✓Tender information last checkedLast checked 7 Oct 2026, 13:56.
Opportunity overview
IMPORTANT: Please read this section before deciding whether you wish to register for this event. This section provides you with information regarding the scope of this procurement and details some of the key requirements that a successful applicant MUST be able to deliver.
This tender is for a new direct contract for a Continuous Testing supplier to implement and provide a fully governed continuous testing framework for IT covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation re-testing. The preferred supplier must support red and purple team testing that will include a multi phase continuous testing model (e.g. tag and release), where red team activity transitions into purple teaming upon detection, and findings are shared in cycle while testing continues across subsequent phases.
The service must include active collaboration with Thames Water teams during purple team activities, including validation of controls, detection capability, and response processes.
The solution must demonstrate clear human oversight across testing, validation, and remediation activities, with automation used to support workflows (e.g. tracking, reporting, prioritisation) but not to replace core testing, validation, or assurance activities.
The supplier must support collaborative remediation and retesting, ensuring findings are handed over, validated, and retested with Thames Water teams, with end to end traceability through to closure.
The following conditions would be considered as some of key requirements for a supplier to meet to be considered for this opportunity:
• Availability of a yearly penetration test as a minimum
• A fully functional PTaaS service that can deliver service in line with applicable cadences
• A qualified, accredited and suitably vetted PTaaS support team
Thames Water reserves the right to refine the award criteria. Please note that that deadline for asking for access to the PSQ & submitting of the PSQ is Tuesday, 3 November 2026, at 12 p.m.
Classification
CPV72000000 — IT services: consulting, software development, Internet and support
Additional information from the published procurement release. Fields appear only when supplied by the source; check the original notice and tender documents before acting.
Scope, procedure and submissions
Id
FA2445
Status
active
Procurement Method
selective
Procurement Method Details
Competitive flexible procedure
Main Procurement Category
services
Above Threshold
Yes
How to submit
If you are interested in participating, please complete this form:
https://forms.cloud.microsoft/e/xBDaHtLPD7
This Competitive Flexible Procedure will be a multi-stage process featuring a PSQ phase, and then a multi-stage ITN phase. The PSQ phase will invite through no more than six (6) Suppliers to the first stage of the ITN. The ITN will then be split into two stages. Stage 1 will invite Suppliers to provide commercial and technical responses to the requirements and associated technical questions whilst Stage 2 will progress chosen Suppliers to a further negotiation and presentation stage.
Further information regarding the make-up of the competition can be found enclosed within the process pack.
Special regime
utilities
Submission terms
Electronic Submission Policy
allowed
Languages
en
Enquiry period
Ends
20 Oct 2026, 17:00
Expected award period
Ends
29 Jan 2027, 23:59
Lots and requirements
Entry 1
Id
1
Status
active
Has Renewal
Yes
Value
Including VAT
2,400,000
Amount
2,000,000
Currency
GBP
Award criteria
Criteria
Criterion 1
Type
quality
Name
Technical
Numbers
Entry 1
Number
70
Weight
percentageExact
Criterion 2
Type
price
Name
Commercial
Numbers
Entry 1
Number
30
Weight
percentageExact
Selection criteria
Criteria
Criterion 1
Description
There are a combination of Pass/Fail evaluated questions and technical questions which will be evaluated. A detailed explanation of what is expected from bidders for each evaluated question is available in the procurement documentation through our sourcing platform Ariba.
For Reduction
Yes
Suitability
Sme
Yes
Contract period
Starts
1 Apr 2027, 00:00
Ends
31 Mar 2030, 23:59
Max Extent Date
31 Mar 2035, 23:59
Renewal
Description
Thames Water envisages that the contract will be awarded for an initial term of 3 years with options to extend by 1 year or longer, up to a maximum overall term of 8 years.
Items and delivery
Item 1
Id
1
Related Lot
1
Additional Classifications
Entry 1
Scheme
CPV
Id
72000000
Description
IT services: consulting, software development, Internet and support
1 published notice version reviewed by ProcuraAxis.
1 VERSION
1
094688-2026Tender notice on Find a Tender ·
PROCURAAXIS ANALYSIS
ProcuraAxis Analysis
Our approved analysis of the opportunity appears below the official tender information.
ANALYSIS PREVIEW
Opportunity intelligence at a glance
Thames Water is seeking a supplier for a continuous penetration testing as a service (PTaaS) arrangement, covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery, remediation support and retesting. The service requires a governed, multi-phase continuous testing model with active collaboration and human oversight.
Who this may suit
Suitable for established cyber-security testing and PTaaS providers able to deliver annual penetration testing at minimum, continuous red/purple team operations, collaborative remediation and end-to-end finding traceability. The tender states the support team must be qualified, accredited and suitably vetted, but does not name required accreditations.
Key points identified
Continuous testing capabilityProvide a fully governed continuous testing framework covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation retesting.Evidence: “implement and provide a fully governed continuous testing framework for IT covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation re-testing.”
Red and purple team modelSupport a multi-phase continuous testing model in which red team activity transitions into purple teaming on detection, with findings shared during ongoing testing.Evidence: “support red and purple team testing that will include a multi phase continuous testing model... where red team activity transitions into purple teaming upon detection, and findings are shared in cycle while testing continues”
Collaboration with buyer teamsCollaborate actively with Thames Water teams to validate controls, detection capability and response processes during purple-team activities.Evidence: “active collaboration with Thames Water teams during purple team activities, including validation of controls, detection capability, and response processes.”
95% approved-analysis confidence9 supplier criteria identified4 risks or unknowns
ProcuraAxis structures information found in published procurement records, checks the result for consistency and publishes only approved analysis. Confidence describes the completeness and consistency of the available source information; it is not a guarantee of eligibility or contract award.
Thames Water is seeking a supplier for a continuous penetration testing as a service (PTaaS) arrangement, covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery, remediation support and retesting. The service requires a governed, multi-phase continuous testing model with active collaboration and human oversight.
Who this may suit
Suitable for established cyber-security testing and PTaaS providers able to deliver annual penetration testing at minimum, continuous red/purple team operations, collaborative remediation and end-to-end finding traceability. The tender states the support team must be qualified, accredited and suitably vetted, but does not name required accreditations.
Key deliverables
Governed continuous testing framework
Penetration testing, at least annually
Red and purple team exercises using a multi-phase model
Cyber stress testing and vulnerability discovery
Collaborative remediation, validation and retesting
Traceable findings management through to closure
Human-led testing and assurance supported by workflow automation
SUPPLIER REQUIREMENTS
9 criteria identified
Continuous testing capability
99% confidence
Provide a fully governed continuous testing framework covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation retesting.
View supporting evidence
“implement and provide a fully governed continuous testing framework for IT covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation re-testing.”
Red and purple team model
98% confidence
Support a multi-phase continuous testing model in which red team activity transitions into purple teaming on detection, with findings shared during ongoing testing.
View supporting evidence
“support red and purple team testing that will include a multi phase continuous testing model... where red team activity transitions into purple teaming upon detection, and findings are shared in cycle while testing continues”
Collaboration with buyer teams
98% confidence
Collaborate actively with Thames Water teams to validate controls, detection capability and response processes during purple-team activities.
View supporting evidence
“active collaboration with Thames Water teams during purple team activities, including validation of controls, detection capability, and response processes.”
Human oversight
99% confidence
Demonstrate human oversight for testing, validation and remediation; automation may support workflow but cannot replace core assurance activities.
View supporting evidence
“clear human oversight across testing, validation, and remediation activities, with automation used to support workflows... but not to replace core testing, validation, or assurance activities.”
Remediation and retesting
99% confidence
Support collaborative handover, validation and retesting of findings with Thames Water, with traceability to closure.
View supporting evidence
“support collaborative remediation and retesting... with end to end traceability through to closure.”
Penetration-test frequency
99% confidence
Provide at least one penetration test each year.
View supporting evidence
“Availability of a yearly penetration test as a minimum”
PTaaS service
96% confidence
Operate a fully functional PTaaS service able to deliver to applicable cadences.
View supporting evidence
“A fully functional PTaaS service that can deliver service in line with applicable cadences”
Support team
98% confidence
Provide a qualified, accredited and suitably vetted PTaaS support team.
View supporting evidence
“A qualified, accredited and suitably vetted PTaaS support team”
Supplier eligibility conditions
95% confidence
Unknown beyond the stated capability and team requirements.
View supporting evidence
No further supplier eligibility, economic/financial standing, insurance, location or organisation-size conditions are supplied.
COMMERCIAL AND DELIVERY
Contract intelligence
Commercial
Estimated contract value
96% confidence
Up to £2,000,000.
View supporting evidence
Opportunity value_max and Lot 1 value amount are both GBP 2,000,000.
Contract term
99% confidence
Unknown.
View supporting evidence
Contract start and end dates are not supplied.
Pricing and payment terms
99% confidence
Unknown.
View supporting evidence
No pricing model, payment terms or rate-card requirements are supplied.
Delivery
Delivery locations
90% confidence
United Kingdom: London (UKI) and South East England (UKJ).
View supporting evidence
Delivery locations are listed as regions UKI and UKJ.
Buyer location
98% confidence
Reading, United Kingdom.
View supporting evidence
Buyer location is listed as Reading, RG1 8DB.
Service delivery model
99% confidence
Unknown.
View supporting evidence
The supplied notice does not state whether delivery must be on-site, remote or hybrid.
PROCEDURE
How to respond
Opportunity status
98% confidence
Open tender.
View supporting evidence
Display status is “open”; source status is “active”.
Procurement procedure
99% confidence
Selective procurement using a competitive flexible procedure.
View supporting evidence
Procurement method is “selective”; procurement method details are “Competitive flexible procedure”.
PSQ
94% confidence
A PSQ is referenced.
View supporting evidence
The description refers to “asking for access to the PSQ” and “submitting of the PSQ”.
Submission deadline
99% confidence
20 October 2026, 17:00 BST.
View supporting evidence
Structured submission deadline is 2026-10-20T17:00:00+01:00, including for Lot 1.
Award criteria
97% confidence
May be refined by Thames Water.
View supporting evidence
“Thames Water reserves the right to refine the award criteria.”
RISKS AND UNKNOWNS
Points requiring attention
Conflicting PSQ deadline information
99% confidence
The narrative gives 3 November 2026 at 12:00 as the PSQ access/submission deadline, while the structured opportunity and lot submission deadline is 20 October 2026 at 17:00.
View supporting evidence
Description: “deadline for asking for access to the PSQ & submitting of the PSQ is Tuesday, 3 November 2026, at 12 p.m.” Structured deadline: 2026-10-20T17:00:00+01:00.
Unspecified accreditation standard
97% confidence
The team must be accredited, but no certification, accreditation body or acceptable equivalent is identified.
View supporting evidence
“A qualified, accredited and suitably vetted PTaaS support team”.
Award criteria subject to change
97% confidence
Evaluation requirements may change before award.
View supporting evidence
“Thames Water reserves the right to refine the award criteria.”
Contract term and commercial model unknown
99% confidence
Duration, pricing structure and payment terms are not supplied.
View supporting evidence
No contract dates or commercial terms are included in the supplied data.
ProcuraAxis analysis supplements, but does not replace, the original notice and tender documents. Always verify eligibility, deadlines and commercial terms with the issuing authority.
Continue in your ProcuraAxis workspaceFree account · Full approved analysis