For Birmingham's banking, legal tech and digital health teams. No day rates, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Birmingham is the largest UK city outside London and one of its biggest financial and professional services centres. Major banks run UK operations from the city, Colmore Row is lined with law and accountancy firms, and large NHS trusts make it a significant health market. The city's several universities add a steady stream of software start-ups selling into all three.
Banks, law firms and NHS trusts are demanding buyers. Each has its own supplier assurance process, and each asks for recent independent penetration testing before data is shared. For a Birmingham SaaS team, one CREST report can be reused across all three, as long as it clearly covers the application they are buying.
Software providers to banks, from onboarding and payments tools to complaints and case management, are treated as material third parties. Bank procurement teams require recent pentest evidence before contract and often each year after.
What we focus onMaker-checker and approval workflow enforcement, payment initiation controls, customer data segregation, privileged staff functions, and audit logging that a bank's own risk team can rely on.
Case management, document automation and client portals hold privileged and commercially sensitive material. Law firms' corporate and banking clients increasingly audit their firms' suppliers, pushing testing requirements down the chain.
What we focus onMatter-level permissions and ethical walls, document version and sharing controls, client portal separation, e-signature workflows, and search features that may reveal documents a user should not see.
Apps and platforms used by hospital trusts, GP practices and patients handle health records. NHS buyers assess suppliers through national frameworks that ask directly whether a penetration test has been carried out.
What we focus onClinician, administrator and patient role separation, patient record access by identifier, session handling on shared clinical workstations, integration interfaces, and data exposed through reporting or export features.
Birmingham's banking, legal and health platforms are built around permissions, and the gaps we find most often are where those permissions quietly fail.
Approval steps enforced only in the interface can be skipped by calling the final API directly. A single user can then create and approve a payment or change that should need two people.
Firm-wide search can return titles or snippets from matters a user is walled off from. Even partial results can reveal a confidential client relationship or deal.
Shared workstations on wards need short, reliable session timeouts. Long-lived sessions, or logouts that do not end the session server-side, let the next user act as the previous clinician.
Patient or appointment endpoints that accept an ID without checking the caller's relationship to that patient let any authenticated user browse other people's health information.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Banks must manage outsourcing risk under FCA rules. They ask suppliers for independent testing evidence, and a CREST report with retest letter is the standard answer.
The DTAC and the Data Security and Protection Toolkit ask about penetration testing. A recent CREST report gives NHS buyers the evidence they expect from digital health suppliers.
Banking and corporate clients audit their law firms' technology suppliers. A pentest report lets legal tech vendors answer those audits once and share the result across firms.
Usually, yes. If each bank uses the same product, the same report answers each questionnaire. We can issue attestation letters addressed to individual banks. If a bank asks for testing of a specific configuration or integration built just for them, that may need its own scope.
The DTAC asks whether a penetration test has been carried out and expects it to be done properly, and many trusts specifically look for CREST. A CREST-accredited test is the safest way to answer that question without follow-ups from the trust's information governance team.
Yes. We create users on both sides of a wall and try to reach restricted matters through every route: direct links, search, reports, exports, notifications and the API. Ethical wall failures are often found in features built after the walls were designed.
No. CyberFortify has no Birmingham office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
