For Perth suppliers to insurers, energy firms and transport operators. £2,400 per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Perth is small for a city but punches above its size as a corporate base. Large insurance, energy and transport groups have headquarters or major offices here, and a ring of software and services firms supplies them. That supply chain builds quote engines, customer energy portals, ticketing apps and field service tools, mostly as web applications with APIs behind them.
Big corporate buyers hand suppliers long security schedules. Insurers have regulators watching their outsourcing. Energy companies are subject to NIS oversight. Transport operators take card payments from the public every day. Whichever one you sell to, a recent CREST pentest is usually on the list before a contract is signed or renewed.
Perth's insurance presence creates demand for broker portals, quote and buy journeys and claims tools. Insurers must oversee material outsourcing, so suppliers are asked for independent testing as standard. It is rarely optional.
What we focus onQuote manipulation through altered risk data, broker access to other brokers' clients, policy document access, claims status APIs, and fraud controls that can be bypassed.
Energy firms with Perth operations depend on suppliers for customer account portals, smart meter data services and field engineer apps. Customer and meter data both attract regulatory scrutiny. Suppliers must show those systems are tested.
What we focus onAccount takeover on customer portals, meter reading and consumption data access, tariff or direct debit changes, and field job APIs that expose customer addresses. Vulnerable customer flags get particular attention.
Bus and transport groups run mobile ticketing, journey planning and concession schemes built on web APIs. These handle payments and personal data for large numbers of passengers. Operators want both protected.
What we focus onTicket generation and validation APIs, replay of purchased tickets, concession eligibility checks, stored card handling, and account data exposure through journey history. We also check refund and cancellation flows, which are a common route for fraud.
Perth's corporate buyers expect suppliers to protect large customer bases, so these are the findings with the widest reach in their applications.
A broker portal links policies to a broker ID passed in the request. Changing it shows clients, premiums and claims belonging to a competing broker, a serious commercial and data protection problem.
A mobile ticket is a static code with no server-side check for reuse. Passengers or fraudsters can share one purchase many times, and the operator has no way of spotting it.
An energy portal lets a logged-in session change bank details with no fresh password or second factor. A stolen session can redirect refunds or create fraudulent mandates.
Engineer apps call an API that returns the full job list, not just the engineer's own jobs. Customer names, addresses and vulnerability flags leak to every engineer account.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
PRA guidance on outsourcing and third-party risk asks insurers to assure the security of their suppliers. A CREST report gives their vendor teams independent, dated evidence about your application.
Ofgem oversees NIS compliance for parts of the GB energy sector, and energy firms pass security requirements on to suppliers. Pentest evidence helps you meet those contract terms.
Ticketing and fare payment platforms that handle cards must meet PCI DSS. Testing the purchase and stored-card flows supports the penetration testing requirement for in-scope web applications.
Yes. Each finding comes with a risk rating, evidence and specific remediation advice, which works as the basis of your action plan. The included retest then shows which items are closed. Many insurer vendor teams ask for exactly that pairing: the original findings and proof they were fixed.
The £2,400 covers the web application and its API, which is where ticket issuing, validation and payments are controlled. Testing the mobile app itself, such as local storage and certificate pinning, is scoped separately. Many teams start with the API because most serious ticketing issues sit there.
Not usually. NIS supply chain clauses typically ask for independent or CREST testing of supplier systems. CHECK is an NCSC scheme mainly for government and some critical infrastructure work. If your contract does name CHECK, you will need a CHECK company and we will say so plainly.
No. CyberFortify has no Perth office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
