For Oxford's digital health, clinical research and science spin-out teams. Retest included, no day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Oxford's technology economy grows out of the university and its hospitals. Spin-outs in vaccines, diagnostics, digital health and AI sit alongside clinical research groups, science parks on the city's edge and, a short drive south, the Harwell campus with its space and big-science facilities. Much of the software built here handles patient data, trial results or research datasets that other organisations depend on.
That puts Oxford teams in front of demanding reviewers. NHS trusts check suppliers against the Data Security and Protection Toolkit and DTAC. Pharma partners audit vendors before trial data goes anywhere near a new platform. Investors backing university spin-outs want to see that a product handling health data has been tested independently.
Patient-facing apps, remote monitoring and clinical decision tools are sold to NHS trusts and practices. NHS buyers ask for penetration testing as part of DTAC and supplier onboarding, and they read the report.
What we focus onIDOR on patient records, clinician versus patient roles, NHS login and SSO integration, appointment and messaging features, file uploads of clinical documents, and audit logging of who viewed what.
Electronic data capture, eConsent and trial management tools hold participant data and results that regulators rely on. Sponsors and CROs qualify vendors carefully, and security testing is a standard part of that.
What we focus onSite and sponsor separation, blinding controls, audit trail integrity, participant identity data, unblinding functions restricted to the right roles, and bulk exports of trial datasets.
Spin-outs and research groups build data platforms, AI tools and instrument portals used by external collaborators. Valuable datasets and intellectual property make them targets, and partners want assurance before sharing data.
What we focus onDataset access between collaborating organisations, API keys in notebooks and pipelines, model and data download controls, collaborator invitation flows, and compute job features that could run unintended code.
When we test the health, trial and research software coming out of Oxford, these four problems appear more often than any others.
Incrementing a patient or appointment identifier in an API request returns another person's health data. It is the most common serious finding in health apps and is reportable to the ICO.
Trial or clinical data changes are logged, but the log itself can be edited or bypassed through a secondary endpoint. Sponsors and inspectors depend on that trail being trustworthy.
Treatment allocation is hidden in the interface but returned in an API response to site staff. Accidental unblinding can compromise an entire study, not just one record.
External researchers keep dataset access after a project ends because invitations and shared links do not expire. Sensitive or licensed data stays exposed long after anyone remembers it.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Suppliers handling NHS patient data complete the DSPT, which asks about penetration testing of systems. A CREST report with retest evidence answers those questions directly.
The Digital Technology Assessment Criteria include a cyber security section that NHS buyers use to assess digital health products. A recent pentest of the product is part of the evidence they expect.
Sponsors and CROs audit eClinical vendors before use, alongside their GxP and computerised system validation checks. An independent pentest report helps you pass the security part of that audit.
Include the product the trust will actually use: the patient and clinician web app, its API, and any admin portal. We test each role separately so the report shows patients cannot reach other patients' data and clinicians only see their own caseload. Mobile apps, if any, are scoped as a separate test.
Yes, and we recommend it. Most sponsors expect testing against a validated test or UAT environment with dummy studies and synthetic participants. We need representative roles, such as site user, monitor and sponsor, so we can check blinding and separation properly.
Increasingly, yes, especially when the product handles health or research data. A short attestation letter in the data room shows the product was tested and serious issues fixed. It also saves time later, as the first NHS or pharma customer will ask for the same evidence.
No. CyberFortify has no Oxford office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
