For Stoke-on-Trent's online retail, gaming and manufacturing teams. No day rates, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Stoke-on-Trent built its name on ceramics, and many potteries still trade from the six towns. Today the local economy also includes large distribution sites near the M6, online retailers fulfilling orders nationwide, and one of the UK's biggest online gambling operators. That mix produces software that takes payments, manages stock and serves trade buyers at high volume.
Testing demand here comes from payment rules and from partners. Acquirers expect PCI DSS evidence, gambling suppliers face Gambling Commission security standards, and trade customers increasingly ask manufacturers how their ordering portals are protected. A fixed-price CREST test gives each of them the same clear answer.
Retailers fulfilling from Staffordshire warehouses run checkout, account and returns systems that handle cards and personal data every day. Card schemes and acquirers expect regular testing, and a breach during peak season is hard to recover from.
What we focus onBasket and checkout price tampering, discount and gift card abuse, account takeover through password reset, order history IDOR, payment page script integrity, and how the returns flow handles refunds.
Stoke is home to a major online gambling operator, and developers and data firms work around the sector. Gambling Commission technical standards push operators and their suppliers towards regular, independent security testing.
What we focus onWallet and balance manipulation, race conditions on bet placement and withdrawals, bonus abuse logic, account verification bypass, self-exclusion enforcement, and API authentication between platform and game providers.
Potteries and manufacturers sell to retailers and hospitality buyers through trade portals with account pricing and credit terms. These systems are often older, customised and rarely tested, yet they hold commercial terms competitors would value.
What we focus onCustomer-specific pricing leaks, order placement on another account, credit limit bypass, legacy authentication, file uploads for artwork and specifications, and admin panels exposed to the internet.
Stoke's high-volume transactional apps fail in predictable ways, usually where money or stock changes hands faster than the checks can keep up.
Sending the same withdrawal or refund request several times in parallel can process it more than once if the balance check and update are not atomic. On gaming and retail platforms this is direct financial loss.
Basket or trade order totals calculated in the browser and accepted by the server. Editing a request changes the price or discount, and the order goes through to fulfilment without anyone noticing.
Third-party scripts loading on the checkout without integrity checks or a tight content security policy. If one is compromised, card details are skimmed in the browser. PCI DSS v4.0 now addresses this directly.
Trade portal login and registration forms that confirm whether an account exists, combined with weak lockout. Attackers use this to target buyers' accounts and place orders against their credit terms.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
PCI DSS requires penetration testing at least annually and after significant changes. Our test covers the web application and API layer. Network and segmentation testing is scoped separately.
The Remote Gambling and Software Technical Standards include security requirements for operators and many suppliers. A CREST report supports the application security part of the annual assessment, but does not replace the audit itself.
Large retail and hospitality buyers increasingly ask manufacturers about the security of ordering systems. A recent independent report lets your sales team answer that questionnaire without delaying the account.
Usually, yes. A hosted payment page reduces your PCI DSS scope, but the pages that redirect to it can still be tampered with, and account, basket and order history functions sit entirely on your side. We test those flows and check that the hand-off to the payment provider cannot be manipulated.
We can, with care. Race condition and wallet tests are better run against a staging environment with test balances, because they deliberately try to break transaction logic. Read-only checks can run in production. We agree timings and request rates with you before starting, so major sporting events are not affected.
If it is internet-facing and holds customer pricing or accounts, yes. Replacement projects often slip, and older portals are where serious issues tend to hide. The report also gives you a practical list of security requirements to write into the specification for the new system.
No. CyberFortify has no Stoke-on-Trent office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
