For Wells and Mendip's ticketing, care software and small SaaS teams. One flat price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Wells is one of England's smallest cities, a cathedral city at the foot of the Mendip Hills with a business base made up mostly of small firms. Tourism, events and hospitality matter, helped by the cathedral and the summer festival season across mid-Somerset. Care providers serve a dispersed rural population, and a growing number of founders run software businesses remotely from the area.
These teams rarely have a security function, and their software often grew faster than their processes. The push to test comes from ticketing partners, care commissioners, insurers and early enterprise customers. A flat CREST price means a three-person start-up pays the same per app as a larger firm, with no day-rate surprises.
Festivals, venues and attractions around Wells rely on ticketing, accreditation and cashless payment systems. Demand arrives in sudden spikes, and touts and fraudsters target the same moments, so sales logic needs testing before on-sale day.
What we focus onTicket allocation race conditions, purchase limit bypass, resale and transfer logic, QR or barcode predictability, accreditation and wristband portals, and admin tools used by box office staff.
Care providers across rural Somerset use rostering, care planning and family portals. These systems hold health and safeguarding information about vulnerable people, and providers must meet the data security expectations set for the care sector.
What we focus onCarer access limited to assigned clients, family portal scope, care note and medication record IDOR, rota and visit location data, offline mobile sync to the web API, and audit trails.
Founders working from Wells and the Mendips build niche SaaS for customers across the UK. Their first enterprise or public sector deal often brings a security questionnaire, and a current pentest is usually on it.
What we focus onAuthentication and password reset, multi-tenant separation, billing and plan enforcement, API key management, admin panels, and the third-party integrations a small team added quickly to ship.
Small teams around Wells tend to share the same blind spots, usually in features built in a hurry to meet a launch or a season.
Per-customer purchase limits checked only in the browser, so scripts buy hundreds of tickets through the API. Resale listings fill before genuine buyers reach the queue, and the organiser carries the reputational damage.
Barcodes or QR codes derived from order numbers or timestamps. Anyone who understands the pattern can generate valid entries, and the problem only shows up at the gate.
Care apps that filter client lists in the interface but return every record from the API. A carer, or anyone holding a carer's login, can read notes about people they never visit.
SaaS products where paid features are hidden in the interface but available through the API on a free plan. It is a revenue leak, and often a sign that other authorisation checks are missing too.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Care providers with NHS contracts or access to NHS systems complete the DSPT. If you supply their software, an independent pentest helps them answer supplier assurance questions and supports your own submission.
Insurers ask small firms about security testing when quoting or renewing cyber cover. A dated CREST report answers that question with evidence instead of a tick box.
Venues, promoters and payment partners often require ticketing suppliers to show their platform has been tested. A report with retest evidence lets you meet that clause before the next on-sale.
Several weeks before your biggest on-sale, so there is time to fix findings and complete the retest. Testing during a live sale risks disrupting genuine buyers. If you change queueing or allocation logic between seasons, that is the moment to test again.
Most want a short summary they can file with their own data security evidence: test date, scope and confirmation that serious issues were fixed. The executive summary and retest results cover that. Keep the technical detail for your developers rather than sending it to every provider.
If you are about to sign a business customer or handle sensitive data, usually yes. The price is flat, so it does not grow with your feature list, and the retest is included. Many founders time it just before their first enterprise questionnaire, so they can answer it with evidence.
No. CyberFortify has no Wells office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
