For Liverpool's game studios, life sciences platforms and port logistics teams. No day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Liverpool has built software for decades, from long-running games studios to newer digital firms in the Baltic Triangle. The Knowledge Quarter brings universities, hospitals and infection research together, including the Liverpool School of Tropical Medicine. The Port of Liverpool and its freight network support a large logistics sector. Each of these groups runs web platforms holding player accounts, research data or shipment records.
Teams here meet security requirements from very different directions. Game studios answer to publishers and platform partners. Research and health software must satisfy NHS and university data custodians. Freight systems face customers who fear disruption at the quayside. An independent CREST test is evidence that all three groups recognise.
Studios in the city run account systems, stores and leaderboards behind their games. Publishers and partners expect those services to resist cheating, fraud and account theft, because a breach hits players and revenue at the same time.
What we focus onAccount linking and login flows, in-game currency and purchase validation, leaderboard and stat tampering through the API, rate limits on reward endpoints, and admin or support tools used by community teams.
Platforms built around the Knowledge Quarter handle trial data, lab results and pseudonymised patient records shared between universities, the NHS and partners. Data custodians want proof of testing before granting access to sensitive datasets.
What we focus onRole separation between researchers, sites and sponsors, re-identification risk in exports and APIs, audit logging, dataset uploads, and whether a user can reach studies they were never added to.
Booking, tracking and customs-related portals around the port connect shippers, hauliers and agents. Downtime or tampered data can hold cargo at the quay, so larger shippers ask their software providers for independent testing.
What we focus onBooking reference enumeration, access to other customers' consignments, integrity of status updates via API, partner API keys and their scope, and abuse of document upload for shipping and customs paperwork.
In Liverpool's game, research and freight software, these four weaknesses turn up often enough that we check for them on every test.
Rewards, scores or purchases accepted from the client without server checks let players grant themselves currency or items. This damages the in-game economy and often leads to chargebacks and refund claims.
Shipment or booking numbers that increase by one let an outsider walk through other customers' consignments. Freight data reveals routes, values and customers, which is useful to thieves and competitors.
Export features that ignore study-level permissions let a researcher download records from projects they do not belong to. With health data this quickly becomes a reportable breach.
Integrations with agents and hauliers often use static keys that never rotate and grant full access. One key leaked from a partner's system can expose every customer record.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Organisations handling NHS patient data must complete the Data Security and Protection Toolkit. A recent pentest report supports the evidence items on technical testing and helps when an NHS trust reviews your submission.
Player accounts and research participants both create personal data obligations. A pentest shows you took appropriate technical measures, and the retest records that issues were closed, which matters if the ICO asks.
Large shippers and port users send security questionnaires before connecting to booking or tracking systems. Our report and retest letter answer the testing questions in one document.
We test the web services and APIs: accounts, stores, matchmaking or leaderboard endpoints, and admin tools. The £2,400 price covers one web application and its API. Game client reverse engineering, console builds and anti-cheat reviews are separate pieces of work, and mobile builds are scoped separately too. We will tell you what fits before you book.
Usually, yes. Testing is remote, so we need the app reachable from our test IP addresses or through a VPN account the university provides. Many data custodians prefer a staging copy with synthetic data, which we are happy to test. We agree access, test accounts and any data rules with your IT and governance teams first.
Yes. We agree testing windows, rate limits and which accounts we can use, and we avoid actions that would create or cancel real bookings. Where possible we test a staging environment. If a finding needs proof against production, we use the least intrusive method and tell you before we try it.
No. CyberFortify has no Liverpool office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
