For Bristol's SaaS scale-ups, fintechs, media tech and aerospace suppliers. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Bristol has one of the deepest tech economies outside London. Aerospace engineering around Filton, chip design firms, a university spin-out pipeline and incubators such as Engine Shed sit alongside a creative industry known for natural history film-making and animation. The MOD's procurement organisation at Abbey Wood also draws defence suppliers to the north of the city.
Many Bristol companies are venture-backed and selling upmarket. That means SOC 2 questionnaires from US customers, technical due diligence before a funding round, and contract security clauses for firms supplying defence. A fixed-price CREST test with a retest fits a sprint plan better than a day-rate engagement that grows mid-project.
Bristol's venture-backed SaaS firms sell to enterprise and US buyers who send long security questionnaires. A current independent pentest is usually a hard requirement, and deals stall when the report is missing or out of date.
What we focus onTenant isolation, role and permission models across organisations, invite and SSO flows, GraphQL and REST authorisation, webhook and integration security, and admin impersonation features used by support staff.
Bristol fintechs build lending, payments, accounting and open banking products. Bank partners, regulators and investors expect independent testing before launch and after major releases, and partners often make it a contractual condition.
What we focus onPayment initiation and transfer logic, open banking consent scope, KYC flow bypass, transaction race conditions, statement and document IDOR, and API key handling for partner integrations.
Production companies and creative tech start-ups run asset management, review and distribution platforms holding unreleased footage. A leak before broadcast or release damages commissions, so studios and broadcasters ask suppliers about security.
What we focus onPre-signed URL expiry and scope, review link sharing, watermark and download controls, role separation between crew and client, bulk upload handling, and storage bucket access exposed through the app.
Bristol's fast-moving product teams ship features quickly, and the flaws we find usually trace back to authorisation added after the feature.
Resolvers that check permissions on the top-level query but not on nested objects. A user fetches their own project and walks the graph into other organisations' records, invoices or users.
Invite links that can be reused, accepted by the wrong email address or edited to grant a higher role. In multi-tenant SaaS, this lets an outsider join a customer's workspace as an admin.
Asset links valid for days or weeks and scoped to whole folders. Forwarded review links expose unreleased footage or artwork long after a project ends, outside any access control.
Parallel requests to a payment or transfer endpoint that each pass the balance check before either debits it. Fintech products without idempotency keys or locking can move more money than an account holds.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
SOC 2 does not mandate a pentest by name, but auditors and customers commonly expect one. A CREST report with retest evidence supports your security and change management controls during the audit.
Funds increasingly ask for recent security testing before Series A and later rounds. An independent report with fixed findings shows the product is not carrying hidden security debt into the deal.
Suppliers to the MOD face cyber requirements set by each contract's risk profile. A CREST web test supports those controls, but contracts that require CHECK need a CHECK company, which we are not.
We test against a stable build, usually staging, and agree a short freeze or a pinned environment for the test window. Findings reference the version tested. The included retest runs against your fixed release, so continuous deployment does not get in the way of a clear before-and-after record.
Generally, yes. US buyers accept CREST-accredited testing as independent third-party evidence. What they check is scope, test date, severity of open findings and proof of remediation, and the report covers each of those. If a customer insists on a specific firm or standard, confirm that before booking.
If it is a web application or API on commercial or company infrastructure, yes. We do not test classified systems or work that requires CHECK. Export-controlled technical data may need specific handling, so tell us early and we will agree what testers can and cannot see.
No. CyberFortify has no Bristol office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
