For Bangor's research spin-outs, Welsh-language software and ocean data teams. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Bangor is a university city on the Menai Strait, and Bangor University shapes much of its tech economy. M-SParc, the science park on Anglesey, houses startups and spin-outs, while the university's ocean sciences work at Menai Bridge supports marine data and environmental technology. North Wales also has a strong cluster of firms building bilingual Welsh and English software for public services.
Young teams here often meet security requirements for the first time through a buyer. A council or health board asks for testing before a bilingual service goes live, a research partner wants evidence before sharing data, or an investor asks during a funding round. A fixed £2,400 keeps that first test predictable.
Councils and public bodies in Wales must offer services in Welsh and English, and local firms build the apps that do it. Buyers check the security of both language versions before residents use them.
What we focus onParity of access controls between Welsh and English routes, resident account security, form submissions and uploads, translation and content management roles, and payment pages for council services.
Ocean, coastal and environmental monitoring platforms collect sensor and survey data for researchers, regulators and energy developers. Partners and funders want to know that data cannot be altered or downloaded without permission.
What we focus onAPI authentication for sensor uploads, data integrity and edit history, dataset sharing permissions between organisations, map and query features prone to injection, and storage bucket configuration.
Startups at M-SParc and from the university are often preparing for their first enterprise customer or funding round. Both ask whether the product has been tested independently, and young teams rarely have an answer ready.
What we focus onAdmin and onboarding flows, subscription and licensing logic, user invitation and role management, secrets in front-end code, and the cloud services the prototype was built on.
Bangor apps are often bilingual, research-led or both. These are the weaknesses we see most in software built that way.
A Welsh version of a page or API added as a separate route without the same authorisation middleware. The English page is locked down; the Welsh one is open.
Endpoints that accept readings from devices with a shared key, or none. Anyone who finds the key can inject false data into a dataset that researchers or regulators rely on.
Sharing features that grant access to a whole project rather than one dataset. A partner sees data they were never given, including unpublished results and sensitive site locations.
Cloud and third-party API keys compiled into JavaScript during early development. Attackers can read them in the browser, then run up cloud bills or access storage and email services directly.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Welsh councils and health boards include security requirements in contracts for resident-facing services. A CREST report covering both language versions gives their teams the testing evidence they need.
Data sharing agreements with universities and public bodies often require appropriate technical security. A pentest shows partners your platform's controls were tested, not only described.
Investors and grant funders reviewing technology businesses ask about security. An independent pentest with retest results answers that question and shows maturity early.
No. If both languages run on the same codebase and API, it is one application at £2,400. We test both language versions, because separate routes and templates are a common place for access controls to differ. Our report is in English; findings refer to the exact Welsh and English URLs affected.
Not within the fixed price. We test the web platform and API that receive and present the data, including how devices authenticate to it. Testing the sensors, firmware or radio links is separate work. We will tell you if the API makes it easy to forge device data.
Ideally once the product is stable enough that findings will not be overtaken by a rewrite, and before due diligence starts. Testing early gives you time to fix issues and use the retest to show they are closed. A report dated within the last year is what investors usually expect.
No. CyberFortify has no Bangor office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
