For Hereford's agri-tech, food producers and Skylon Park suppliers. One price, whatever the app size.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Herefordshire is a farming county, and Hereford's economy reflects it: food and drink producers, cider makers, livestock markets, agricultural suppliers and the advisers who serve them. The city's enterprise zone at Skylon Park adds a cluster of defence, security and engineering firms. Most businesses are small, so a single web platform often carries the whole company's sales, records or contracts.
That makes testing a commercial question as much as a technical one. Supermarkets and wholesalers ask producers about system security, defence primes push requirements down their supply chain, and small teams need a price they can budget for. A flat CREST fee, independent of app size, suits firms that cannot absorb open-ended day rates.
Software for herd records, crop planning, traceability and subsidy paperwork is used by farms across the Welsh Marches. It holds holding numbers, movement records and bank details, and farmers increasingly share it with vets, agronomists and buyers.
What we focus onSharing and delegation between farm, vet and adviser accounts, IDOR on holding and animal records, CSV and spreadsheet imports, offline sync conflicts, and API access granted to buyers or processors.
Producers in Herefordshire sell cider, meat boxes and specialist food online, often on customised e-commerce platforms. Subscriptions and gift orders mean stored customer details, and a single breach can cost a small brand its reputation.
What we focus onSubscription management flaws, age verification bypass for alcohol, gift voucher and discount abuse, address book IDOR, account takeover through password reset, and plugin vulnerabilities in customised store platforms.
Firms at Skylon Park and elsewhere in the county supply defence and security customers. Primes increasingly ask smaller subcontractors for evidence of security testing, and the portals those suppliers run are part of the chain.
What we focus onDocument portal access controls, supplier and customer role separation, file handling for technical drawings, multi-factor enforcement, session security, and audit trails on sensitive project records.
Hereford's small teams often run software that grew quickly from a spreadsheet or a plugin, and the weaknesses we find reflect that history.
Farm platforms that let owners invite a vet or adviser but never revoke access when the relationship ends. Former contractors keep reading records, and nobody notices because there is no access review screen.
Alcohol checkout flows where age confirmation is a front-end tick box. The order API accepts requests without it, which creates a licensing problem as well as a technical one.
Customised e-commerce sites running plugins with known, published vulnerabilities. Small producers rarely track plugin updates, and automated attacks find these sites soon after a disclosure.
Supplier portals that store drawings or contract files at guessable paths with no access check on download. Anyone holding one link can increment the ID and retrieve other projects' documents.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Large food buyers send producers information security questionnaires during onboarding and audit. A recent CREST report lets a small team answer the testing questions with evidence rather than promises.
The ICO expects security testing appropriate to the risk. For a small online shop holding customer addresses and order histories, a dated pentest and retest is clear evidence of that effort.
Defence suppliers registered on JOSCAR are asked about cyber controls by primes. A CREST web test supports those answers. Work that names CHECK must go to a CHECK company, which CyberFortify is not.
It adds work in the right places. Offline sync often trusts data the device uploads later, so we check whether a modified client can overwrite another farm's records or push invalid movements. The web application and its API are in scope for the £2,400. Native mobile apps are scoped separately.
We test whether age checks are enforced by the server, not just the page. That means placing orders through the API without the confirmation step, editing a date of birth after verification, and checking that proof-of-age delivery instructions cannot be stripped from an order.
Often it is part of what they ask for, alongside Cyber Essentials or Cyber Essentials Plus. Ask the prime exactly what evidence they need. If they require a CHECK company, we will say so, and you will need a CHECK provider. If a CREST web application test is acceptable, we can help.
No. CyberFortify has no Hereford office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
