For Carlisle's hauliers, livestock trading platforms and food producers. Fixed price, no day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Carlisle sits where the M6 meets the main routes into Scotland, which makes it a natural base for haulage, warehousing and distribution. It is also the commercial centre for a large farming area, with a busy livestock auction trade that now runs partly online. Food manufacturing has deep roots in the city. Software here tends to track loads, sell stock and manage orders across Cumbria and the Borders.
Many firms here are family-owned and are not used to security questionnaires. That changes when a supermarket, national carrier or processor asks for proof that an online system is secure. A fixed-price CREST pentest answers that request without a large consultancy bill, and the retest shows the fixes are in place.
Transport and warehousing firms along the M6 corridor run driver apps, proof-of-delivery systems and customer tracking portals. National customers now ask carriers to show these portals are tested and safe to connect to.
What we focus onCustomer access to other customers' loads, driver account security, proof-of-delivery photo and signature handling, tracking links shared by email, and API integrations with customers' ordering systems.
Online and hybrid livestock sales, buyer registration and payment systems handle farmers' identities, bank details and animal movement data. Trust is essential, and a single fraud can damage an auction business's reputation quickly.
What we focus onBidding integrity and timing, buyer verification, bank detail changes on seller accounts, access to sale results and invoices, and the links between trading systems and animal records.
Food producers in and around Carlisle use supplier, ordering and quality portals to work with retailers and distributors. Retail customers now include web app security in their regular supplier assessments.
What we focus onRetailer and distributor portal access, separation of order and pricing data, quality and traceability document access, invoicing endpoints, and user management for external customer accounts.
On Carlisle's transport, trading and food supply systems, these are the problems we check first and still find surprisingly often.
Delivery tracking links that never expire and show addresses, names and goods can be forwarded or guessed. For high-value loads this helps thieves plan where and when to strike.
Online sale systems that check bid timing or increments only in the browser can be manipulated by sending requests directly. This undermines fair trading and can cost sellers money.
If an attacker can log in as a seller, or change their bank details without verification, sale proceeds can be paid to the wrong account. Weak passwords make this much easier.
Portals that give a whole retailer or distributor one shared login make audit and revocation impossible. When a member of staff leaves, their access often stays.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Supermarkets and large processors assess suppliers' information security as well as food safety. A CREST report on your customer portal answers the testing section with independent evidence.
Farmers, drivers and customers all have personal data in your systems. A pentest and retest show the ICO that you took appropriate technical steps to protect it.
CE+ checks basic controls on your devices and networks. It does not test your web application's logic. Many buyers ask for both, and our report covers the application side.
Most want an independent test of the portal and its API, a summary of findings by severity, and proof that serious issues are fixed. Our CREST report gives them that, and the included retest closes the loop. If they send a questionnaire, we can point you to the sections of the report that answer each testing question.
We would rather not. Testing bidding and payment logic during a live sale risks disrupting real trading. We prefer a staging copy or a test sale with dummy lots. If production must be tested, we agree a quiet window and avoid any action that would place or alter a real bid.
No. You are responsible for systems you build or run, not the retailer's own portal. A pentest becomes relevant when you operate your own customer-facing ordering, traceability or B2B site. If you are unsure which of your systems a customer is asking about, send us their questionnaire and we will give you an honest answer.
No. CyberFortify has no Carlisle office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
