For Swansea's health tech, life sciences and vehicle data teams. Flat price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Swansea's knowledge economy has grown out of its two universities. Swansea University's medical school and life science research support health technology and data companies, and the Bay Campus links engineering and energy research to industry. The DVLA headquarters in Morriston also makes the city a centre for driver and vehicle data, with suppliers and users of its services nearby.
Health tech teams here sell into NHS Wales and often NHS England, and both want security evidence. Products that hold medical, genetic or vehicle data face hard questions from data protection officers. An independent CREST pentest gives those reviewers something specific to assess instead of a vendor's own assurances.
Digital health products used by Welsh health boards go through supplier assurance and data protection review. Clinicians and digital teams expect proof that patient records cannot be reached by the wrong user.
What we focus onPatient record IDOR, clinician and patient role separation, consultation notes and attachments, appointment and referral APIs, integration accounts with health board systems, and session timeouts on shared devices.
Firms working with trial, laboratory or genetic data share it with sponsors and partners. That data is special category under UK GDPR, so sponsors and ethics reviewers ask how it is secured.
What we focus onSeparation between studies and sponsors, consent records, dataset downloads and query tools, pseudonymisation that can be reversed through the API, and audit trails for every access.
Fleet, motor trade and insurance tools use vehicle and driver information. Driver licence data is sensitive and attractive to fraudsters, so customers and data providers ask how the app controls access.
What we focus onDriver and vehicle record lookups without proper authorisation, bulk search abuse, API key protection for upstream data services, fleet manager roles, and consent checks before driver data is retrieved.
Swansea teams handle health, research and driver data, all of it sensitive. These are the issues we most expect to find in their apps.
Uploaded letters or images served from a predictable path with no session check. Anyone with a link, or who can guess one, can read clinical documents.
Pseudonymised research data that the API joins back to identifiers in some responses. The front end hides it, but the raw JSON exposes who each participant is.
Search features with no rate limit or business-purpose check. An insider or stolen account can quietly harvest licence and vehicle records at scale for identity or insurance fraud.
Registration or profile updates that accept a role field from the request. A patient account can become a clinician account and see a whole caseload.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Welsh health boards and Digital Health and Care Wales review supplier security before connecting systems. A CREST report with retest results is the testing evidence those reviews ask for.
Health, genetic and research data need a data protection impact assessment. Pentest results give the DPIA real evidence on technical risks and how they were reduced.
If your software qualifies as a medical device, cyber security forms part of your technical documentation. An independent pentest supports that file, though it does not replace your regulatory work.
Yes. The report describes the application tested, the method, findings and retest results. Welsh supplier assurance and English requirements such as DTAC and the DSPT both look for that kind of independent evidence. Each buyer may ask extra policy questions, but the testing evidence is the same.
That is our strong preference. A staging environment with synthetic records lets us test every route fully. If production testing is unavoidable, we agree limits first, avoid reading real records beyond what proves a flaw, and handle anything we see under our ISO 27001 certified processes.
No. We test your application and API, including how it stores and protects credentials for upstream services and controls who can trigger lookups. Testing a government service needs its owner's permission, which we would not have. We report any way your app could be abused to over-query it.
No. CyberFortify has no Swansea office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
