For St Asaph's photonics, precision engineering and health service suppliers. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
St Asaph is one of the UK's smallest cities, but its business park has an unusual technology profile. The OpTIC centre helped establish an opto-electronics and photonics cluster, and precision engineering firms work nearby on optics, coatings and instruments. The business park also hosts health service and public sector offices that serve North Wales, which brings supplier software into the area.
Photonics and optics firms often sell to aerospace, defence and scientific customers who check how suppliers protect technical data. Health service suppliers face their own assurance. In both cases a CREST pentest is evidence an outside tester has attacked the web systems and confirmed fixes.
Firms around the park design and make optical components, coatings and systems for demanding customers. Those customers share detailed specifications and expect suppliers to keep designs, quotes and test results confidential.
What we focus onCustomer portals for specifications and certificates of conformity, test data integrity, quote and order systems, file sharing with customers and partners, and access for visiting researchers.
Optics and instrument makers may supply defence and aerospace primes, who pass security requirements down the chain. Suppliers need evidence for those reviews and should know where CHECK or defence standards apply.
What we focus onControlled document access, export classification of technical data, multi-factor authentication for remote users, supplier collaboration portals, and audit logging that a prime contractor can review.
Suppliers to North Wales health services build scheduling, workforce and patient-facing apps. Health service buyers check security and data protection before anything connects to their systems or holds patient data.
What we focus onStaff roster and workforce data access, patient appointment and messaging features, single sign-on for health staff, data exports for reporting, and separation between teams and sites.
St Asaph firms protect technical designs and health data. These are the issues we most commonly raise in apps that hold them.
Certificates of conformity or test results stored as editable records with weak role checks. Tampered quality evidence can reach a customer and undermine trust in every shipment.
Portals that store controlled and uncontrolled drawings together with the same access rules. Users or partners can reach files they should not, creating export control risk.
Remote access portals and collaboration tools protected by passwords alone. Defence primes usually expect MFA for remote access, and password reuse makes this an easy route in.
Workforce or scheduling apps that let a manager at one site see staff details at every site by changing a filter in the API request.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Defence suppliers are assessed against Def Stan 05-138 and often register through JOSCAR. A CREST pentest supports your responses, but if a contract requires CHECK, you need a CHECK company.
Optics and engineering firms pursuing ISO 27001 need evidence of technical vulnerability testing. An annual application pentest with retest results meets that need for auditors.
Suppliers to health services must show patient and staff data is protected. A pentest report supports information governance review and the DPIA a health service buyer will request.
We can test your web applications and APIs and give you a CREST report for their supplier review. That supports Def Stan 05-138 and JOSCAR questionnaires. CyberFortify is not a CHECK company, so if the prime or contract requires CHECK testing for a particular system, you will need a CHECK provider for that part.
Tell us before booking. We prefer to test a staging environment with dummy drawings, so no controlled data is accessed. If testing must touch production, we agree what is off limits and stop as soon as we prove access, without downloading the files. Any restrictions on who can test can be confirmed at scoping.
Usually a recent independent test of the app and its API, findings by severity, and evidence that serious issues were fixed. Our report and retest provide that. Information governance teams may also ask about hosting, data location and policies, which you answer separately.
No. CyberFortify has no St Asaph office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
