For Wakefield's warehouse operators, policing suppliers and housing software teams. Fixed price.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Wakefield sits close to where the M1 and M62 meet, and that location has drawn large warehouses and distribution centres to the district. The city is also a long-standing public-sector base, including the headquarters of West Yorkshire Police. Social housing is a major local landlord and employer. Software built or used here moves stock, manages tenancies and supports public services that handle sensitive data.
Buyers here use formal procurement. Retail clients of logistics firms ask their warehouse partners for testing evidence. Police and public bodies apply strict supplier security checks. Housing providers face a regulator and tenants who expect their data to be safe. An independent CREST test, with a retest, gives each of them the document they need.
Third-party logistics firms around the motorway junctions run warehouse management, client portals and returns systems for retailers. Clients connect directly to these systems and want proof they cannot be used to reach other clients' data.
What we focus onClient-to-client separation in warehouse portals, stock and order data exposure, returns and refund workflows, carrier label generation APIs, and integration keys shared with retail clients.
Companies selling software to police forces and emergency services handle case, evidence and staff data. Forces run thorough supplier security assessments before award, and any web-facing service that touches the public or partners gets close attention.
What we focus onPublic reporting and contact forms, evidence upload and sharing portals, role separation between officers, staff and partners, audit logs, and sessions on shared devices. CHECK-scoped systems need a CHECK company.
Tenant portals, repairs booking and rent payment apps hold tenant identities, vulnerability flags and payment details. Housing providers answer to their regulator on tenant services and want suppliers to show their apps are secure.
What we focus onTenant account separation, repair job and contractor access, exposure of vulnerability and safeguarding notes, rent payment flows, and how far contractors can see tenant addresses and contact details.
Testing Wakefield's warehouse, policing and housing systems, our engineers keep coming back to these four weaknesses.
Warehouse portals that rely on the interface to hide other clients' data let one retailer query another's stock, orders or customer addresses through the API. Clients rarely forgive this.
Evidence or document sharing links that work without login, or stay valid longer than needed, leave sensitive material exposed. We check every sharing route and when it expires.
Tenant and repairs apps sometimes return internal vulnerability or safeguarding notes to contractors or tenants. The notes are hidden on screen but visible in the API.
Returns workflows that trust status changes sent from the client can trigger refunds for items never received back. In high-volume fulfilment this can go unnoticed for weeks.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Forces and public bodies ask for independent testing of web-facing services before contract award and at renewal. Our CREST report is a clear, dated answer. Where a contract specifies CHECK, you need a CHECK company.
Landlords must show their regulator and tenants that tenant information is handled properly. Supplier pentest evidence supports their assurance that portals and repairs apps protect personal data.
Retail clients increasingly expect 3PL partners to hold ISO 27001 or work towards it. A pentest of your client portal supports the vulnerability management controls auditors check.
Yes, if the API is part of the web application we are testing. We check how client keys are issued, what each key can reach, and whether one client can read or change another client's orders, stock or returns. Integration flaws are often more serious than anything visible in the user interface.
It depends on the system and the contract. Many force procurements ask for an independent CREST pentest of the supplier's web application, which we provide. If the system connects to police networks or the contract names CHECK, you need a CHECK company, and we are not one. Send us the requirement and we will give you a straight answer.
Yes, if it is a web app or progressive web app. We test contractor access to job details, tenant addresses and notes, and check that jobs close properly and access ends when it should. Native mobile apps are scoped separately from the £2,400 web application test, and we will quote for them if needed.
No. CyberFortify has no Wakefield office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
