For Glasgow's fintech operations, space-data platforms and university spin-outs. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Glasgow's economy mixes large financial services operations, a well-known small-satellite and space-data cluster, and a steady flow of spin-outs from the University of Glasgow and the University of Strathclyde. Many of these teams ship web portals and APIs that sit between engineers, customers and data. That software is what we test: the login, the roles, the data and the integrations behind it.
Buyers here rarely take security on trust. Banks running operations in the city put suppliers through vendor onboarding. Space and data customers want proof their feeds are isolated. Seed and Series A investors ask for a recent independent report before they sign. A CREST test gives each of them evidence they can file.
Glasgow hosts technology and operations teams for several large banks and asset servicers. Suppliers of workflow, reconciliation and onboarding tools are asked for a recent pentest before they can connect to those environments.
What we focus onRole separation between maker and checker, approval workflows that can be skipped by replaying requests, bulk export endpoints, audit log integrity and SSO configuration with the client's identity provider.
Satellite builders and space-data firms around the city sell imagery, telemetry and tasking through customer portals and APIs. Customers in government and commercial markets ask how one customer's data is kept apart from another's.
What we focus onTenant isolation on imagery and telemetry APIs, scoping of API keys, signed download URLs that never expire, tasking requests that can be altered, and access to raw data stores behind the portal.
Young companies coming out of Glasgow's universities often reach their first enterprise customer before they have a security team. A pentest report answers the security questionnaire that usually arrives with the first serious contract.
What we focus onBroken access control between organisations, password reset and invite flows, admin features left reachable in production, dependency weaknesses in fast-moving codebases, and secrets exposed in front-end bundles.
Across finance operations tooling, space-data portals and new spin-out products, these are the weaknesses we would expect to look hardest for in Glasgow.
A key issued for one customer's imagery feed also reads other customers' archives because the API checks the key is valid but not which tenant it belongs to. One leaked key exposes the whole catalogue.
A payment or reconciliation workflow enforces four-eyes approval in the interface, but the API accepts the final request directly. A single user can push a change through that should need a second person.
Features that fetch a file or URL for processing, such as importing a dataset or rendering a map tile, can be pointed at internal services or cloud metadata endpoints, exposing credentials.
Early products often keep debug or admin pages from development. If they rely on an unguessable path rather than proper authorisation, anyone who finds them can change accounts or settings.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Investors backing Glasgow spin-outs increasingly ask for an independent security test. A CREST report with retest evidence shows issues were found and closed, not just listed.
Annex A expects technical vulnerabilities to be identified and handled. A scoped pentest with dated retest results is clear evidence for an auditor reviewing your first or renewal certification.
Some space customers are government or defence bodies. Our report suits commercial supplier assurance. Where a contract specifically requires a CHECK company, you will need a CHECK provider for that work.
Yes, if the API is the product. We test the API and whatever portal or dashboard sits in front of it as one application. We focus on tenant isolation, key scoping and download controls. Ground station systems, internal networks and cloud account reviews are separate pieces of work and would be scoped and priced on their own.
It will answer the questions about independent testing directly: who tested, when, what was in scope, what was found and what was fixed. You will still need to answer policy questions yourself. We include a short attestation letter that many procurement teams accept in place of the full report, which keeps detailed findings private.
Very little. We need a test environment that mirrors production, two accounts per user role and any API documentation you have. A short call covers scope. Findings come with plain fix guidance aimed at developers, and the retest confirms your fixes worked, so you do not need in-house security expertise to act on it.
No. CyberFortify has no Glasgow office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
