For Leeds health tech suppliers, legal software teams and data platforms. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Leeds has long been a base for national health and care organisations, and many health tech firms grew up nearby to supply them. The city is also one of the largest legal and professional services centres outside London, which supports a market for case management, document and client portal software. A strong data and analytics community builds platforms that combine information from public bodies, retailers and banks.
Health tech suppliers need testing evidence for NHS assurance before a trust will deploy them. Law firms carry client confidentiality duties and push them onto their software vendors. Data platforms hold other organisations' data and are judged by its owners. All three ask for an independent test before signing, and again when the product changes.
Patient-facing apps, clinical tools and care record products from Leeds suppliers must pass NHS assurance before deployment. Trusts and integrated care boards ask for a recent independent pentest as part of that review.
What we focus onIDOR on patient and appointment records, clinician versus patient role separation, NHS login integration, multi-site and care home tenancy, audit logs of record access, and FHIR or other health data APIs.
Case management, e-signature, conveyancing and client portal tools serve the city's many law and accountancy firms. These systems hold privileged documents and client money details, and firms' risk teams test vendors hard.
What we focus onMatter-level access control, document sharing links, client portal separation, conveyancing payment and completion flows, and the late bank detail change process that conveyancing fraud so often targets.
Leeds data businesses build dashboards, data sharing and analytics products that combine information from many clients. A single access control mistake can expose one client's data to another, so buyers want independent evidence.
What we focus onTenant isolation in query and reporting layers, API key scoping, row-level security, export and scheduled report features, injection through filter and query parameters, and embedded dashboard tokens.
Across Leeds health, legal and data software, these are the findings NHS reviewers, law firm risk teams and data owners care about most.
Changing an appointment or patient ID in an API call returns another person's health record. This is the most common serious finding in clinical apps, and a reportable breach if exploited.
Completion and payment flows that let bank details change late, without out-of-band checks, enable the fraud conveyancing teams fear most. We test the controls around that change.
Document links sent to clients or other parties stay valid forever and need no login. Privileged papers then end up wherever those emails are forwarded.
Tokens used to embed analytics dashboards in client sites can often be reused to query other datasets or other tenants. We check their scope, lifetime and signing.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
The Digital Technology Assessment Criteria ask for evidence of security testing on digital health products. Our CREST report supports the technical security section that NHS buyers check.
Suppliers processing NHS data complete the Data Security and Protection Toolkit each year. A recent pentest, with retest results, supports the toolkit's evidence on vulnerability testing.
Law firms audit suppliers against their own client confidentiality and information security policies. A CREST pentest gives their risk team an independent view of your platform's controls.
DTAC's technical security section asks whether the product has been penetration tested by a suitably qualified provider and whether issues were fixed. Our CREST report and included retest answer that. Other DTAC areas, such as clinical safety, data protection and interoperability, are separate and need your own evidence. We can explain what reviewers usually look for in the security section.
Generally, yes. Risk and IT teams at law firms look for an accredited tester, a clear scope, severity ratings and evidence of fixes, and our report includes all four. If a firm has its own vendor questionnaire, we can show you which answers the report supports, so you are not rewriting the same evidence for every panel review.
We set up at least two test tenants with different roles and try to reach one from the other through every route: API calls, filters, exports, scheduled reports, shared dashboards and embedded tokens. Tenant isolation flaws are the most valuable thing we find in data products, so we spend much of the test there.
No. CyberFortify has no Leeds office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
