For Bath's edtech, engineering software and lettings platform teams. Flat fee, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Bath is a compact city with two universities, a strong engineering and architecture consultancy tradition and a share of the wider Bristol and Bath software cluster. Spin-outs and small product companies work from the city centre and nearby business parks, building learning platforms, design and project tools, and property software for a rental market shaped by students and visitors.
Teams here often sell to institutions that run formal assessments: universities, schools, multi-academy trusts and large engineering clients. Those buyers expect an independent test before data flows. Bath companies tend to be small, so a flat CREST fee with a retest included is easier to plan around than an open-ended engagement.
Edtech teams in Bath build assessment, tutoring and course platforms used by schools, universities and training providers. They hold pupil and student records, and schools are expected to check the security of the services they buy.
What we focus onTeacher, pupil and parent role separation, class and cohort isolation, assessment answer exposure, LTI and SSO integrations with school systems, safeguarding note access, and bulk roster imports.
Consultancies and software firms around Bath build tools for design collaboration, building data and project delivery. Clients share drawings and commercial information through them, and major contractors ask suppliers about access control and data handling.
What we focus onProject-level permissions, external collaborator access, large file uploads and model processing, version history exposure, share link controls, and API access used by design software plug-ins.
Bath's student and visitor rental market runs on lettings, tenancy and maintenance platforms. They store ID documents, guarantor details and deposits, which makes them a target and a UK GDPR concern for landlords and agents.
What we focus onTenant and guarantor document access, landlord and agent role boundaries, deposit and rent payment flows, maintenance photo uploads, viewing booking APIs, and referencing data shared with third parties.
Platforms selling to Bath's universities, schools and consultancies usually fail at the boundaries between user groups, so that is where we look hardest.
Teacher accounts that can request any class or pupil ID, not just their own. In a multi-academy trust, that can expose pupils at other schools, including safeguarding notes.
Learning tool integrations that trust role or user claims without properly verifying the signed launch. An attacker can launch as an instructor and view or change other students' grades.
Lettings platforms storing ID and payslip uploads at predictable URLs. Anyone who learns one file path can retrieve documents for other tenants and guarantors, a serious UK GDPR breach.
External consultants invited to one project who can list or open files from others through search or API calls. Commercial information then leaks between clients sharing the same platform.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
The Department for Education's digital standards ask schools and trusts to consider the security of their suppliers. A CREST report gives your sales team clear evidence to share during that check.
Universities run third-party risk reviews before contracts that involve student data. An independent pentest with retest results shortens those reviews and answers the testing questions directly.
Schools, universities and letting agents often complete a DPIA before adopting new software. Your pentest report helps them evidence the security measures section and record residual risk.
Usually the test date, the scope, and whether any critical or high findings remain open. They also care about pupil data separation between schools in the trust. We test that boundary specifically, and the retest report shows what has been fixed, which is normally the deciding point.
The upload and processing endpoints are part of your web application, so yes. We check file type validation, size and parsing limits, path handling, and whether processed outputs are stored with the right permissions. Desktop plug-ins are separate software and would be scoped separately.
Larger agencies and institutional landlords increasingly include security questions in supplier reviews. Even when nobody asks, you hold ID documents and financial details for every tenant, so a breach would land on you under UK GDPR. A flat fee makes testing affordable before the question arrives.
No. CyberFortify has no Bath office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
