For Coventry's connected vehicle, EV charging and battery tech teams. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Coventry has been a car city for well over a century, and it is now a centre for the shift to electric and connected vehicles. Major vehicle makers have engineering bases here, WMG at the University of Warwick works closely with industry, and the UK Battery Industrialisation Centre is on the city's edge. Around them is a supply chain building telematics, charging and manufacturing software.
Vehicle makers now have type approval rules on cyber security that reach their suppliers, and charge point software falls under its own regulations. Those pressures land on the web portals and APIs behind every connected service. Buyers want evidence that someone independent has tried to break them.
Companion apps, fleet dashboards and telematics platforms link drivers and fleet managers to vehicle data and, sometimes, remote functions. Vehicle makers expect suppliers to show testing of every back end that touches the vehicle.
What we focus onVehicle-to-account binding, VIN-based lookups, remote command authorisation, location data exposure, OAuth flows used by companion apps, and the split between fleet manager and driver permissions on shared vehicles.
Charge point management systems and driver apps handle payments, account data and remote control of chargers. Regulations and network operators expect smart charge points and their back ends to be secure.
What we focus onRemote start and stop authorisation, OCPP back end exposure, tariff and payment manipulation, site owner versus driver roles, and whether one operator's account can control another operator's chargers.
Battery development and production generate valuable process and test data, often shared between manufacturers, research partners and suppliers through web platforms. Leaks of that data can hand competitors years of work.
What we focus onPartner and project data separation, test result access controls, bulk export and API rate limits, file upload parsing for test data formats, and access removal when partnerships end.
Mobility software in Coventry has to protect both data and physical actions, so our findings here often involve commands reaching the wrong device.
Remote start, stop or unlock calls that check only that the user is logged in let anyone control any charger by changing its ID, disrupting sites or giving away free charging.
VINs are visible through windscreens. APIs that accept a VIN and return linked account or location details let a stranger identify owners and track vehicles.
Companion app sign-in that accepts any redirect URL starting with an allowed domain can be tricked into sending authorisation codes to an attacker, who then acts as the driver.
Fleet and test data APIs without pagination limits or rate controls let a single account pull entire histories in minutes, making scraping of location or process data easy.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Vehicle makers need a cyber security management system covering their suppliers. A pentest of your back end and APIs provides testing evidence for their 21434 work products.
Many automotive customers require TISAX labels from suppliers. A CREST report supports the technical testing elements and shows assessors that vulnerabilities were found and fixed.
The Electric Vehicle (Smart Charge Points) Regulations 2021 set security requirements for chargers. Testing the management platform and app shows that the connected side has been checked too.
Only if you want it to. We agree in advance which vehicles or simulators we may target. Most teams provide test vehicles or a simulated back end, and we confirm command authorisation without affecting customers' vehicles. Any test that could change a vehicle's state is agreed with your engineers first.
No. The fixed price covers your web application and its API, including the services the car or charger talks to. Testing vehicle ECUs, infotainment units, charger hardware or the radio interfaces is specialist work, scoped and priced separately if you need it.
If every network runs the same codebase and API with configuration differences, it is one application. We test isolation between networks as part of that. If some networks run customised builds with different features, we may treat those as separate applications. We confirm before booking.
No. CyberFortify has no Coventry office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
