For Highland life-sciences firms, public-sector suppliers and tourism platforms. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Inverness is the Highlands' main city and its economic centre. Inverness Campus brings together life-sciences companies, the University of the Highlands and Islands and Highlands and Islands Enterprise. NHS Highland and The Highland Council are major employers and buyers. Tourism, from bookings to activity providers, depends heavily on online sales across a large, remote region.
Suppliers here often sell to public bodies that must follow Scottish Government guidance on cyber resilience. Diagnostics and health firms answer to NHS and laboratory customers. Tourism platforms take card payments. Each group needs evidence that the web application holding their data has been tested independently, and a flat price suits smaller Highland teams.
Companies around Inverness Campus build diagnostics, medical device and health data products. Results portals and connected device dashboards hold sensitive health information, so customers and regulators expect testing. Remote patients make online access the norm.
What we focus onAccess to test results and device data, clinician and lab roles, result tampering, API authentication for connected devices, and audit logging of who viewed which record.
Local firms provide software to councils, NHS Highland and other public bodies across a dispersed region. Those buyers ask suppliers for security evidence as part of procurement and contract review.
What we focus onCitizen and staff role separation, case and service records, document uploads, single sign-on with public-sector identity, and reporting features that may expose personal data. Accounts for remote staff working across the region get the same checks.
Accommodation, tours and activity providers across the Highlands sell online, often through small, locally built booking systems that take payments and store guest details. Few of these teams have anyone responsible for security.
What we focus onBooking and availability APIs, price and discount manipulation, payment integration, guest data exposure, and admin panels used by small operators. We also check how cancellations and refunds are authorised, since those move money back out.
Inverness teams serve patients, public bodies and visitors, often from small development teams, so these findings come up repeatedly in comparable applications.
A diagnostics portal returns test results from a link containing a guessable reference. Anyone who changes the reference can view another patient's result. Health data makes this a notifiable breach.
The total for a tour or stay is calculated in the browser and sent to the server unchecked. Attackers can book at any price they choose.
Small operators share one admin login across staff. There is no way to tell who changed what, and the password rarely changes when someone leaves.
A public-sector case system's search or autocomplete returns names and addresses from records the user cannot open, leaking personal data in fragments. Attackers can piece together a full record from repeated searches.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Scottish public bodies use this framework and look at supplier assurance. A CREST pentest report helps you show a council or health board that your application has been tested.
Suppliers handling NHS patient data complete the Data Security and Protection Toolkit. Independent testing evidence supports the technical security sections and your customer's own assurance.
Tourism businesses taking card payments must meet PCI DSS. Testing the booking flow checks that payment pages and integrations do not expose card data or allow tampering.
Generally no. CHECK applies to certain central government and critical national infrastructure work. Most council and health board supplier requirements ask for independent or CREST testing, which we provide. If your contract explicitly names CHECK, you would need a CHECK provider, and we would tell you so before quoting.
If the booking plug-in is hosted by a large provider, their own security largely covers it, and a pentest of your site adds little. A test is worth it when you have a custom booking system, your own payment integration or a portal holding guest data. We will tell you honestly which applies.
The dashboard and the APIs the device uses to send data are in scope as one application. We test authentication, data access between customers and result integrity. Device firmware and hardware testing are not covered and would need a specialist assessment.
No. CyberFortify has no Inverness office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
