For Nottingham's credit, pharmacy and retail technology teams. Fixed price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Nottingham has an unusual mix of employers for a city its size. Credit reference, data and consumer lending operations employ large teams here, and the city is closely tied to UK pharmacy and health retail. Two universities feed a steady supply of developers and data scientists into local firms, many of them building for retail, finance and health customers across the country.
The common thread is sensitive personal data. Credit files, prescription histories and shopping behaviour are all valuable to fraudsters and heavily scrutinised by regulators. Lenders, pharmacy groups and retailers buying software from Nottingham suppliers want a recent independent test before they connect it to their customers.
Lending, affordability and identity verification platforms process credit files, income data and bank transactions. Lenders and data providers require suppliers to show regular independent testing before granting API access to sensitive data.
What we focus onConsent capture and scope in open banking and credit search flows, application record access, decisioning API authentication, JWT handling, and how much personal data each API response actually returns.
Online pharmacies, prescription services and health product retailers hold medical questionnaires, prescriptions and delivery details. That is special category data, and a breach brings regulatory as well as reputational damage.
What we focus onPrescription and order history access, consultation questionnaire integrity, prescriber versus customer roles, repeat order flows, and whether restricted medicines can be bought by bypassing the clinical checks.
Platforms running loyalty schemes, personalised offers and customer analytics for retailers process purchase histories at scale. Retail clients expect their suppliers to protect that data and to prove it through testing.
What we focus onPoints balance and redemption logic, offer targeting APIs, customer profile access, bulk export controls, and account takeover through credential stuffing on loyalty logins that often lack multi-factor authentication.
Finance, pharmacy and retail data platforms in Nottingham share a theme in our findings: APIs returning or accepting more than they should.
Endpoints often return the full customer object and let the front end hide what it does not need. Anyone reading the raw response can see dates of birth, credit scores or addresses that were never displayed.
Credit and open banking journeys that pass the requested consent scope through the browser can be altered. A tampered request may gain access to more accounts or data than the customer agreed to.
Some pharmacy checkouts validate medical questionnaire answers only in the browser. Submitting the order directly can skip the questions and buy restricted products without the intended safeguards.
Tokens signed with a guessable secret, or services that accept unsigned tokens, let an attacker mint their own identity. In multi-service platforms one weak service can compromise the rest.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Health and prescription data carry extra obligations. A pentest shows you tested the controls protecting it, supporting your data protection impact assessment and your position if the ICO asks questions.
Retail and pharmacy sites taking card payments must test the systems around checkout. Our report supports requirement 11.4 evidence for your acquirer or assessor.
Credit data providers and lenders assess suppliers before sharing data. A CREST report covering the platform and its APIs answers the testing part of that due diligence directly.
We avoid live credit searches. We test with sandbox credentials or agree test identities with you, so no real customer's credit file is searched or footprinted. If a third-party API is involved, we test how your application uses it, not the provider's own systems.
Yes. That is one of the first things we check. We try to order restricted products while skipping, changing or replaying questionnaire answers, and confirm that prescriber approval is enforced on the server, not only in the browser. Bypasses are reported with the exact steps to reproduce.
Yes. We test login rate limiting, lockout behaviour, bot protections and whether multi-factor authentication can be enabled or bypassed. We do not run large-scale password attacks against real customer accounts; we use controlled tests to show whether the defences work.
No. CyberFortify has no Nottingham office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
