For Newcastle's B2B SaaS, games and data-driven health teams. Flat price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Newcastle has one of the North's deepest software scenes. Accounting and business software has a long history on Tyneside, the city has a games development community with studio roots going back decades, and Newcastle Helix brings together university research, the National Innovation Centre for Data and health and ageing work. Many teams here sell subscription software nationally and abroad.
Growth usually brings the first serious security review. A UK enterprise sends a supplier questionnaire, a US prospect asks for SOC 2, or an NHS trust wants DTAC evidence. Each of them asks the same thing in different words: has an independent, accredited tester attacked this product, and were the findings fixed?
Multi-tenant business software holds payroll, ledgers and customer records for many companies at once. Larger customers and their auditors want proof that one tenant cannot reach another's data before they renew or expand.
What we focus onTenant isolation across every API route, invitation and user management flows, API tokens for integrations, accountant or partner roles that span many clients, and file exports that bypass the normal permission checks.
Studios running online games operate account systems, stores and back-office tools alongside the game itself. Publishers and platform holders ask how player accounts, purchases and moderation tools are protected before launch.
What we focus onAccount takeover through login and recovery flows, race conditions in virtual currency and item purchases, admin and support consoles, leaderboard and save-data APIs, and payment webhook verification.
Teams working near Newcastle Helix build analytics and digital health products on sensitive datasets. NHS buyers and research partners want evidence that patient and study data cannot leak across organisations or users.
What we focus onIDOR on patient or participant records, data-sharing permissions between NHS organisations, dashboards and query builders that allow injection, pseudonymised data that can be re-identified through the API, and audit trails.
Newcastle products are often multi-tenant platforms or live-service games. These flaws turn up repeatedly in apps built that way.
APIs that take the company or workspace ID from a header or body field. Change it and you read another customer's ledgers, payroll or reports, the single most damaging SaaS finding.
Purchase and redemption endpoints that do not lock balances. Firing requests in parallel lets a player spend the same currency twice or duplicate items, which quickly becomes a fraud and economy problem.
Introspection left on in production and authorisation applied only at query level. Attackers map the whole data model, then request fields their role should never see.
Internal admin or customer support tools on public URLs with weak authentication. One phished support account can then impersonate any customer or player across the whole platform.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
SOC 2 auditors expect evidence of periodic penetration testing and follow-up. A CREST report with retest results slots into your control evidence as you sell to American customers.
The Digital Technology Assessment Criteria ask health tech suppliers for penetration testing evidence. Our report states scope, method and remediation status so NHS assessors can check it quickly.
UK corporates and public bodies ask SaaS suppliers for a recent independent test during procurement. One clear report saves you answering the same questions with screenshots each time.
Our fixed price covers the web application and API that support the game, such as accounts, stores, matchmaking APIs and admin tools. Reversing a game client, anti-cheat or console builds is separate work. Most studios get most value from testing the services, because that is where player data and money live.
SOC 2 does not mandate a specific tester, but auditors look for an independent test with clear scope, dated findings and evidence of remediation. A CREST report with our retest results gives them that. We do not issue SOC 2 reports ourselves; that is your auditor's job.
We prefer a staging environment with synthetic or dummy records, and most NHS partners require it. If testing must run against production, we agree rules in advance and avoid extracting real records beyond what proves a finding. Our handling follows our ISO 27001 certified processes.
No. CyberFortify has no Newcastle upon Tyne office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
