The bank wants findings above medium fixed before onboarding. How does the retest show that?
After you fix the issues, we retest each one and update the report with its new status. You can then send the bank the final report or a short retest letter confirming which findings are closed. The retest is included in the £2,400, so there is no extra fee for proving the fixes.
Do you test how our platform handles a change of client bank details?
Yes. Bank detail changes are one of the most abused flows in wealth and payments software. We check whether a change needs fresh authentication, whether alerts go to the old contact details, whether the API can be called directly to skip checks, and whether staff tools can be misused. Weaknesses here rank high in the report.
Our client portal stores identity documents for anti-money laundering checks. How do you test it?
We check who can reach uploaded passports, utility bills and proof of address, including through direct file URLs and the API. We look at storage, link expiry and whether staff roles are scoped properly. We also check whether an attacker could upload a malicious file that staff later open. Fraudsters value these documents, so we treat them as high-value targets.
Do you have an office in Chester?
No. CyberFortify has no Chester office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Why is it cheaper than UK day-rate firms?
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Is CyberFortify really CREST accredited?
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
What counts as one application?
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Is the price really fixed?
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
Is Cyber Essentials Plus the same as a penetration test?
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
Are you a CHECK company?
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
How fast can you start?
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
What happens to our data?
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
