For Manchester's fintech, online retail and B2B SaaS teams. Fixed £2,400 per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Manchester has one of the biggest tech economies outside London. Payments and lending start-ups work a short walk from fast-growing online fashion and retail brands, and the city centre is full of B2B SaaS teams selling to property, HR and finance buyers. GCHQ opened a Manchester office in 2019, which has added to the local security talent pool. Much of the software built here handles money, card data or customer accounts.
Most Manchester scale-ups meet the pentest question in a procurement pack. An enterprise buyer, a partner bank or an acquirer asks for a recent independent test before signing. A dated CREST report with a clean retest answers that question once, instead of in a dozen custom spreadsheets.
Lending, payments and open banking start-ups here connect to banks, card schemes and each other through APIs. Partner banks and payment processors want evidence that those APIs cannot be abused before they switch a connection on.
What we focus onAuthorisation on account and transaction endpoints, race conditions in transfers and refunds, webhook signature checks, token scope and expiry, and whether one customer can read another customer's statements by changing an ID.
Manchester is home to several large online retail brands and the agencies and platforms that serve them. Checkout, loyalty and returns flows see heavy traffic and attract fraud, so retailers want them tested before peak trading.
What we focus onBasket and price tampering, discount and gift card logic, account takeover through password reset, guest checkout data exposure, and third-party scripts on payment pages that matter for PCI DSS.
Property management, build-to-rent and HR platforms built in the city hold tenant, landlord and employee data for many client organisations in one database. Each new enterprise customer brings another security questionnaire to answer.
What we focus onTenant isolation between client accounts, role escalation from standard user to admin, document upload and download controls, bulk export endpoints, and single sign-on and user provisioning configuration.
On Manchester fintech, retail and SaaS apps, these are the weaknesses we report most often before a release or a funding round.
Sending the same refund or transfer request several times in parallel can credit an account more than once. Payment apps that check a balance before writing, without locking, often miss this until a customer finds it.
Checkout APIs that accept a price, discount or delivery charge from the browser let a shopper edit the basket total. We see this most in custom headless storefronts built quickly for a launch.
A changed organisation ID in an API call returns another client's tenants, leases or payroll records. One missing check in a shared SaaS codebase exposes every customer at once.
Reset tokens that never expire, can be reused, or leak in referrer headers let attackers take over customer accounts. On retail sites this leads straight to stored addresses, saved cards and loyalty balances.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Merchants and payment platforms must test their cardholder data environment and payment pages. Our report covers the web app and API in scope and gives your QSA or SAQ owner clear evidence of testing and retest.
SOC 2 auditors look for independent testing as part of your risk and monitoring controls. A dated CREST report, with retest results, gives your auditor a clean artefact for the review period.
Large buyers ask when you were last tested, by whom, and whether high-risk issues were fixed. Our executive summary and retest letter answer those questions without sharing raw findings.
Usually, yes. Banks typically want an independent test by an accredited firm, clear severity ratings and proof that high-risk issues were fixed. Our CREST report covers your web app and its API, and the included retest shows the fixes. If the bank has its own scoping template, send it and we will confirm what the £2,400 test covers before you book.
Yes. We can test against a staging environment that mirrors production, which most retailers prefer in the run-up to peak trading. If you want production tested, we agree rate limits and a testing window with you first. Book early in the autumn so that fixes and the retest land before your change freeze.
Test once the new services carry real traffic or real data, not halfway through the move. If the migration runs over several months, test the customer-facing journey at a stable point, then use the retest to confirm fixes. Buyers' questionnaires often ask whether testing followed a major architecture change, so a dated report after the switch is useful.
No. CyberFortify has no Manchester office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
