For Colchester's professional firms, data start-ups and student-facing platforms. No day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Colchester's economy is built on many smaller firms rather than a few large ones. Accountants, solicitors and financial advisers serve clients across north Essex, and many now run client portals. The University of Essex at Wivenhoe brings a strong social science and data tradition, including the UK Data Archive, and its Knowledge Gateway hosts young technology companies. A large student population also drives demand for accommodation and student service platforms.
For many Colchester firms the first pentest is triggered by a single larger customer, a bank, or a university procurement team. They rarely want a long consultancy project. They need one accredited report that answers the question, shows what was fixed, and can be handed straight to the buyer.
Law and accountancy firms share tax returns, contracts and identity documents through online portals. Banks, lenders and corporate clients increasingly ask these firms how their portals are secured and whether they have been tested.
What we focus onShared document links, client-to-client separation, file upload handling, multi-factor login enforcement, and staff roles that can see every client's records when they only need a handful.
Companies working with survey, social or behavioural data often hold sensitive datasets on behalf of research partners. Partners and data owners require proof that the analysis platform keeps each dataset properly restricted.
What we focus onRow and dataset level permissions, export and download controls, API access for analysts, audit logging of who viewed what, and removal of access when a project or licence ends.
Booking and tenancy platforms for students collect passports, guarantor details and payments, often from international applicants. Universities and landlords that partner with these platforms ask for testing evidence before sharing student data.
What we focus onApplicant document storage, guarantor and payment flows, room allocation logic, landlord and student role separation, and account takeover through weak sign-up or email verification steps.
Colchester firms are often testing for the first time, and first tests here tend to turn up the same handful of access and authentication gaps.
Document links sent to clients often stay valid forever and work for anyone who has them. Forwarded emails or browser histories can then expose tax returns, ID scans and contracts long after the matter closed.
Some logins set the session after the password check and only then ask for a code. Browsing straight to an internal page skips the second factor entirely, defeating the control clients were promised.
Analysts may be correctly blocked from viewing a restricted dataset on screen, yet the bulk export or API endpoint returns it anyway. That breaks the terms of most data access agreements.
A return URL parameter that accepts any address lets attackers send users a genuine login link that lands them on a phishing page afterwards. Student and client portals are frequent targets for this.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Banks and lenders ask law and accountancy firms detailed questions about how client data is held. A CREST report on the client portal answers the testing questions with evidence rather than assurances.
Data owners often apply frameworks such as the Five Safes, including secure settings for sensitive data. A pentest report supports a platform's case that its environment is genuinely secure.
Smaller firms going for ISO 27001 for the first time need evidence of technical vulnerability management. A pentest with a retest gives auditors a clear, dated record of testing and remediation.
If the portal is a vendor's hosted product, the vendor should test it and share evidence. Ask them for a recent pentest summary. If you have customised it heavily, run your own instance, or built integrations around it, those parts can be in scope for us, with the vendor's agreement where needed.
Usually the executive summary, the scope, the findings table and the retest results. Some institutions want the full report under NDA. We can also provide an attestation letter that confirms the dates, scope and outcome without exposing any technical detail.
Very little. We need the application URL, test accounts for each user role, any API documentation you have, and a contact during the test. A staging environment is helpful but not required. We send a short scoping form and walk you through it.
No. CyberFortify has no Colchester office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
