For Hull's offshore wind, port and process-industry software teams. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Hull has reinvented itself around the Humber's energy estuary. Offshore wind manufacturing and operations, a busy port with ferry and freight routes to Europe, and the chemicals works at Saltend all depend on software: maintenance scheduling, vessel and crew logistics, customs paperwork and plant reporting. The firms that build it range from small specialists to engineering consultancies.
Energy operators classed as essential services push security duties down to their suppliers. Port and freight customers want to know who can see their cargo data. When a Hull supplier bids for that work, an independent CREST pentest is often the piece of evidence the buyer's security team asks for first.
Wind farm operators use web platforms for work orders, technician scheduling, turbine inspection images and vessel transfers. Operators of energy assets expect suppliers to show their software will not become the weak link.
What we focus onContractor account separation between wind farms, storage of inspection photos and drone footage, permit-to-work records, report generation features, and any web dashboard that displays data pulled from site systems.
Freight forwarders and port users run booking, haulage and customs declaration tools that hold commercial data about who is shipping what, where and when. Customers ask for proof that rivals on the same platform cannot see it.
What we focus onBooking reference enumeration, document upload for customs and dangerous goods paperwork, API access granted to hauliers, release or collection status changes, and audit logging for every edit.
Process plants buy software for permits, environmental reporting, lab data and contractor management. Their security teams are used to strict site rules and apply the same thinking to web apps that touch plant information.
What we focus onServer-side request forgery in import and reporting features, contractor onboarding and induction records, emissions and lab data integrity, single sign-on with corporate identity, and over-broad read access for site visitors.
Software around the Humber often joins office users to operational data. These weaknesses come up most in apps built for that setting.
Turbine or plant inspection images kept in cloud storage with listable or long-lived links. They can reveal asset locations, defects and site layouts to anyone who finds one URL.
PDF or report features that fetch URLs on the server. An attacker points them at internal addresses or cloud metadata services and reads data the app was never meant to expose.
Freight booking or collection records fetched by ID with no ownership check. A haulier or forwarder can read, and sometimes amend, another firm's consignments and release status.
Web dashboards that show live site data protected by password alone, with no MFA and no lockout. For an energy client this is the finding their reviewers notice first.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Energy operators covered by the NIS Regulations must manage supplier risk. A CREST report on your platform gives them evidence for their own assessments and audits.
Energy and utility buyers use prequalification schemes and questionnaires that ask about security testing. Attaching a current report with retest results answers those questions directly.
Many Humber suppliers hold or are working towards ISO 27001. An annual application pentest feeds your technical vulnerability management controls and gives auditors dated evidence.
No. We test the web application and its API, including how it handles data coming from site systems. Testing operational technology, SCADA or plant networks needs a different scope, specialist safety controls and the asset owner's consent. We will report anything in the web layer that could give a path towards those systems.
It covers the questions about application security testing: who tested, when, to what standard, what was found and whether fixes were verified. It will not answer policy questions such as backups or staff vetting. Most suppliers attach the report and refer to it in the testing section.
The price stays £2,400 for one web app and its API, wherever your users are. Tell us about the roles and integrations with other systems so we can plan the test. We do not test third-party government or port community systems you connect to, only your side of the connection.
No. CyberFortify has no Hull office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
