For Newry's freight, cross-border retail and building-products teams. £2,400 per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Newry sits on the Belfast to Dublin corridor, a few miles from the border, and its economy has long been shaped by trade between the two. Haulage and freight forwarding firms, cross-border retailers and building-products manufacturers are all prominent in the wider area. Their software handles consignments, customs paperwork, quotes and payments in two currencies.
Since the Windsor Framework, goods moving into Northern Ireland come with more data and declarations, and the platforms carrying that data have become more important to trade. Customers, insurers and partners want assurance those systems are secure. A CREST pentest gives a clear answer about the web applications and APIs involved.
Hauliers and forwarders in the Newry area run booking, tracking and declaration platforms used by shippers on both sides of the border. Customers trust them with commercial and customs data.
What we focus onConsignment and declaration access by customer, tracking links, document upload for customs paperwork, driver and subcontractor accounts, and integration APIs with shipper systems. We also check how subcontracted hauliers are limited to their own loads.
Retailers here sell into both Northern Ireland and the Republic, often with sterling and euro pricing. Multi-currency checkouts and delivery rules create more logic to get wrong. Each rule is a chance for errors attackers can exploit.
What we focus onCurrency and price calculation, VAT and delivery rule handling, voucher logic across stores, customer account takeover, and payment provider integration. We also test stock and delivery checks that differ between Northern Ireland and Republic addresses.
Manufacturers and merchants in the area supply builders through trade portals with credit accounts, quotes and order histories. Trade credit makes account security a financial issue. A hijacked account means real goods on real credit.
What we focus onTrade account access and credit limits, quote and pricing visibility between customers, order placement on credit, delivery address changes, and staff impersonation features. We also test how new site contacts are added to a trade account.
Trade across the border puts customs data, currency and trade credit at the centre of Newry's applications, which shapes the findings we expect.
Declaration or invoice documents are stored under sequential references. Changing the number exposes other shippers' invoices, values and consignee details. Competitors could learn pricing and customer lists from them.
Switching currency mid-checkout recalculates the basket incorrectly, or the server trusts a converted total from the browser. Goods can be bought far below price. Small discrepancies are easy to miss in reconciliation.
A trade portal lets a user place orders against any account number in the request. Fraudsters can order materials on another firm's credit and redirect delivery.
Public tracking pages show more than status, including names, phone numbers and full addresses, and are indexed or easy to enumerate. That data supports parcel fraud and targeted phishing.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Businesses serving customers in both jurisdictions handle data under UK GDPR and EU GDPR. A pentest shows customers and regulators on both sides that security measures were tested.
Insurers increasingly ask about independent testing at renewal, particularly for firms handling payments or trade credit. A recent CREST report gives a straightforward answer.
Cross-border shops taking card payments in two currencies must still protect card data. Testing the checkout and payment integration supports your PCI DSS obligations.
We test your application and its APIs, including how it stores and sends declaration data. We do not test government customs systems themselves, as we have no authority to. We check that your side of the integration does not leak credentials, accept tampered data or expose other customers' declarations.
Yes. Different currencies often take different code paths for pricing, VAT and delivery. We test both, and any switching between them, as part of the same application. It is one test at £2,400 if both currencies run through the same site and back end.
The web back end and API that receive proof of delivery are included in the application test. The driver's mobile app itself, such as how it stores data on the device, is scoped separately. Most serious issues, like seeing other drivers' jobs, are found at the API level.
No. CyberFortify has no Newry office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
