For Doncaster's warehousing, rail engineering and staffing platforms. One flat price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Doncaster sits where the A1(M), M18 and the East Coast Main Line meet, which is why so much of its economy moves goods. Large distribution parks, inland rail freight and a long railway engineering history shape the software built and bought here: warehouse systems, carrier integrations, fleet portals and the shift tools that staff big sheds around the clock.
Logistics customers now send security questionnaires before they connect a new system to their stock or order data. Rail clients ask suppliers to show how their portals are secured. A CREST report written for those reviewers answers the question once, with evidence, instead of another self-assessed spreadsheet.
Fulfilment platforms here plug into retailers, marketplaces and carriers through dozens of APIs. A client will usually want proof that one shipper's orders, stock levels and customer addresses cannot be seen or changed by another before they sign.
What we focus onShipper-to-shipper isolation, consignment and order IDs that can be guessed, carrier label endpoints, bulk CSV imports, webhook signing and the admin roles that warehouse supervisors use to override picks.
Doncaster's rail heritage means plenty of firms run asset, inspection and maintenance software for the wider rail industry. Those buyers take supplier security seriously because their portals sit close to safety records and engineering data.
What we focus onAccess to inspection records and defect reports, contractor accounts that outlive the contract, file uploads for drawings and photos, audit trails that can be edited, and exports from asset registers.
Big distribution sites lean on agency and shift-booking apps to fill rotas. Those apps hold right-to-work documents, bank details and home addresses for thousands of workers, so clients and agencies both ask how that data is protected.
What we focus onWorker profile IDOR, document storage links, shift-swap and timesheet approval logic, pay rate tampering, role escalation from worker to site manager, and password reset flows on mobile-first web apps.
Logistics and rail software in Doncaster tends to fail where many partners share one platform. These are the issues we see most in that kind of app.
Tracking pages and APIs that accept sequential consignment numbers without checking the caller. Anyone can walk the range and collect names, addresses and delivery notes for every shipper on the platform.
Keys for courier or label APIs shipped in front-end JavaScript. An attacker can print labels, cancel jobs or read shipment data against your account, and the bill lands with you.
Approval endpoints that trust a role sent by the client. A worker can approve their own hours or change a pay rate by editing one field in the request.
Report and export endpoints with no rate limit or size cap. One compromised supervisor login can pull the full order or worker history in minutes without raising an alert.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Large shippers ask fulfilment partners for recent independent testing before integration. The report gives scope, findings and retest results you can attach rather than describe.
Rail clients often ask for evidence of security testing during supplier onboarding and renewals. A CREST report with retest confirmation shows your portal has been checked by an accredited tester.
Right-to-work scans, bank details and addresses are high-risk personal data. Testing the app that stores them supports your Article 32 security duty and any DPIA you keep.
Usually yes, if they share one codebase and API and differ only by role. We test each role against the others, which is where most logistics flaws hide. If the driver tool is a native mobile app, that part is scoped separately. Send us the URLs and we will confirm before you commit.
We test against a staging or sandbox environment where possible and agree rules for anything that must touch production, such as no label creation against live carrier accounts. We check how your API handles webhooks and keys from partners, not the partners' own systems, which we are not authorised to test.
No. The £2,400 covers your web application and its API. Handheld scanner apps, Wi-Fi and the internal network on a distribution site are separate pieces of work with their own scope and price. Many Doncaster teams start with the customer-facing portal because that is what clients ask about first.
No. CyberFortify has no Doncaster office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
