For Milton Keynes logistics, financial services and mobility software teams. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Milton Keynes sits on the M1 within easy reach of London and Birmingham, which has made it a base for distribution centres, logistics operators and large financial services operations. The city has also hosted self-driving vehicle and pavement delivery robot trials, and The Open University is based here. Software in Milton Keynes tends to run warehouses, fleets, back offices and connected services rather than consumer apps.
Those systems sit inside other companies' supply chains. Retailers and shippers ask their logistics software suppliers for security evidence. Financial services firms must check the third parties they outsource to. Mobility projects involve councils, insurers and research partners who each want proof that the platform has been tested independently.
Transport management, warehouse and proof-of-delivery platforms connect retailers, carriers and drivers. A breach can stop deliveries or leak thousands of customer addresses, so retailers and shippers include security testing in supplier onboarding.
What we focus onCarrier and shipper tenant separation, consignment and tracking IDs that can be guessed, label and manifest generation, driver app APIs, and integrations that accept bulk order uploads from customers.
Milton Keynes has large banking and insurance operations, and the software suppliers serving them. Regulated firms must assess outsourcing and third-party risk, and a supplier without a recent pentest slows procurement down.
What we focus onBack-office case management, document handling, agent and team leader permissions, customer search features that return too much, and audit trails that can be edited or bypassed.
Trials of autonomous vehicles, delivery robots and smart mobility services rely on web dashboards and APIs to dispatch, monitor and control devices. Partners need confidence that nobody can take over a fleet through the web layer.
What we focus onFleet command endpoints, operator versus viewer roles, device enrolment and API keys, live location feeds, and whether a customer booking API can be used to reach control functions.
When we test the operational platforms common in Milton Keynes, these four issues come up more than most.
Sequential consignment or order numbers let anyone enumerate deliveries and see names, addresses and delivery notes. For a carrier serving many retailers, this exposes every customer's end customers at once.
A multi-client warehouse system filters stock and orders in the interface but not in the API. One client can query another client's inventory levels, which is commercially sensitive as well as a contract breach.
Driver or vehicle positions are returned to any authenticated user, not just dispatchers. Real-time location of people and high-value loads is a safety risk, not only a data protection one.
Back-office search returns full records for partial matches and has no rate limit. A single compromised agent account can extract large parts of the customer base in an afternoon.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Large retailers send logistics suppliers detailed security questionnaires. A current CREST report, with retest evidence, answers the testing questions directly and shortens the back and forth.
Tracking drivers, vehicles and deliveries means processing location data about identifiable people. Testing shows you have taken appropriate technical measures to protect it, which the ICO expects.
Regulated firms must manage risk in material outsourcing. If you supply software to banks or insurers, our report gives their third-party risk teams independent evidence about the application they depend on.
The web application and the API behind it, which usually includes the endpoints the driver app calls. Testing the native driver app itself, such as local storage and certificate pinning, is a separate mobile test. We will look at your architecture first and confirm in writing exactly what is in scope.
We test the web dashboard and APIs used to dispatch, monitor and configure the fleet, including whether low-privilege users can reach control functions. Testing on-device firmware, radio links or the vehicles themselves is outside a web application test and would need separate specialist scoping.
It covers the security testing part. Outsourcing reviews also look at resilience, exit plans and data location, which are for you to answer. Our report shows scope, dates, findings and retest status, and we can provide a short attestation letter for the client's third-party risk file.
No. CyberFortify has no Milton Keynes office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
