For Bradford's mortgage and savings suppliers, grocery supply chain and manufacturers.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Bradford's economy mixes mutual financial services, the head office of one of the UK's big grocery retailers and a manufacturing base that grew out of the city's wool and textile trade. Engineering, chemicals and food production still employ many people. The city has one of the youngest populations in England, and a digital sector is growing alongside it. Local software often serves savers, suppliers or factory floors.
The pressure to test comes through supply chains. A building society will not onboard a broker or mortgage tech supplier without security evidence. A national grocer expects suppliers using its portals and data feeds to protect them. Manufacturers face customers asking about their web systems too. A fixed-price CREST pentest meets all three.
Mortgage application, broker and savings platforms connect to building societies and lenders. They hold income, identity and bank account data, and lenders' third-party risk teams require independent testing before integration.
What we focus onDocument access between applicants and brokers, identity verification bypass, savings withdrawals and nominated account changes, broker role escalation, and APIs that submit cases to lender systems.
Suppliers, growers and logistics firms working with large grocers run ordering, forecasting and promotions tools. Grocers include those systems in their supplier security checks, especially where data feeds connect directly.
What we focus onSupplier-to-supplier data separation, pricing and promotion data exposure, ordering and forecast API integrations, user management for external accounts, and bulk download of sales or forecast data.
Bradford manufacturers use customer portals, product configurators and B2B ordering sites. Larger customers now ask about those sites' security during supplier qualification, and many firms have never had them tested.
What we focus onQuote and price manipulation, customer account separation, order history and invoice access, file upload for specifications and drawings, and exposed admin interfaces on older platforms.
In Bradford's lending, grocery supply and manufacturing systems, these four issues are the ones we most want teams to catch before a buyer does.
Broker portals that filter cases only in the interface let a broker query other firms' applications through the API. That exposes income, identity and credit information for many applicants.
Savings platforms that let a user change their nominated withdrawal account without fresh verification invite fraud. Combined with reused passwords, money can be moved quickly.
Supplier portals with export endpoints that ignore supplier boundaries let one supplier pull competitors' sales or pricing data. Grocers treat this as a serious breach of trust.
Older B2B ordering sites often have admin logins reachable from anywhere, with default paths and outdated components. Automated attacks scan for these constantly and need no inside knowledge.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Lenders and building societies must manage risk from the services they outsource. Your CREST report gives their third-party risk team independent evidence to file against your service.
Large grocers ask suppliers about access control, testing and data protection. A recent pentest and retest letter answer the testing questions directly.
Mortgage and savings data is high-risk personal data. Testing and fixing access control flaws lowers the chance of a reportable breach and shows the ICO you took reasonable steps.
Expect them to ask who tested, when, what was in scope and whether high and critical findings were fixed. Some will want the full report, others a summary and retest letter. Our CREST report covers your web app and API, and the retest is included. Tell us about their requirements at booking so the scope matches.
If the feed runs through an API that is part of your web application, yes. We test authentication, access control and data separation on it. If it uses a separate EDI or file transfer service, that is usually a different scope. We will look at your setup and tell you what the £2,400 covers before you commit.
If it still takes orders or holds customer data, yes. Older platforms often carry outdated components and exposed admin areas that automated attacks find quickly. A test tells you what to fix now and gives your replacement project a list of risks to avoid. If replacement is only weeks away, test the new system instead.
No. CyberFortify has no Bradford office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
