For Plymouth's marine tech, naval suppliers and port software teams. CHECK caveats stated plainly.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Plymouth's economy is tied to the sea. Devonport is home to a major Royal Navy base and dockyard, the city has a long-established marine science community and a university known for marine and maritime research, and ferries link the port to France and Spain. A growing digital sector builds software for ocean data, vessel operations and the naval supply chain.
That brings two kinds of security pressure. Defence customers push requirements down the supply chain, and maritime operators face rising attention to cyber risk on ships and in ports. We test commercial web applications and APIs to CREST standards, and we are clear when a contract needs a CHECK company instead.
Plymouth firms build platforms that control uncrewed vessels, manage sensors and deliver ocean data to researchers and offshore operators. A compromised web console could mean lost data, or a vessel taking commands from the wrong user.
What we focus onCommand and mission APIs, operator role separation, telemetry ingestion authentication, data sharing with research partners, map and geofence editing controls, and session security on control dashboards.
Engineering and services firms around Devonport supply maintenance, logistics and training. Their portals exchange schedules, technical documents and personnel details, and primes expect suppliers to show their systems are secure.
What we focus onDocument and drawing access, separation of contractor and customer users, personnel data protection, MFA enforcement, file upload handling, and audit logging of who viewed what.
Booking, freight and port community systems move passengers, vehicles and cargo through Plymouth. They connect to customs, hauliers and shipping lines, and an outage or data leak affects operations well beyond the app itself.
What we focus onBooking and manifest IDOR, freight declaration data access, haulier and agent account roles, integration API authentication, sailing availability logic, and the handling of passenger personal data.
Plymouth's maritime and defence software often connects the web to physical operations, and the findings that matter most sit at that join.
Sensor or vessel data endpoints that accept posts from anyone who knows the URL. Attackers can inject false positions or readings, misleading operators and corrupting datasets other organisations rely on.
Mission or control APIs that verify a login but not whether the user may command that asset. A viewer account intended for a research partner can send instructions.
Booking references or manifest IDs that return full records to any authenticated agent. Passenger names, travel document details and vehicle registrations leak across agencies sharing the platform.
Supplier portals where contractor accounts stay active after a project ends, often without MFA. In defence supply chains, stale accounts are a common route in and a contract compliance problem.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Port and harbour operators above the thresholds are operators of essential services under the NIS Regulations. Suppliers' web systems feed into that risk picture, and an independent pentest supports the evidence they need.
Defence customers may ask for CREST testing, Cyber Essentials Plus or CHECK. A CREST web test meets many supplier requests. Where CHECK is named, you need a CHECK company. CyberFortify is not one.
Defence suppliers often hold Cyber Essentials Plus. It checks baseline controls, not your application logic. A web application pentest covers the gaps that certification does not look at.
Yes, with planning. We test command and control functions against a simulator or test asset, never a vessel at sea. Read-only and access control checks can run against production if you prefer. We agree which actions are off limits before testing starts.
Yes. We agree test windows away from peak departures, use test bookings that can be cancelled, and avoid load testing in production. Availability and payment logic is best tested in staging. If anything unexpected affects live bookings, we stop and contact you straight away.
Not for the test itself. We use test accounts that mirror partner roles to check what each can reach. If partners host their own systems that connect to yours, we only test your side of the connection unless they give written permission.
No. CyberFortify has no Plymouth office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
