For Cardiff's insurance, fintech and media software teams. One flat price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Cardiff is the Welsh capital and a financial services centre in its own right. Insurers, lenders and fintech firms employ thousands across the city, and a strong cyber security community has grown alongside them. Screen production at Roath Lock and broadcasters around Central Square add a media technology cluster, while the Senedd and Welsh Government make the public sector a major buyer.
Financial firms here answer to the FCA and pass that scrutiny on to their technology suppliers. Card payments bring PCI DSS. Welsh public bodies ask for security evidence in tenders. For a supplier, a CREST report is the common document all three will accept as proof that the application was properly tested.
Insurers and brokers run quote engines, policy portals and claims systems that handle personal and financial data at volume. They test because the FCA expects them to manage technology risk, including in third-party software.
What we focus onPrice and premium tampering in quote journeys, claims document uploads, policyholder IDOR, broker and aggregator API access, and admin roles that can change cover or payouts.
Payment, lending and open banking products sell to regulated firms who ask for independent testing during onboarding. Fraud teams also want to know whether the app can be abused at scale.
What we focus onOpen banking consent and token handling, affordability and identity check bypasses, transaction and payee changes, step-up authentication, and race conditions in balance or limit updates.
Production and broadcast teams use web tools for rushes, scripts, scheduling and rights. Leaks before transmission are costly, so commissioners and broadcasters ask suppliers how unreleased content and contracts are protected.
What we focus onShared links to unreleased media, access for freelancers after a production wraps, rights and contract document access, watermarking bypass, and API keys for storage and transcoding services.
Cardiff's insurance, fintech and media apps each attract a different kind of attacker. These are the findings we most often raise in them.
Quote journeys that trust a price or risk score sent from the browser. A user can lower their premium or alter cover terms, which is fraud the insurer may not spot until a claim.
Medical letters, photos and receipts fetched with a predictable ID and no ownership check. One policyholder can download another's sensitive claim evidence, including medical details, just by changing a number.
Changing bank details or adding a payee with only the existing session. A hijacked session becomes a direct route to redirect payments or loan funds.
Share links for rushes or scripts that never expire and work for anyone holding them. Forwarded once in an email or chat, they can leak scripts or footage months before broadcast.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Regulated firms must show they understand and manage risks in important business services, including third-party apps. A CREST pentest gives your clients evidence for their resilience and outsourcing reviews.
Insurers and fintechs taking card payments must pentest applications in or connected to cardholder data. Our test covers the web app and API, with retest confirmation for your assessor.
Welsh Government and public bodies ask suppliers to evidence security testing in procurement. A current CREST report with retest results answers that section with something concrete.
For the application testing part, usually yes. Outsourcing and vendor risk teams look for an independent, accredited tester, clear scope, findings by severity and proof of retest. Our report includes all of that. They may also ask about policies, hosting and business continuity, which a pentest does not cover.
Yes, if they are part of your application's API. We test how your platform handles consent, tokens, account data and payment initiation from your side. We do not attack banks' or aggregators' systems. If the API is a separate product with its own codebase, it may be priced as a second app.
Yes, but we prefer a staging copy so no unreleased material is put at risk. If production must be tested, we agree what we can touch, avoid downloading real media beyond proving access, and work to your schedule. Findings are shared only with the contacts you name.
No. CyberFortify has no Cardiff office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
