For Durham's research spin-outs, edtech and council suppliers. First pentest at a flat price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Durham is a small city with an outsized university. Research from Durham University feeds spin-outs in areas like physics, materials and data, and the wider county is home to NETPark, a science park focused on deep tech. Alongside them sit education technology firms and suppliers to the councils and public bodies that are major employers in the area.
For a young company, the first pentest usually arrives as a condition of a deal. A council procurement team asks for it, a university wants it before rolling out a tool to students, or an investor puts it on the due diligence list. A fixed price means a founder can budget for it without guessing at day rates.
Spin-outs often turn research code into a commercial product quickly. Their first enterprise customers and investors want proof that the web platform around the science has been tested by someone outside the team.
What we focus onLeftover debug and test endpoints, research data uploads and parsers, licence and subscription checks, API keys for cloud compute, and admin panels inherited from the prototype.
Tools for students and staff connect to university and school identity systems and hold coursework, marks and wellbeing notes. Institutions ask for testing before they enable single sign-on for thousands of users.
What we focus onSAML and OAuth sign-in handling, cohort and class separation, marks and feedback IDOR, file upload for assignments, staff impersonation features, and integrations with learning platforms.
Local authorities buy case management, booking and resident service apps from small suppliers. Their procurement teams expect evidence of independent testing, and sometimes a full pentest each year of the contract.
What we focus onResident account takeover, case notes visible across teams, document upload for evidence and forms, payment pages for local services, and exports used for reporting to central government.
Young products and public sector tools in Durham tend to share a few patterns. These are the issues we see most in that kind of app.
Debug routes, test accounts or old API versions from the research prototype still running in production. They often skip authentication entirely and expose the data the product was built around.
SSO integrations that accept unsigned or replayed assertions, or trust an email claim from any identity provider. An attacker can sign in as a staff member at a client institution.
Coursework or grade APIs that check the user is logged in but not that they belong to the class. Students or staff from one group can read another group's results and feedback.
Upload features for datasets or documents that parse files on the server without limits. Crafted files can trigger server-side code execution, data access or crash the service.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Investors increasingly ask whether a product has been independently tested. A CREST report with retest results answers that cleanly and shows security has been handled before scale.
Councils buying through frameworks expect suppliers to describe their security testing. A dated CREST report gives you a concrete answer for tender responses and contract reviews.
Education and council apps hold data on young people and vulnerable residents. Testing supports your security duty under Article 32 and the DPIA your customer will usually ask to see.
Very little. We need the URL, test accounts for each user role and any API documentation you have. A short call covers what the product does and what is off limits. The report explains each finding in plain terms with fix guidance, so a small engineering team can act on it.
Yes. Sign-in handling is part of testing your web application. We check how your app validates assertions and tokens, maps users to accounts and handles logout. We do not test the university's own identity provider, which belongs to them, unless they authorise it separately.
No. CyberFortify is not a CHECK company, and if the contract requires CHECK you need a CHECK provider. Many council software contracts only ask for a CREST or equivalent independent pentest, so it is worth asking the procurement team exactly what the requirement says.
No. CyberFortify has no Durham office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
