For St Davids' booking, holiday let and outdoor activity businesses. One fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
St Davids is the UK's smallest city by population, set inside the Pembrokeshire Coast National Park. Its economy is built on visitors: holiday cottages, campsites, boat trips, outdoor activity providers, galleries and food producers. Much of that trade now happens online through booking systems, gift voucher shops and small e-commerce stores, many built by local web developers or agencies.
Small firms rarely think about pentests until something forces the question. A card provider asks about a breach, a cyber insurance renewal asks about testing, or a booking platform is sold or licensed to other operators. A flat £2,400 lets a small team or its developer get one CREST test without an open-ended quote.
Cottage agencies and owners run booking sites that store guest names, addresses, travel dates and sometimes key codes. Guests and insurers expect that data to be protected, and owners want to know their calendars cannot be manipulated.
What we focus onBooking confirmation links, guest account IDOR, access codes or arrival instructions in emails and pages, owner portals, availability and price calculation, and the content management login.
Wildlife boat trips and outdoor activity providers sell timed slots online with waivers and medical questions. A broken booking flow costs a whole season's trust, and medical answers are sensitive data.
What we focus onSlot booking and capacity checks, price and discount tampering, storage of waivers and health questionnaires, staff and instructor logins, and integrations with third-party booking widgets.
Galleries and food producers sell online to visitors once they get home. Small shops depend on plugins, themes and payment integrations that are easy to misconfigure and rarely reviewed by anyone.
What we focus onGift voucher generation and redemption, basket and delivery price manipulation, admin and plugin exposure, customer account takeover, and how the site hands off to the payment provider.
Small visitor businesses around St Davids face opportunistic attacks rather than targeted ones. These are the flaws those attackers find first.
Short or sequential voucher codes with no limit on attempts. An attacker can find valid unredeemed vouchers and spend them before the real customer arrives.
Confirmation pages reached by booking number alone. Changing the number shows other guests' names, dates and arrival details, including when a property will be empty.
Old content management plugins with published vulnerabilities, and an admin login with no MFA. These are the first things automated attack tools look for, and they find them within hours.
Prices or discounts sent from the browser and accepted by the server. A visitor can book a trip or buy goods for far less than the listed price.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Even small merchants must protect payment pages, especially where scripts load on the checkout. A pentest finds weaknesses that could let attackers tamper with or skim payment details.
Insurers increasingly ask small businesses about security testing at renewal. A CREST report gives you a straight yes and evidence that any issues were fixed.
Guest addresses, travel dates and health answers are personal data you must protect. Testing your booking system supports your security duty if the ICO ever asks.
Not if you take bookings or payments online. The price is fixed at £2,400 whatever the size of the site, so you know the cost up front. If your site is a brochure with a third-party booking widget and no logins, you may not need one. Ask us and we will say so.
We can test your own website and how it connects to the platform. Testing the platform provider's systems needs their permission, which most will not give. Ask them for their own pentest evidence. If you built or customised the booking system yourself, we can test it fully.
It helps. We need test accounts, the URL and a contact who can answer questions and fix findings. The report is written so a developer can act on it directly, and the retest checks their fixes. Many small businesses ask their developer to book and manage the test.
No. CyberFortify has no St Davids office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
