For Brighton's digital agencies, games studios and consumer app teams. One price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Brighton and Hove has one of the densest clusters of digital agencies and creative tech businesses on the south coast. Studios around the North Laine and the seafront build websites, apps and platforms for clients across the UK, while games developers and small product companies ship consumer apps of their own. Many teams are small, move fast and hand over code to clients who then own the risk.
That handover is where testing comes in. Agency clients increasingly write a pentest into acceptance criteria before launch. Games and consumer apps attract fraud, cheating and account takeover from day one. A fixed price per app suits agencies, because it can be quoted into a project budget without day-rate surprises.
Agencies build client portals, e-commerce sites and campaign platforms, then hand them over. Clients, especially larger brands and charities, now ask for an independent pentest before go-live so they are not inheriting unknown problems.
What we focus onAdmin panels left reachable, CMS plugin exposure, form handlers, file uploads, staging environments with production data, and API endpoints built quickly for a single campaign and never locked down.
Studios run account systems, stores, leaderboards and community features on web APIs. Those APIs are probed by players looking for free currency or unfair advantage, and platform partners expect basic security assurance.
What we focus onClient-trusted values in purchase and reward calls, leaderboard tampering, account linking between platforms, in-game currency logic, rate limiting on reward endpoints and moderation tools that can be abused.
Small product teams in Brighton run subscription services, dating, wellbeing and lifestyle apps with large user bases. Personal data, payments and messaging make them a target, and app store reviews do not cover security.
What we focus onAccount takeover through password reset and magic links, profile and message IDOR, subscription entitlement checks done only on the client, and exposure of user data through search or recommendation APIs.
In agency builds and consumer apps shipped from Brighton, these problems turn up again and again.
A staging site or /admin path is still public after launch, sometimes with default credentials or real customer data copied across. It is an easy win for attackers and an awkward conversation with the client.
The app sends the price, quantity or reward amount and the server accepts it. In games and shops this lets players mint currency or buy items for nothing, and it is usually simple to fix once found.
Reset tokens that do not expire, can be reused, or leak through referrer headers make account takeover straightforward. For consumer apps with stored cards or private messages, that becomes a serious breach.
Mobile and single-page apps call endpoints that return full user objects, including email, location or date of birth, and the front end simply hides the extra fields. Anyone with a proxy can read them.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Games and apps likely to be used by under-18s must meet the Age Appropriate Design Code. A pentest shows that profile, chat and location data are not exposed through the app or its API.
Agencies building checkouts for clients often need to show the payment page and surrounding scripts are not tampered with. We test the web app and report in a way the client's PCI assessor can use.
More client contracts now name an independent security test or OWASP ASVS level as a launch condition. A CREST report with retest results gives agencies a clean sign-off document to hand over.
Yes. We can address the report and attestation letter to your client, or to you, depending on who owns the application and the contract. Many agencies include the test as a line item in the project quote, then hand the report over at launch alongside the retest results.
Yes. The £2,400 covers the web application and its API, which for most studios means the account, store, reward and leaderboard services. Reverse engineering a native game client or mobile build is a separate piece of work, scoped and quoted on its own.
Usually, if you book promptly. Reports arrive four to seven working days after testing starts, which leaves time to fix and request the retest. Tell us your launch date when you book so we can plan the window around it, and test against a staging copy that mirrors production.
No. CyberFortify has no Brighton and Hove office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
