CREST Accredited by CREST G2 Rated 4.8/5 on G2

CREST Penetration Testing in London
£2,400 Flat per App

For London's fintech, insurtech and enterprise SaaS teams. Retest included, no day rates.

Get your £2,400 quote Book a scoping call
CREST accredited: Penetration Testing CREST accredited: Vulnerability Assessment CREST accredited: App Security Testing CREST accredited: Mobile App Security Testing

Get your £2,400 pentest quote

Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.

  • £2,400 flat per app and its API, any size
  • Retest included
  • CREST accredited, rated 4.8/5 on G2

Prefer to talk? Book a 30-min scoping call

Penetration Testing for London Teams

Greater London

London is where most UK fintech, insurtech and B2B SaaS companies sell into regulated buyers. Payments firms, challenger banks and wealth platforms cluster around the City, Shoreditch and Canary Wharf, while the Lloyd's market keeps a steady flow of insurance software in demand. Much of that software touches money, policy data or customer identity, so it gets scrutinised hard before anyone signs.

Bank and insurer procurement teams usually ask for a recent CREST pentest report and an attestation letter before a contract moves forward. FCA-regulated firms need evidence that their important business services were tested. Investors at Series A and beyond increasingly check for a report in the data room too.

What London Teams Bring Us to Test

Fintech and payments

Payment initiation, open banking and card platforms move real money and hold account data. London's banks, e-money firms and their partners will not onboard a supplier without independent testing, and regulators expect it as part of operational resilience work.

What we focus onTransfer and refund flows, race conditions on balances, open banking consent handling, idempotency keys, KYC document access and whether one customer can read or act on another customer's account through the API.

Insurtech and the Lloyd's market

Broker portals, underwriting workbenches and claims platforms handle sensitive policyholder data and price risk. Carriers and managing agents in the London market run detailed supplier security reviews, and a pentest report is usually one of the first documents requested.

What we focus onBroker versus underwriter role boundaries, quote and policy document access, bulk export endpoints, file uploads on claims, and whether pricing or referral logic can be bypassed by editing requests.

Enterprise B2B SaaS

London SaaS companies sell into banks, law firms, media groups and the public sector. Those buyers send long security questionnaires, and a current third-party test answers a large share of them in one go.

What we focus onTenant isolation, SSO and SCIM provisioning, admin role escalation, API token scope, audit log integrity, and the bulk data export features that large customers rely on.

What We Often Find

Across the money-moving and policy-handling apps typical of London, these are the weaknesses we see most often.

Broken object-level authorisation on accounts

Changing an account or wallet ID in an API call returns another customer's balance or statement. In a payments product this is a reportable data breach and often a contract-ending event with a bank partner.

Race conditions in transfers

Sending parallel withdrawal or refund requests lets a user spend the same balance twice. Automated scanners rarely catch it, but it is one of the first things a motivated attacker tries against a ledger.

Broker role leaking underwriter data

A broker account can call endpoints meant for underwriters and see referral notes, loadings or other brokers' submissions. Insurers treat this as both a confidentiality and a commercial problem.

Unsigned or replayable webhooks

Payment or KYC provider callbacks are accepted without checking the signature or timestamp. An attacker who finds the endpoint can mark payments as settled or identities as verified.

Trusted by SaaS Teams Worldwide

£2,400. Not £12,000–£25,000.

What UK pricing guides put a SaaS app with an API and several user roles at.

Typical UK quote
CyberFortify
How it’s priced
Typical UK firm: day rates (median ~£1,000/day)
£2,400 flat per application
SaaS app, API, several roles
£12,000–£25,000
£2,400
Retest of your fixes
Often extra, £2,000–£5,000
Included
App bigger than expected
More days, bigger invoice
Same £2,400, no size cap
Who tests
Varies by firm
CREST-accredited engineers

Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).

Got a UK Quote? See Your Saving

Example figures are filled in. Change them to match your quote.

days
£
£
£
Your saving
Your UK quote£9,500
CyberFortify, retest included£2,400
£7,10075% less than your quote
Book my £2,400 pentest

One Price, Everything In It

Per application · any size

£2,400flat

  • One web app and its API, no endpoint cap
  • Testing starts within a week, report in 4–7 working days
  • Free retest, signed attestation letter
Book a scoping call

Included in the £2,400

  • AI-enabled testing, with every finding validated and exploited by CREST-accredited engineers
  • Authentication, access control between user roles and business logic
  • Criticals flagged within 24 hours, not held for the final report
  • CVSS-scored findings with reproduction steps and the fix
  • Clean report and signed attestation letter for customers, auditors and insurers
  • ISO 27001 and ISO 9001 certified processes, professional liability cover and Koop cyber insurance

One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.

From First Call to Clean Health Report

9 gates, the same sequence on every engagement.

  1. 01

    Discovery

    Client insight

    We send a short questionnaire to understand your infrastructure, business requirements and security concerns.

    Owner: you + CyberFortifyOutput: completed questionnaire
  2. 02

    Agreement

    Scope & SOW

    We analyse your answers, define a clear scope and issue the Statement of Work.

    Duration: 2–3 business daysOutput: signed SOW
  3. 03

    Initiation

    Kickoff meeting

    We walk through methodology, timeline and requirements, and access is handed over securely.

    Format: live sessionOutput: methodology brief
  4. 04

    Active testing

    Testing execution

    AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.

    Duration: 4–7 working daysLive alerts: high & critical
  5. 05

    Reporting

    Report delivery

    Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.

    Format: PDF + machine-readableAudit-ready
  6. 06

    Walkthrough

    Report review

    A session with your technical team to explain findings, priorities and remediation approaches.

    Duration: 60–90 minutesRecorded on request
  7. 07

    Remediation

    You fix

    Your teams implement fixes. We stay available for guidance throughout.

    Timeline: you set itSupport: on call
  8. 08

    Verification

    Retest

    We re-test every previously identified issue to confirm the fix and check nothing new was introduced.

    Cost: includedScope: every finding
  9. 09

    Attestation

    Clean health report

    A final report confirming remediation and your improved security posture, ready to share with auditors.

    Audit-readyShareable with customers

What London Buyers Ask For

FCA operational resilience

Firms must show their important business services can stay within impact tolerances. A pentest report on the customer-facing apps behind those services is concrete evidence for the self-assessment and board review.

DORA for EU-facing firms

London firms with EU entities or EU financial clients are being asked for ICT risk and testing evidence under DORA. Our report gives those clients a documented, independent test of the application they rely on.

PCI DSS

If your app touches cardholder data or the payment page, PCI DSS requires application penetration testing. We test the web app and API in scope and report findings in a form your QSA can use.

Before you book.

A bank partner has asked for an attestation letter before go-live. Can you provide one?

Yes. Alongside the full report we issue a short attestation letter that confirms what was tested, when, by whom, and the status of findings after retest. It is designed to be shared with bank and insurer procurement teams without exposing the technical detail of your vulnerabilities.

Does your test count towards our FCA operational resilience evidence?

It can form part of it. Operational resilience covers far more than security testing, but an independent CREST test of the apps behind an important business service is a common piece of evidence. We state scope and dates clearly so your risk team can map the report to specific services.

We are an insurtech selling to Lloyd's managing agents. What will they want to see?

Usually a recent independent pentest of the platform they will use, confirmation that high and critical issues are fixed, and answers on data handling. Our report covers the first two, including retest results. We test broker, underwriter and admin roles separately so role boundaries are clearly evidenced.

Do you have an office in London?

No. CyberFortify has no London office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.

Why is it cheaper than UK day-rate firms?

Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.

Is CyberFortify really CREST accredited?

Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.

What counts as one application?

One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.

Is the price really fixed?

Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.

Are you a CHECK company?

No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.

How fast can you start?

Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.

What happens to our data?

CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.

Already have your scope written up? Send full scope details

Also Testing Near London

All UK locations · UK CREST penetration testing

A CREST pentest in London for £2,400.
Booked this week.

Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.

Get your £2,400 quote Book a scoping call

Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.