For Edinburgh's wealth, insurance and data teams. Fixed £2,400 per app, retest included, no day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Edinburgh is home to a long-established asset management, life insurance and banking sector, alongside a data and AI research base anchored by the University of Edinburgh. Fintech and data companies here build platforms that hold portfolios, policies and models. When they sell into the city's regulated institutions, their web applications and APIs become part of someone else's risk register.
That is why testing gets asked for early. Regulated firms must show oversight of the suppliers they rely on, so procurement wants independent evidence before onboarding. Data and AI companies face a different question: what can a user make the model reveal? A CREST pentest gives both a clear, dated answer.
Investment managers and wealth platforms in Edinburgh rely on outside software for client portals, adviser tools and reporting. Their supplier oversight teams expect a recent independent pentest before any new platform touches client data.
What we focus onIDOR on statements and valuations, adviser-to-client delegation, document downloads, MFA enforcement on every route, and whether instructions such as withdrawals can be raised without step-up checks.
Life, pensions and general insurance firms in the city outsource quote engines, claims tools and member portals. Each one handles personal and sometimes health information, so suppliers face detailed security review.
What we focus onQuote and claims APIs that trust client-side values, member record access by reference number, bulk upload of scheme data, and file handling for claims evidence.
Edinburgh's research strength has produced a cluster of data and machine learning companies. Customers want to know that model features cannot be turned against the data behind them. Buyers in finance and health ask for this before pilots begin.
What we focus onPrompt injection and data leakage through AI features, tenant separation in vector stores and retrieval, tool or plugin calls made on a user's behalf, and rate limits on costly inference endpoints.
Edinburgh platforms hold high-value financial and personal records, so these are the issues that tend to matter most when we test them.
A client portal serves valuation statements by numeric ID. Changing the number in the request returns another client's holdings. It is simple to find and a reportable breach under UK GDPR.
A retrieval feature searches a shared index without filtering by customer. A crafted question returns snippets from another organisation's documents, bypassing every access control in the main application.
The web interface asks for a second factor before changing bank details, but the underlying API endpoint does not. Anyone holding a session token can redirect a withdrawal.
Claims and onboarding flows accept documents. Weak type checks or public storage links can let attackers upload active content or read other customers' files. Both lead to data exposure.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Regulated firms must manage the risk from the third parties behind their important business services. A CREST report gives their oversight teams dated, independent evidence about your platform.
Edinburgh firms with EU fund ranges or EU entities pass DORA requirements down to ICT suppliers. Regular independent testing with tracked remediation supports those contractual obligations.
Article 32 asks for regular testing of security measures. A pentest with retest results shows the ICO, and your clients, that you checked controls around personal financial data.
Location is not the test regulators or procurement teams apply. They look at accreditation, scope, method and remediation. Our engineers are CREST accredited and the report states exactly what was tested and when. We also provide an attestation letter for sharing, so your client gets assurance without seeing every finding.
AI features inside the application are in scope. We test for prompt injection, leakage between customers through retrieval, and unsafe actions taken by the model on a user's behalf. We do not evaluate model accuracy or bias. Separate model hosting or training infrastructure would be scoped as its own piece of work.
No. The included retest checks the fixes for findings from that test, normally within a few weeks of the report. An annual test is a fresh assessment of the application as it is then, including features you have shipped since. Each annual test is the same flat £2,400 per application.
No. CyberFortify has no Edinburgh office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
