For Sunderland's automotive supply chain, EV and customer service software. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Sunderland's economy is anchored by car making. Vehicle assembly, a growing battery and electric vehicle supply chain, and the parts suppliers around them depend on supplier portals, scheduling systems and EDI links. The city also has a large customer service and contact centre workforce, plus software firms that grew out of local digital programmes.
Car makers expect their supply chain to meet automotive security standards, and they audit for it. Contact centres that take payments face card scheme rules. In both cases a supplier needs to show that the web software it builds or runs has been tested by someone independent, and that the problems were fixed.
Tier one and tier two suppliers exchange schedules, advance shipping notices and quality data with vehicle makers through web portals and APIs. Car makers treat any weak link in that chain as a risk to production.
What we focus onSupplier-to-supplier separation, EDI and ASN endpoints, shared or generic logins, quality and warranty document access, exposure of pricing data, and integration accounts that never expire or rotate.
The battery and EV supply chain around Sunderland is newer and brings new software: traceability, test data and production analytics. Those records carry commercial value and safety relevance, so buyers ask how they are secured.
What we focus onIntegrity of traceability and test records, who can edit or delete batch data, API authentication for production systems feeding the web layer, and access for visiting engineers and contractors.
Sunderland hosts contact centre operations for national brands. Agent desktops, CRM integrations and payment capture tools are tested because clients and card schemes want proof that customer data and card numbers stay protected.
What we focus onAgent role limits, customer record searches with no business reason, payment pages and pause-and-resume card capture, session handling on shared desks, and call recording or transcript access.
Supply chain portals and contact centre tools in Sunderland face very specific pressures. These are the weaknesses we most expect to find in them.
One login used by a whole team at a parts supplier, with no MFA. Nobody can tell who changed a delivery schedule, and a leaked password exposes every order and drawing on the account.
Shipping notice or EDI web endpoints that accept data from any caller. Forged or replayed notices can disrupt goods receiving, line-side stock records and production planning at the plant.
Customer screens or logs that show or store complete card numbers taken over the phone. This widens PCI DSS scope and makes one compromised agent account very valuable.
Traceability or test results that any engineer role can edit without an audit trail. Tampered battery or part data undermines recalls, warranty claims and quality investigations long after the fact.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
TISAX assessments look at how suppliers protect information, including technical testing. A CREST pentest of your customer-facing portal is strong supporting evidence for those controls.
Contact centres taking card payments must test the systems in their cardholder data environment. Our application test covers the web payment and agent tools in scope for that requirement.
Some buyers already require Cyber Essentials Plus. That checks basic controls on devices and networks. It is not a pentest of your application, and automotive clients increasingly ask for both.
No. TISAX labels come from an accredited audit provider assessing your whole organisation. Our report is evidence you can show that auditor for the technical testing of your web application and API. It also answers the security questions car makers send outside the TISAX process.
If each brand runs on the same codebase and API with different configuration, it is normally one application, and we test the separation between clients carefully. If each client portal is a different build, each is priced as a separate app. We confirm this before you commit.
Not within the £2,400. We test web applications and APIs, including the agent screens and payment pages that support your calls. Telephony platforms, IVRs and internal networks are separate work. We will point out where the web app connects to them and what we could reach.
No. CyberFortify has no Sunderland office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
