For Silicon Fen's AI, genomics and connected-device teams. One price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Cambridge, often called Silicon Fen, has grown a dense cluster of deep tech companies around the university, the Cambridge Science Park and the Cambridge Biomedical Campus. Chip design, AI and machine learning, genomics and connected hardware are all strong here. Many companies started as research projects and now sell software platforms, APIs and cloud dashboards on top of their core technology.
Those platforms often reach enterprise buyers before the company has a security team. Investors expect a pentest report in the data room before a Series A or B. Enterprise customers ask how AI features and data pipelines are protected. Genomics and biotech platforms handle some of the most sensitive data there is, and partners check carefully.
Cambridge AI companies ship assistants, model APIs and analytics tools to enterprises. Buyers now ask specifically how prompt injection, data leakage between customers and model misuse are handled, alongside the usual web security questions.
What we focus onPrompt injection through documents and tool calls, cross-tenant leakage in retrieval and fine-tuning, API key scope and rate limits, model output that triggers actions, and admin access to training data.
Sequencing, bioinformatics and lab data platforms store genetic and experimental data for research partners and companies. Genetic data is special category data, and pharma partners treat it as highly confidential.
What we focus onDataset and project separation, sample identifiers that link back to individuals, pipeline job submission, file download links, collaborator roles, and storage bucket permissions exposed through the application.
Hardware and chip companies run cloud portals for device fleets, licensing, firmware updates and design collaboration. A weak portal can expose customer IP or let an attacker push changes to devices in the field.
What we focus onFirmware update and signing workflows exposed via the web, device enrolment, fleet and organisation separation, licence key generation, and access to design files or SDKs restricted by customer contract.
In the AI, data and device platforms that Cambridge spin-outs build, these are the findings we report most often.
An uploaded document or web page contains hidden instructions that the AI feature follows, leaking other data or triggering actions. Enterprise buyers increasingly ask to see this tested explicitly.
A shared vector store or search index is filtered loosely, so carefully worded questions return snippets from another customer's documents. It rarely shows up in normal use, which is why it survives to production.
Download links for sequencing files or datasets stay valid for days and are not tied to the user. Once forwarded or logged, they give anyone access to sensitive data.
A support or viewer account can call the endpoint that schedules firmware updates. In a device fleet, that turns a web bug into a physical-world risk.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Funds backing Cambridge deep tech increasingly ask for independent security evidence. A CREST report and attestation letter in the data room answer that question before it slows the round.
Genetic and health data need appropriate technical measures and often a DPIA. A pentest is practical evidence for both, and helps when research partners review your data handling.
AI companies adopting the ISO/IEC 42001 AI management standard need evidence that AI systems are tested for misuse and data leakage. Our AI-enabled testing gives you concrete findings to record.
Both, within the same web application and API. We test prompt injection, data leakage between users and tenants, and whether model output can trigger actions it should not. Testing the model's training process or running large-scale red teaming of the model itself is outside a standard application test.
We would rather not. We recommend a test environment with synthetic or public reference datasets and the same roles your partners use. If testing must happen on production, we agree in advance what we may access and avoid downloading any real participant data.
Yes. The £2,400 covers the web portal and its API, including enrolment, fleet management and update scheduling. We check whether web-layer bugs could reach devices. Testing firmware, radios or the physical hardware is separate specialist work that we scope and quote on its own.
No. CyberFortify has no Cambridge office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
