For Fife's logistics, contact-centre and back-office software teams. Retest included, no day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Dunfermline has grown quickly as a working city in Fife, with large distribution and fulfilment sites, contact centres, and back-office operations serving businesses across the Forth in Edinburgh. Nearby Rosyth adds a shipbuilding and defence engineering presence. The software that runs these operations, from warehouse and order APIs to customer service platforms, is increasingly web-based and multi-client.
These operations handle orders, card payments, call records and personal data for other companies. Clients outsourcing to them want proof the systems are secure before signing. A CREST pentest of the specific application in use is the evidence most procurement and audit teams ask for.
Fulfilment and distribution businesses around Dunfermline connect warehouse systems to retailers and carriers through APIs. Every client integration is another path into order and customer data. Retail clients ask for testing before they connect.
What we focus onOrder and shipment APIs scoped per client, API key handling for retailer integrations, address and contact data exposure, label generation, and returns workflows that can be abused.
Contact centres serving banks, telecoms and retailers run CRM, call recording and agent tools. Clients expect those platforms to be tested before customer conversations and records sit inside them. Many clients are regulated.
What we focus onAgent access to only assigned clients, call recording and transcript access, payment capture during calls, screen-pop data from client systems, and supervisor role escalation. We also check how quickly access ends when agents move between client teams.
Back-office teams process payroll, HR, invoices and claims for organisations elsewhere. These platforms hold employee and financial data across many clients at once. One weak control can expose every client's staff or suppliers.
What we focus onClient separation, payroll and bank detail changes, invoice approval rules, document upload and storage, and bulk data import from client systems. We also look at how client administrators are created, since they often get wider access than needed.
Most Dunfermline platforms serve many client companies from one system, so the findings below focus on where those boundaries break down.
Integration keys identify the retailer but the order API does not restrict results to that retailer. One partner's key returns shipments and home addresses for every client in the warehouse.
Recordings and transcripts are served from storage links that do not check the agent's permissions. Recordings may contain card numbers, health details or account security answers.
Payroll or supplier bank details can be changed by one user with no approval step or notification, the classic route for payment diversion fraud. Losses can be large and hard to recover.
CSV or spreadsheet imports run without validating content. Formula injection in exported files, or malformed records overwriting existing data, are both common results. Both damage trust with clients.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Contact centres that take card payments must keep agent tools and recordings out of scope or protect them. Testing confirms card data is not exposed in the web platforms agents use.
Clients, especially US-headquartered ones, often expect SOC 2 from service providers. A pentest is a common supporting control and evidence your auditor will ask to see.
Firms near Rosyth may serve defence programmes. Our CREST testing suits commercial assurance. If a contract specifies CHECK or MOD-specific schemes, that work needs a provider in those schemes.
No. If it is one application with one code base, one test covers it at £2,400. We test with accounts for at least two clients to prove separation. Each client can then receive the attestation letter. Separate client-specific apps or portals with different code would be priced individually.
We can only test systems you own or have written permission to test. If the CRM belongs to your client, they would need to authorise and usually commission that test. We can test your own agent tools and integrations, and the report will make that boundary clear.
No. We test web applications and their APIs, such as client portals and integration endpoints. Handheld devices, warehouse networks and on-site infrastructure need an internal or network test, which is scoped separately. Many fulfilment firms start with the client-facing APIs because they are exposed to the internet.
No. CyberFortify has no Dunfermline office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
