongside FCDO and DFAT, funding cybersecurity capacity building globally.
• UK Bank of EnglandflagshipStrategic or Co-development PartnerCREST developed CBEST framework with UK Bank of England to deliver controlled, bespoke, intelligence-led cyber security tests for systemically important financial institutions. CREST helps develop accreditation standards for CBEST penetration testing.
• UK National Cyber Security Centre (NCSC)flagshipStrategic or Co-development PartnerCREST delivers CHECK scheme (approved penetration tests for public sector and CNI), NCSC CIR Standard Level scheme, and Cyber Incident Exercising (CIE) scheme in partnership with NCSC.
• UK Civil Aviation Authority (CAA)coreStrategic or Co-development PartnerCREST developed ASSURE scheme with UK CAA for cyber security audits of aviation organizations under CAP 1753 framework.
• Dubai Electronic Security Center (DESC)coreStrategic or Co-development PartnerDESC Cyber Force program enables CREST-qualified individuals and accredited companies to register as cybersecurity service providers for Dubai government, semi-government, and critical information infrastructure sectors.
• European Central Bank (ECB)coreStrategic or Co-development PartnerCREST supports TIBER-EU framework enabling European and national authorities to test financial sector resilience against sophisticated cyber attacks.
• Hong Kong Monetary Authority (HKMA)coreStrategic or Co-development PartnerCREST supports iCAST framework introduced by HKMA for threat intelligence-led security testing of banks under Cyber Resilience Assessment Framework.
• UK Cabinet OfficecoreStrategic or Co-development PartnerCREST developed GBEST scheme based on CBEST model, being rolled out across UK Government Departments with NCSC providing technical assurance.
• UK Cyber Security CouncilcoreStrategic or Co-development PartnerCREST certifications align with UK CSC professional titles framework. CHECK scheme requires CTLs and CTMs to hold UK CSC professional titles at Practitioner and Principal levels respectively.
• OWASPcoreTechnology or IntegrationCREST OVS quality assurance standard is aligned to OWASP's Application Security Verification Standard (ASVS) and Mobile Application Security Verification Standard (MASVS).
• Center for Internet Security (CIS)coreStrategic or Co-development PartnerCREST offers CIS Controls Accreditation for organizations assessing client implementation of CIS Critical Controls.
• UK CAA (ASSURE)coreStrategic or Co-development PartnerCREST and UK CAA collaborated to develop the ASSURE scheme for third-party cyber security audits of aviation organizations.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• CompTIA: CompTIA is a large, established provider of vendor-neutral IT certifications (Security+, PenTest+, CySA+) that overlaps with CREST's entry- and mid-tier cybersecurity certification portfolio and is widely recognized by employers and governments.
• PCI Security Standards Council: PCI SSC is an industry-led standards body that qualifies security assessors (QSAs) and approves scanning vendors for the payments ecosystem, operating an analogous accreditation model in the adjacent payments-cyber segment.
• IAPP (International Association of Privacy Professionals): IAPP is a global non-profit certification and membership body for privacy professionals (CIPP, CIPM, CIPT), adjacent in mission and member-funded business model to CREST's privacy- and security-accreditation role.

Direct peers

• EC-Council: EC-Council issues the Certified Ethical Hacker (CEH) and other offensive security credentials, competing for the same individual certification and training demand that CREST addresses via CRT, CCT, and CCSAM/CCRTS.
• ISACA: ISACA is a global non-profit membership body that issues widely recognized cybersecurity and IT governance certifications (CISA, CISM, CGEIT, CRISC) and serves as a direct peer in professional credentialing for the cybersecurity workforce.
• APMG International: APMG accredits and manages professional certification schemes (e.g., ISO/IEC 27001, cyber resilience schemes), operating the same accreditation-and-certification business model as CREST across adjacent standards.
• Offensive Security: Offensive Security issues the OSCP and other hands-on penetration testing certifications, positioning it as a direct peer for offensive-security individual credentials that overlap with CREST's CCT INF and CCT APP certifications.
• (ISC)²: (ISC)² is a global non-profit cybersecurity professional certification body best known for the CISSP credential, making it the most direct peer to CREST's role as an accreditation and certification body for cybersecurity professionals and organizations.
• SANS Institute: SANS Institute delivers cybersecurity training and awards the GIAC family of certifications, overlapping directly with CREST's penetration testing, incident response, and SOC certification offerings.

Others

• NCSC (UK National Cyber Security Centre): UK NCSC is the regulator that delegates delivery of CHECK, CIR, and CIE schemes to CREST and licenses other accreditors; it is a key ecosystem partner and the source of CREST's strongest UK regulatory moat.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• YouTubeyoutube.com/@CREST-International
• LinkedInlinkedin.com/company/crest-approved
• Xx.com/crestadvocate

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CREST