For Cornwall's holiday let, space and clean energy software teams. Remote CREST testing, flat fee.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Truro is Cornwall's only city and its administrative centre, home to the county council, the main hospital and a cluster of professional firms. Cornwall's wider economy leans heavily on tourism and holiday lets, while newer sectors are growing: satellite and space activity at Goonhilly and Newquay, and renewable energy and critical minerals projects across the county.
Many Cornish software firms are small and a long way from London security suppliers, which makes remote testing practical. Booking platforms take payments and guest details, space data firms face demanding partners, and energy projects bring regulators and grid operators with firm security expectations. A fixed CREST price lets small teams plan the cost a season ahead.
Letting agencies, owners and attractions across Cornwall depend on booking platforms, owner portals and channel manager integrations. They hold guest identities, payment links and property access details, so a flaw can expose guests and empty properties.
What we focus onOwner and guest role separation, booking IDOR, key safe and door code exposure, channel manager API authentication, payment link tampering, and cancellation and refund logic.
Firms linked to Goonhilly, Spaceport Cornwall and the wider Cornish space cluster build ground station scheduling, satellite data and mission planning software. Agency and commercial partners expect strong security around tasking and data delivery.
What we focus onTasking and scheduling API authorisation, customer data isolation, large file delivery links, operator role controls, integration with partner ground networks, and secrets handling in deployment pipelines.
Geothermal, wind, solar and lithium projects in Cornwall use web platforms for asset monitoring, investor reporting and community engagement. Energy operators and grid partners expect suppliers to protect operational data and access.
What we focus onSeparation between monitoring dashboards and any control functions, operational data exposed through web APIs, investor data room access, contractor accounts, and authentication on telemetry feeds.
Cornish booking, space and energy platforms each have their own weak points, but most come down to who can see or change something they should not.
Arrival details, including key safe codes, returned for any booking reference rather than just the guest's own. An attacker can enumerate references and learn how to enter occupied or empty properties.
Integration credentials for booking channels stored in plain text or shared across every owner on a platform. One compromised account exposes each property's calendar and guest list.
Scheduling APIs that let any customer view, change or cancel another customer's satellite passes or orders. Beyond the data exposure, it disrupts capacity that someone has paid for.
Energy monitoring portals where hidden or legacy endpoints accept control commands. A read-only user, or an attacker with stolen credentials, could change setpoints meant to be reachable only from the operational network.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Online travel platforms and payment providers set security conditions for connected booking systems. An independent pentest report shows your integrations and payment flows have been tested.
Larger energy operators fall under the NIS Regulations, overseen in Great Britain by DESNZ and Ofgem. Suppliers to those operators are asked for testing evidence, and a CREST report provides it for web systems.
Space agencies and commercial operators review the security of ground segment and data partners. A CREST web test supports those reviews. Licensing obligations are separate, and we do not test spacecraft or radio links.
We use test properties and test bookings with dummy codes, never real ones. We then check whether another account, a cancelled booking or an unauthenticated request can retrieve those codes, and whether they stay visible after checkout. It is one of the first things we look at in holiday let software.
Usually, because partners ask early. Agency programmes and larger operators often want evidence that your data portal and APIs have been tested before they connect. Testing ahead of that conversation means you can share a clean retest report rather than a promise.
Yes. We test the web application and its APIs, ideally in a staging environment, and confirm in advance that no test will send commands to live assets. If the platform can reach operational technology, we report that path as a finding rather than exploiting it. Internal network and OT testing are scoped separately.
No. CyberFortify has no Truro office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
