For Thames Valley enterprise software, IT services and telecoms teams. £2,400 per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Reading anchors the Thames Valley, a corridor along the M4 where many global technology companies have their UK headquarters. Alongside them sit enterprise software vendors, IT resellers, managed service providers and telecoms businesses. The work here is largely business to business: platforms that other organisations run their IT, networks or operations on, often with privileged access to customer systems.
That privileged access is exactly why buyers ask hard questions. Enterprise customers expect SOC 2 or ISO 27001 evidence and an independent pentest of the product. MSPs are being asked how their own portals are secured, since a compromise there reaches every client. US parent companies often require a third-party test before a product can be sold in the UK.
Thames Valley vendors sell HR, finance, analytics and workflow platforms to large organisations. Those customers run formal vendor risk assessments, and a missing pentest report can stall a deal for months.
What we focus onTenant isolation, SAML and OIDC configuration, SCIM provisioning, delegated admin, integration tokens with excessive scope, reporting and export features, and API endpoints shared by the web and integration layers.
MSPs and the vendors behind remote monitoring, ticketing and backup portals hold keys to many customer environments. Attacks on this kind of tooling have caused large supply chain incidents, so clients now ask directly.
What we focus onTechnician versus client user roles, access to other clients' tickets and assets, stored credentials and secrets, script or command execution features, and session handling on high-privilege consoles.
Telecoms operators and their suppliers in the area build provisioning portals, self-service dashboards and partner APIs. These sit close to core infrastructure and are tested by both customers and carriers.
What we focus onNumber and circuit provisioning APIs, reseller hierarchies, billing exports, partner API authentication, and whether customer self-service features can quietly change services belonging to someone else.
Thames Valley platforms often hold privileged access to customer estates, so these findings carry more weight here than usual.
An MSP portal checks that a user is a technician but not which clients they serve. One technician account, or one phished password, then opens tickets, credentials and devices for every customer.
SAML responses are not fully validated, or an email claim from an untrusted identity provider is accepted. An attacker can sign in as a user in another customer's tenant without a password.
API keys created for a single integration grant full administrative access and never expire. When one leaks from a script or log, it gives a complete foothold in that customer's account.
In telecoms and licensing portals, a sub-reseller can change identifiers to view or modify services owned by a sibling reseller. The commercial and service impact can be significant.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Many Reading vendors report to US customers or parents. SOC 2 auditors look for evidence of regular independent testing, and our report with retest results fits neatly into that evidence set.
Cloud computing services above the size thresholds are relevant digital service providers under the UK NIS Regulations. Application testing helps show appropriate security measures to the ICO, which regulates that group.
Large customers send assessments built on ISO 27001, NIST or their own frameworks. A current CREST report answers the testing questions and shows how quickly you fixed what was found.
Yes, and that is often the right place to start. We test the portal and its API, focusing on whether one client or technician can reach another client's data or tools. Testing your customers' internal networks is separate work, scoped individually and not part of the £2,400 application price.
Most global standards ask for an independent test by a recognised provider, a clear scope, risk-rated findings and evidence of remediation. Our CREST report covers all of these. If your parent has a specific template or required fields, send it over before testing and we will confirm what we can map to it.
We test your side of the integration using test identity providers we control, covering SAML and OIDC validation, account linking and just-in-time provisioning. That shows whether a hostile or misconfigured identity provider could reach other tenants. We do not test your customers' own identity platforms.
No. CyberFortify has no Reading office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
