For Canterbury's edtech, ticketing and heritage software teams. Fixed price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Canterbury is a cathedral city with a large student population, home to the University of Kent, Canterbury Christ Church University and a medical school run jointly by the two. Its other big earner is the visitor economy, built around the cathedral, a World Heritage Site, and the historic centre. Local software tends to serve students, staff, visitors and the charities and trusts that look after heritage sites.
Universities run formal supplier assessments before any platform touches student records. Ticketing and donation platforms take card payments from the public at scale. Charities and heritage bodies have smaller security teams but the same legal duties, so they lean on suppliers to show the product was independently tested.
Platforms for assessment, timetabling, accommodation and student support hold personal data on thousands of young people. University procurement and information security teams ask for pentest evidence before contracts are signed or renewed.
What we focus onStudent versus staff roles, access to marks and submissions, accommodation and welfare records, single sign-on with university identity systems, and file uploads in coursework and assessment tools.
Timed-entry tickets, tours and events are sold online to visitors from across the world. Booking systems face bots, refund fraud and card testing, and venues want to know the platform holds up.
What we focus onPayment and refund flows, discount and concession code abuse, capacity and timed-slot logic, booking lookup by email, and the admin tools used by box office and front-of-house staff.
Membership, donation and Gift Aid systems for trusts and charities store supporter details and payment mandates. Supporters' trust is the real asset here, and a breach can damage fundraising for years.
What we focus onDonor record access, Gift Aid declaration data, direct debit and recurring payment handling, membership renewal flows, volunteer accounts with too much access, and bulk export of supporter lists.
In the student, visitor and supporter-facing systems typical of Canterbury, these are the findings that come up most.
A student account can call marking or moderation endpoints directly because the role check sits only in the interface. Grades and feedback can be read or changed for other students.
Discount codes can be reused, stacked or applied to excluded tickets by editing the request. On busy days this means real lost revenue and oversold time slots.
Export features meant for fundraising managers are available to volunteer or junior roles. Full supporter lists with addresses and donation history can leave the organisation unnoticed.
Low-value ticket or donation forms with no rate limiting or bot controls are used by fraudsters to test stolen card numbers. Chargebacks and payment provider penalties follow.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Higher education buyers send security schedules covering testing, data location and incident handling. A CREST report with retest evidence answers the testing section and supports renewal reviews.
Welfare notes, disability records and donor histories need careful protection. A pentest shows you tested the technical controls, which matters if the ICO or a data subject ever asks.
Taking card payments online brings PCI DSS duties, including application testing where your system is in scope. Our report gives your acquirer or assessor the evidence they expect.
We test against a staging instance connected to a test identity provider, or to a university test tenant if one is available. We check how your app trusts the identity claims it receives and whether student and staff roles are enforced on the server. We never test live university identity systems without their permission.
If membership and donations sit in one web application with one API, yes. If they run on separate platforms, such as a hosted donation page plus a separate membership system, each may need its own test. Send us the URLs and we will tell you what counts as one app before you commit.
We prefer a staging copy with test payments switched on. If testing must happen on production, we agree times outside peak hours, avoid load-heavy techniques, and use test tickets or slots that you can release afterwards. Nothing is purchased with real cards.
No. CyberFortify has no Canterbury office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
