For Salisbury and Porton's diagnostics, research and science supplier teams. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Salisbury's economy is shaped by science as much as by its cathedral and visitors. Porton Down, a few miles north-east of the city, hosts government defence and health security laboratories, and the nearby Porton Science Park supports life sciences and diagnostics companies. The army's presence on Salisbury Plain adds a wider defence community to an area with a busy tourism trade.
Software here often handles research data, clinical information or material connected to government work. Buyers range from pharmaceutical partners to defence customers with strict rules. We test commercial web applications and APIs to CREST standards. Where a contract requires a CHECK company, we say so plainly, because that work needs a CHECK provider.
Diagnostics and biotech firms near Porton build platforms for test ordering, results delivery and sample tracking. They hold health data and feed clinical decisions, so NHS and pharma partners expect evidence of independent testing.
What we focus onResult access controls between patients, clinicians and labs, sample ID enumeration, report generation, integration endpoints for lab instruments and hospital systems, and audit trails that must not be editable.
Research groups and spin-outs share data with universities, funders and overseas partners through web platforms and electronic lab notebooks. Unpublished results and intellectual property are valuable, and trusted research guidance asks organisations to protect them.
What we focus onProject and dataset permissions, external collaborator onboarding, data export and download controls, notebook version history, uploads of instrument output, and API tokens used by analysis scripts.
Smaller firms supplying defence research customers often run commercial portals for project management, reporting and data exchange. Primes and customers ask about security, and the portal is part of their supply chain risk.
What we focus onMulti-factor enforcement, role separation between supplier and customer users, document access and protective marking handling, session controls, and the logging that would reveal misuse by an insider.
Science and diagnostics platforms around Salisbury tend to protect the obvious screens well and leave the data underneath reachable by other routes.
Results portals that look up reports by sample or barcode number with no ownership check. Incrementing the number returns other patients' or customers' results, including personal and clinical details.
Lab and quality systems where audit entries can be altered or deleted through an API the interface never exposes. That undermines data integrity, which regulators and partners rely on.
Collaborators granted access to one dataset who can export others by changing an identifier in the request. Unpublished research leaves the organisation without any visible sign.
Multi-factor applied at the main login but not on password reset, API token creation or a legacy login path. Defence and research customers expect MFA everywhere, and attackers look for the gap.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Government and critical systems work that names CHECK must go to a CHECK company. CyberFortify is not one. For commercial platforms, partners and most supply chain questionnaires, a CREST test is the usual evidence.
Computerised systems in regulated labs must protect the integrity of records. A pentest that checks audit trails, access controls and data changes supports your validation work and inspection readiness.
The National Protective Security Authority's Trusted Research guidance asks research organisations to protect sensitive work and IP. Testing collaboration platforms shows you have checked how data can leave.
Not automatically. CHECK depends on the customer and the system, not your location. If the contract or the customer's security team names CHECK, you need a CHECK company, and we are not one. Many commercial platforms are tested to CREST standards. Ask your customer before booking.
We test the web application and the APIs it exposes, including integration endpoints that receive results or orders. We check that those interfaces authenticate senders and validate data. Instrument firmware, hospital networks and internal infrastructure are outside the £2,400 and would need separate scoping.
Yes, and we recommend it. A staging environment with synthetic datasets and test accounts for each role is ideal. We need realistic structure, not real results. If production testing is unavoidable, we agree in advance which datasets testers may open and keep access to the minimum needed.
No. CyberFortify has no Salisbury office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
