For Armagh's agri-food, orchard and visitor businesses selling online. One flat price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Armagh is a small cathedral city whose wider area is known for agri-food, from meat and dairy processing to the orchards that produce Armagh Bramley apples. Its visitor economy includes the Armagh Observatory and Planetarium and the city's two St Patrick's cathedrals. Local firms increasingly sell online, trade with supermarkets through supplier portals, and track produce digitally.
Most Armagh businesses are not software companies, but many now run custom web applications. Supermarket and food-service buyers send supplier questionnaires that include cyber security. Online shops take card payments. A flat-priced CREST test lets a small business get an independent answer without committing to open-ended consultancy fees.
Food processors and producer groups in the Armagh area exchange orders, specifications and traceability data with retailers and wholesalers. Large customers include cyber questions in supplier audits. Food fraud concerns make data integrity important.
What we focus onTraceability and batch record integrity, customer and supplier portal access, order and pricing APIs, certificate document storage, and integration with retailer EDI or ordering systems.
Orchard growers, cider makers and craft food producers sell direct online and through subscriptions. These shops store customer accounts, addresses and payment tokens, often on custom builds. Small teams rarely test them.
What we focus onCheckout and pricing integrity, subscription changes, age verification for alcohol sales, customer account security, and admin access used by small teams. We also check how delivery addresses and gift messages can be changed after an order is placed.
Attractions, heritage sites and event organisers sell tickets and memberships online. Seasonal peaks and small teams make these booking systems attractive targets. Ticket and member data are both valuable to fraudsters, and outages at busy times are costly.
What we focus onTicket and capacity APIs, membership account takeover, discount and concession abuse, booking data exposure, and admin panels for event management. We also test group and school booking forms, which often collect more personal data than single tickets.
Armagh businesses often run one custom system that does a lot, so these findings concentrate on traceability, online sales and bookings.
A traceability system lets a user edit batch or origin data after it has been approved, with no audit trail. That can undermine recalls and supplier audits.
An online drinks shop asks for date of birth on screen, but the order API accepts purchases without it. The legal control can be skipped entirely.
Customers can pause, change or cancel subscriptions by order reference without ownership checks, letting anyone alter other customers' orders and see their addresses. It is easy to automate.
Concession or member prices are applied based on a flag in the request. Anyone can buy discounted tickets by changing a single value. Losses grow quietly over a season.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Supermarkets and food-service groups ask suppliers about cyber security during onboarding and audits. A CREST pentest report gives a clear, dated answer about any portal or system you run.
Small merchants complete a PCI DSS self-assessment questionnaire. Where you run a custom checkout, testing helps confirm the payment integration is set up so card data stays protected.
Small firms holding customer and member data must keep it secure. Pentest results are practical evidence of appropriate measures if the ICO ever asks.
Not always. If you have no web application of your own and use standard software, Cyber Essentials may answer their questions. If you run a supplier portal, traceability system or online ordering platform that the retailer's data passes through, a pentest of that application is the right evidence. We will tell you which applies.
Yes. We test whether age checks are enforced on the server and cannot be skipped by calling the order API directly or altering requests. We do not assess whether your chosen verification method meets licensing law, which is a question for your licensing adviser.
Test in the quieter months, against a staging copy if possible. That leaves time to fix findings and complete the retest before peak season. Testing a staging environment also avoids any effect on live bookings. Reports arrive in four to seven working days.
No. CyberFortify has no Armagh office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
