For Dundee's games studios, life-sciences platforms and health tech teams. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Dundee has a long games history, from the studio that created Lemmings and Grand Theft Auto to the graduates Abertay University still sends into the industry. Alongside games, the University of Dundee supports a significant life-sciences and drug discovery base. Both sectors now run online services: player accounts, stores and community tools on one side, research data and collaboration portals on the other.
The pressure to test comes from different places. Publishers and platform partners expect studios to protect player accounts and payments. Pharma partners and NHS buyers expect research and health platforms to protect sensitive data. An independent pentest gives either group something concrete to review.
Studios in Dundee increasingly run their own account systems, web stores, leaderboards and community features. These attract account takeover, fraud and cheating, and publishers ask how they are protected. Players expect the same.
What we focus onAccount login and recovery, in-game currency and store APIs, server-side validation of rewards, leaderboard and match result tampering, and parental controls on accounts for younger players.
Research groups and spin-outs share compound, assay and trial data with commercial partners through web portals. Partners want assurance that confidential data stays with the right collaborator. Losing that trust can end a partnership.
What we focus onProject-level access between partner organisations, bulk download of datasets, audit trails, file upload of research documents, and API access used by analysis pipelines. We also check that withdrawn users lose access promptly.
Health tech teams building on the city's medical research base sell into NHS Scotland and wider NHS markets, where security evidence is part of buying approval. DTAC and DSPT both ask for it.
What we focus onPatient record access controls, clinician versus patient roles, appointment and messaging features, data export, and integrations with NHS identity and clinical systems. We also test how sessions are handled on shared clinical devices.
Games, research and health platforms in Dundee fail in different ways, so these findings span player economies, shared research data and patient records.
A game store API accepts the price or item granted from the client request. Players can alter it to get premium items free, a direct revenue loss that spreads fast once shared online.
Password reset sends predictable codes or does not limit attempts. Attackers take over valuable player accounts at scale, leading to support load, chargebacks and damage to the game's reputation.
A research portal checks that a user is logged in but not which projects they belong to. A partner on one programme can download assay data from a different, confidential collaboration.
Export and reporting features in health apps bypass the access rules applied on screen, so a staff user can export records they should not view.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Games likely to be played by under-18s must meet the Age Appropriate Design Code. A pentest checks the security of account, profile and messaging features that hold children's data.
The Digital Technology Assessment Criteria ask for evidence of penetration testing. A CREST report with retest results covers that section for health products sold into the NHS.
Commercial pharma collaborators run supplier assessments before sharing confidential research data. An independent pentest report answers their questions about application security testing.
No. We test the web and API side of a game: account systems, stores, leaderboards, matchmaking or community APIs and admin tools. Reverse engineering game clients and testing anti-cheat are specialist work outside our fixed-price scope. Server-side checks that stop clients cheating, such as reward validation, are covered.
Whoever is responsible for the application should commission it, usually the spin-out or research group running the portal. We can test with accounts representing each partner type, so the report shows separation between collaborators. The attestation letter can then be shared with partners without exposing technical details.
Usually yes, if it is the same application. One report covers the application and can be referenced in both. Make sure the scope includes the features each buyer cares about, such as patient-facing flows for the NHS and data-sharing features for research partners.
No. CyberFortify has no Dundee office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
