CREST Accredited by CREST G2 Rated 4.8/5 on G2

CREST Penetration Testing in St Albans
£2,400 Flat per App

For St Albans accountancy, HR and property software teams selling into London. Retest included.

Get your £2,400 quote Book a scoping call
CREST accredited: Penetration Testing CREST accredited: Vulnerability Assessment CREST accredited: App Security Testing CREST accredited: Mobile App Security Testing

Get your £2,400 pentest quote

Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.

  • £2,400 flat per app and its API, any size
  • Retest included
  • CREST accredited, rated 4.8/5 on G2

Prefer to talk? Book a 30-min scoping call

Penetration Testing for St Albans Teams

East of England

St Albans is a Hertfordshire cathedral city a short train ride from London, and much of its business life faces the capital. Accountancy, payroll, legal and HR firms have offices here, alongside small software companies founded by people who once worked in them. Products tend to be practical B2B tools: practice management, payroll, recruitment, lettings and client portals for professional firms.

These teams are often small but sell to London clients with large compliance functions. A single enterprise or mid-market deal can depend on a security review. Cyber insurers ask detailed questions at renewal. Professional firms using the software have their own clients' confidential data to protect, and they pass that pressure straight on to their suppliers.

What St Albans Teams Bring Us to Test

Accountancy and payroll software

Practice management, bookkeeping and payroll tools hold salaries, bank details, tax references and company accounts. Accountancy firms and their clients expect suppliers to show independent testing, and payroll data is a common fraud target.

What we focus onPractice versus client roles, payroll run approval, changes to employee bank details, tax reference exposure, document requests between firm and client, and integrations with banks and HMRC-connected services.

HR and recruitment platforms

Applicant tracking and HR systems store CVs, right-to-work documents, references and disciplinary records. Employers that buy them, many of them London based, run security reviews before migrating their people data.

What we focus onCandidate and employee record access, hiring manager permissions, document uploads and storage, public job board APIs, recruiter agency access, and bulk export of personal data.

Property and lettings technology

Lettings, block management and estate agency platforms handle tenant referencing, deposits and rent payments. Landlords, agents and tenants all use the same system, which makes access control the main risk.

What we focus onLandlord, agent and tenant role boundaries, referencing documents, rent and deposit payment flows, maintenance request portals, and whether one agency branch can see another branch's properties and tenants.

What We Often Find

For the professional-services and property software built around St Albans, these four findings appear in report after report.

Payroll bank details changed silently

An employee or compromised account can update salary bank details just before a payroll run with no approval or notification. It is a direct route to payroll diversion fraud.

Client portal seeing other clients

In practice management tools, a client user can change a company identifier and view another client's accounts, tax documents or private messages from the firm.

Right-to-work documents in public storage

Passport and visa scans uploaded during hiring are stored in a location reachable without authentication. These are among the most sensitive files an HR platform holds.

Tenant access to landlord data

A tenant account can query endpoints that return landlord contact details, other tenants in the block, or deposit information. Shared multi-party platforms often get these boundaries wrong.

Trusted by SaaS Teams Worldwide

£2,400. Not £12,000–£25,000.

What UK pricing guides put a SaaS app with an API and several user roles at.

Typical UK quote
CyberFortify
How it’s priced
Typical UK firm: day rates (median ~£1,000/day)
£2,400 flat per application
SaaS app, API, several roles
£12,000–£25,000
£2,400
Retest of your fixes
Often extra, £2,000–£5,000
Included
App bigger than expected
More days, bigger invoice
Same £2,400, no size cap
Who tests
Varies by firm
CREST-accredited engineers

Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).

Got a UK Quote? See Your Saving

Example figures are filled in. Change them to match your quote.

days
£
£
£
Your saving
Your UK quote£9,500
CyberFortify, retest included£2,400
£7,10075% less than your quote
Book my £2,400 pentest

One Price, Everything In It

Per application · any size

£2,400flat

  • One web app and its API, no endpoint cap
  • Testing starts within a week, report in 4–7 working days
  • Free retest, signed attestation letter
Book a scoping call

Included in the £2,400

  • AI-enabled testing, with every finding validated and exploited by CREST-accredited engineers
  • Authentication, access control between user roles and business logic
  • Criticals flagged within 24 hours, not held for the final report
  • CVSS-scored findings with reproduction steps and the fix
  • Clean report and signed attestation letter for customers, auditors and insurers
  • ISO 27001 and ISO 9001 certified processes, professional liability cover and Koop cyber insurance

One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.

From First Call to Clean Health Report

9 gates, the same sequence on every engagement.

  1. 01

    Discovery

    Client insight

    We send a short questionnaire to understand your infrastructure, business requirements and security concerns.

    Owner: you + CyberFortifyOutput: completed questionnaire
  2. 02

    Agreement

    Scope & SOW

    We analyse your answers, define a clear scope and issue the Statement of Work.

    Duration: 2–3 business daysOutput: signed SOW
  3. 03

    Initiation

    Kickoff meeting

    We walk through methodology, timeline and requirements, and access is handed over securely.

    Format: live sessionOutput: methodology brief
  4. 04

    Active testing

    Testing execution

    AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.

    Duration: 4–7 working daysLive alerts: high & critical
  5. 05

    Reporting

    Report delivery

    Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.

    Format: PDF + machine-readableAudit-ready
  6. 06

    Walkthrough

    Report review

    A session with your technical team to explain findings, priorities and remediation approaches.

    Duration: 60–90 minutesRecorded on request
  7. 07

    Remediation

    You fix

    Your teams implement fixes. We stay available for guidance throughout.

    Timeline: you set itSupport: on call
  8. 08

    Verification

    Retest

    We re-test every previously identified issue to confirm the fix and check nothing new was introduced.

    Cost: includedScope: every finding
  9. 09

    Attestation

    Clean health report

    A final report confirming remediation and your improved security posture, ready to share with auditors.

    Audit-readyShareable with customers

What St Albans Buyers Ask For

Cyber insurance renewals

Insurers increasingly ask whether customer-facing applications have been independently tested. A recent CREST report gives you a straight answer and can help with terms at renewal.

ISO 27001

ISO 27001 includes controls on technical vulnerability management and security testing. A dated pentest with retest results is clean evidence for your Stage 2 or surveillance audit.

London client onboarding

Mid-market and enterprise clients send supplier questionnaires before migrating payroll or HR data. A CREST report answers the testing questions and shows how you handled the findings.

Before you book.

We are a five-person software company. Is a pentest realistic for us?

Yes. The fixed £2,400 price is designed for teams without a security budget line. You get one tested web app and API, a report you can share with clients, and a retest once you have fixed the issues. Many small teams book their first test when a larger client's questionnaire arrives.

Our payroll product connects to banks and HMRC. Will you test those connections?

We test how your application sends, stores and protects that data, and whether users can tamper with it. We do not test bank or HMRC systems. We use sandbox or test connections where possible, so no real payments or submissions are made during testing.

Our cyber insurer asked whether we test our apps. What should we send them?

Usually a short attestation letter, not the full report. It confirms the application tested, the dates, the testing standard and whether high-risk issues were fixed. Insurers rarely need technical detail, and keeping the full report private limits who sees your vulnerabilities.

Do you have an office in St Albans?

No. CyberFortify has no St Albans office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.

Why is it cheaper than UK day-rate firms?

Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.

Is CyberFortify really CREST accredited?

Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.

What counts as one application?

One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.

Is the price really fixed?

Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.

Are you a CHECK company?

No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.

How fast can you start?

Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.

What happens to our data?

CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.

Already have your scope written up? Send full scope details

Also Testing Near St Albans

All UK locations · UK CREST penetration testing

A CREST pentest in St Albans for £2,400.
Booked this week.

Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.

Get your £2,400 quote Book a scoping call

Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.