For Derry~Londonderry's SaaS, digital-services and edtech teams. £2,400 per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Derry~Londonderry has a growing software and digital-services sector, with SaaS companies, outsourced development and customer-service businesses working alongside Ulster University's Magee campus and North West Regional College. The city sits on the border with County Donegal, so many local companies sell into the Republic of Ireland and the wider EU as naturally as into Great Britain.
That reach brings two sets of expectations. UK customers ask about UK GDPR and recent independent testing. Irish and EU customers increasingly flow NIS2 and DORA requirements down to their suppliers. Larger customers on either side send long security questionnaires. A CREST pentest is the common evidence that answers both.
Software companies in the city are moving from early customers to enterprise accounts. That shift brings formal vendor security reviews, and a pentest report is usually the first document asked for.
What we focus onOrganisation and workspace separation, SSO and SCIM provisioning, API token scopes, role changes, audit logging, and data export features enterprise customers rely on. We also check invitation links and domain-based sign-up rules.
Agencies and outsourced teams in Derry build and run web platforms for clients elsewhere. Clients want proof that what was built is secure before launch. Some make it a condition of sign-off.
What we focus onPre-launch testing of client builds, admin panels, CMS customisations, form handling, third-party plugins, and hand-over of secrets and environments between agency and client. Our report can be handed to the client as launch evidence.
Edtech products built near the university and college campuses hold student records, assessments and safeguarding information for schools and colleges in both jurisdictions. Schools now expect suppliers to show how that data is protected.
What we focus onStudent and teacher role separation, access to grades and submissions, parent accounts, safeguarding notes, and integrations with school management systems. We also check that former pupils and staff lose access at the end of term or employment.
Derry teams selling on both sides of the border face questions from enterprise, agency and education buyers, and these findings answer the most common ones.
When a customer removes a user in their identity provider, the SaaS app keeps the local session or API tokens active. Former staff can still reach company data.
A role check is applied to menu items, not to the endpoints behind them. Students can call grading or submission APIs directly to view or change marks.
After hand-over, an agency account or default admin login stays enabled on a client's site. It is a forgotten and often weakly protected way in.
Detailed errors in the API reveal internal IDs, email addresses or query details from other workspaces, giving attackers material for targeted access attempts. They also suggest weak error handling elsewhere.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Irish customers in sectors covered by NIS2 must manage supply chain security. Independent pentest evidence helps you answer their supplier assessments.
Large customers send questionnaires such as SIG or their own templates. A CREST report and attestation letter answer the testing questions and shorten review time.
Edtech products processing pupils' data must meet UK GDPR, Irish GDPR and safeguarding expectations. Testing access controls shows schools that sensitive records are protected.
Yes. The pentest assesses your application, not a jurisdiction, so one report serves customers on both sides. The report is in plain English with standard risk ratings. If an Irish customer needs specific NIS2 or DORA wording, tell us at scoping and we will make sure the scope and summary address it.
Yes, with the client's written authorisation for their systems. Each client application is priced at £2,400 including retest. The report can be issued to you, to the client or both. Many agencies test before launch, so the client receives a clean retest result with the hand-over.
They want to know pupils cannot see each other's data, teachers only see their own classes, and safeguarding notes are restricted. We test those boundaries directly. The attestation letter states what was tested and that findings were fixed, which is usually what a school's data protection lead needs.
No. CyberFortify has no Derry office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
