For Newport's semiconductor, cyber and public data software teams. Flat price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Newport sits at the heart of the South Wales compound semiconductor cluster, with wafer fabrication and design firms along the M4 corridor. The city is also home to national bodies such as the Office for National Statistics and the Intellectual Property Office, and the University of South Wales runs cyber security teaching and research here. That mix creates a market for secure, specialist software.
Semiconductor customers guard designs and process data closely and check their suppliers. Government bodies apply formal supplier assurance. Cyber startups need their own product tested before anyone will trust it. In each case the buyer wants independent evidence, and for government work it is worth knowing early whether CHECK is required.
Compound semiconductor firms share designs, wafer data and orders with customers worldwide. Leaks of process or design information are a commercial and sometimes a national security concern, so customers audit supplier software.
What we focus onAccess to design files and test data by customer, order and lot ID enumeration, file sharing links, export-controlled data separation, contractor accounts, and integrations with engineering tools.
Newport's cyber talent produces startups selling security products. Buyers expect a security vendor to have had its own product tested independently, and a weak finding in a security tool hurts more than most.
What we focus onAgent and API authentication, multi-tenant separation of customer telemetry, privilege escalation in admin consoles, injection in search and query features, and secrets handling in the platform.
Suppliers building data, survey and case tools for national bodies face formal assurance before go-live. Departments want to know that personal and embargoed data cannot be accessed early or by the wrong user.
What we focus onEmbargo and publication controls, respondent and case record IDOR, bulk download features, role separation for analysts and administrators, and audit logging that stands up to review.
Newport's buyers protect designs, telemetry and official data. These are the weaknesses we most often find in apps built to hold them.
Download endpoints that check login but not which customer owns the file. A rival's engineer with a valid account could pull mask designs or test results by changing an ID.
Content scheduled for release served by the API before its embargo time, or visible in drafts to the wrong role. For statistics and results, early release is a serious incident.
Security products that store many customers' alerts and logs together and filter in the UI only. A crafted API query skips that filter and returns other customers' alerts, logs and asset details.
API tokens for integrations given full admin rights and no expiry. One leaked token from a CI pipeline or log file gives an attacker the whole platform.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Some government and critical national infrastructure work must be tested by a CHECK company. CyberFortify is not one. Confirm the requirement first; many supplier contracts accept CREST testing instead.
Public bodies and essential services assess suppliers against the NCSC Cyber Assessment Framework. A CREST report supports outcomes on vulnerability management and secure configuration for your application.
Semiconductor customers audit how suppliers protect designs and process data. A pentest report showing access controls were attacked and verified gives their auditors evidence beyond policy documents.
Yes, independence is the point. Buyers want to see that someone outside your team tested the product to a recognised standard. A CREST report with retest evidence is a common requirement in enterprise procurement for security vendors, and it carries more weight than an internal assessment.
It affects how we test. We prefer a staging environment with dummy designs, and we will not download real controlled data. Tell us about any handling rules or nationality restrictions in advance so we can confirm they can be met before the test is booked.
It depends on the contract. CHECK is required for some government systems and critical infrastructure, and we cannot provide it. Many supplier contracts instead ask for a CREST or equivalent independent pentest, which we do provide. Check the tender wording or ask the buyer directly.
No. CyberFortify has no Newport office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
