For Lisburn's engineering firms, retailers and council suppliers. Fixed price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Lisburn sits just south-west of Belfast, with a mix of engineering and manufacturing firms, a major retail destination at Sprucefield, and public-sector employers including Lisburn and Castlereagh City Council. Thiepval Barracks, the Army's headquarters in Northern Ireland, gives the area a defence presence. Local software ranges from supplier portals and quoting tools to retail e-commerce and council-facing services.
Security requirements here depend on the customer. Engineering firms in aerospace and defence supply chains face formal cyber requirements from primes. Retailers take card payments. Public-sector contracts carry procurement security checks. We can cover the commercial application testing these buyers ask for, and we are clear about where specialist defence schemes take over.
Engineering firms around Lisburn exchange drawings, quotes and orders with customers through supplier portals. Those in aerospace and defence supply chains face cyber requirements set by their prime contractors. Those requirements reach small firms too.
What we focus onAccess to drawings and technical files by customer, quote and order manipulation, supplier user management, file upload and download controls, and integration with ERP systems.
Retailers and brands in and around Sprucefield trade online as well as in store. Web shops, click-and-collect and loyalty schemes all process payments and customer accounts. Each is a target for fraud.
What we focus onCheckout and discount logic, gift card and loyalty balance abuse, account takeover, click-and-collect order access, and payment page integrity. We also check how staff accounts in the store's back office are protected and logged.
Software firms supplying councils and public bodies in Northern Ireland handle resident data in licensing, bookings and service requests. Public buyers ask for security assurance at tender. Councils carry the reputational risk if it leaks.
What we focus onResident accounts and service records, staff and contractor roles, online payments for council services, document uploads, and public search features. We also check how contractor accounts used for inspections or enforcement are limited to their own cases.
Lisburn's mix of supply-chain portals, retail and public services produces a distinct set of findings, with technical data and payments most at risk.
A supplier portal serves CAD files and specifications by file ID. Changing the ID returns drawings belonging to other customers, which can breach contracts and export controls.
Checkout accepts the same single-use code repeatedly or combines codes the business never meant to stack. Losses can grow quickly once codes circulate online. Abuse is rarely noticed until margins drop.
Gift card balance checks have no rate limit, so attackers can guess card numbers and drain valid balances before customers spend them. Customers then blame the retailer, not the attacker.
A licensing or planning search returns more fields than the page displays, such as personal contact details, which are visible in the raw API response.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Defence primes may ask for Cyber Essentials, DCPP risk assessments or JOSCAR. Our CREST report supports commercial assurance. Where a contract requires CHECK, a CHECK company must do that work.
Merchants with their own checkout or payment integrations need to protect card data. Testing the payment journey helps support PCI DSS application testing requirements.
Northern Ireland public tenders often ask about independent testing. A recent CREST report and attestation letter answers those questions with dated evidence.
For the commercial web applications you run, such as a supplier portal, many primes accept a CREST pentest as evidence. Defence contracts can carry extra requirements, including Cyber Essentials, DCPP or occasionally CHECK. We are not a CHECK company. Check your contract wording, and we will tell you plainly if our test will not satisfy it.
On a hosted platform, the provider secures the core. We focus on what you have added: custom apps, checkout changes, loyalty or gift card features, and integrations with your stock or customer systems. If you have changed very little, a full test may not be worth it, and we will say so.
It can be both. Our test checks that drawings are only reachable by the right customer accounts, which is a security control. Whether particular files are export-controlled is a legal question for your compliance team. A clean report helps show the access controls behind your export obligations are working.
No. CyberFortify has no Lisburn office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
