For Lancaster spin-outs, energy supply chain firms and environmental data teams. No day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Lancaster's economy leans on its university, which the NCSC recognises as an Academic Centre of Excellence in Cyber Security Research. Spin-outs and start-ups grow from that research and from the Lancaster Environment Centre, which also hosts a UK Centre for Ecology and Hydrology site. Along the coast, Heysham's nuclear power station and port support an energy supply chain with its own software needs.
Early-stage teams usually need a first pentest to land a first enterprise customer or close a seed round. Energy suppliers sell to operators bound by the NIS Regulations. Environmental data platforms are asked by funders and partners to protect long-running datasets. In each case, a fixed-price CREST test is easier to budget for than open-ended day rates.
New companies from Lancaster's research base often sell to large organisations before they have a security team. Their first enterprise buyer usually sends a questionnaire, and a recent pentest is one of the first items requested.
What we focus onThe basics young codebases miss: access control on every endpoint, secure defaults, secrets in front-end code, user invitation flows, and whether the admin panel is reachable or guessable from the internet.
Firms around Heysham and the wider North West energy sector build maintenance, contractor and asset management tools. Their customers include operators covered by the NIS Regulations, who must manage risk from suppliers.
What we focus onContractor and permit-to-work portals, role separation between operator and supplier staff, asset data exposure, partner API access, and how web apps connect towards operational systems. Operational technology itself is out of scope.
Platforms that collect and publish environmental monitoring, sensor and survey data are built around the Lancaster research community. Funders and partners want long-term datasets protected from tampering and from accidental exposure.
What we focus onIntegrity of data submission APIs, authentication for sensor and device uploads, public versus restricted dataset controls, export features, and API keys embedded in dashboards or notebooks.
In Lancaster's spin-out, energy and research software, these weaknesses appear most often during a first or second penetration test.
API keys, cloud storage credentials or internal URLs left in JavaScript bundles are easy to find. Young teams under deadline pressure ship these more often than anyone expects.
Sensor or upload endpoints that accept data without strong authentication let anyone inject false readings. For monitoring datasets used in research or reporting, tampered data is hard to detect later.
Contractor accounts on permit or maintenance portals stay active long after the job ends. Combined with weak passwords, this gives former staff or attackers an easy way back in.
Search or listing APIs reveal titles, metadata or download links for datasets marked as restricted. The interface hides them, but the API still returns them to anyone who asks.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Spin-outs going for ISO 27001 need evidence of technical vulnerability management. A first CREST pentest, with fixes retested, is a straightforward artefact for the Stage 2 audit.
Energy operators covered by NIS must manage risk from their suppliers. Giving them an independent pentest of the system you provide makes their supplier assessment, and your renewal, easier.
Funders and data partners increasingly ask how shared platforms are secured. A pentest report shows a concrete, dated control rather than a policy statement.
Often it is the thing that unblocks the deal. Enterprise buyers rarely sign without some testing evidence, and fixing issues before launch costs less than fixing them after. At £2,400 with retest included, the cost is known in advance. If the product still changes weekly, we suggest testing once the core features and user roles are stable.
You own the report. You can share it with customers, investors or your university's technology transfer office as you see fit. Many founders share the executive summary and retest letter widely and keep the full technical findings for readers under NDA. We can provide a summary suitable for a data room.
We check that restricted records, files and metadata never leak through search, listing, export or download endpoints, and that changing an ID or parameter cannot unlock them. We also look at who can publish or edit datasets, and whether submission APIs can be used to insert false data that would later look genuine.
No. CyberFortify has no Lancaster office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
