For Winchester software suppliers to councils, law firms and financial advisers. Fixed price, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Winchester is Hampshire's county town and the seat of Hampshire County Council, which shapes much of its economy. Around the council sit legal practices, accountants, financial planners and the consultancies and software firms that serve the public sector. The city is also home to the University of Winchester. Software here is often built for case work, client records and regulated advice rather than consumer markets.
Councils assess suppliers formally, often starting with Cyber Essentials and moving on to application testing for systems that hold resident data. Law firms and advisers face pressure from insurers and regulators to protect client money and confidential files. In both cases, a current independent pentest is now a standard request rather than an exception.
Case management, licensing, social care and housing platforms hold sensitive resident data. Councils buy through frameworks and their own assessments, and expect suppliers to show testing beyond a Cyber Essentials certificate.
What we focus onCaseworker versus manager roles, access to safeguarding and social care records, citizen-facing forms and uploads, payment of fees, and integrations with other council systems through shared APIs.
Client portals, conveyancing tools and document exchange platforms are targeted by fraudsters who want to redirect completion funds. Insurers and clients now ask firms and their software providers what testing has been done.
What we focus onChanges to bank details and payment instructions, document access between matters, client portal authentication, notification emails that can be spoofed or triggered, and fee-earner permissions.
Advisers and the platforms they use hold pensions, investment and identity data. Client-facing portals are a natural target, and the firms using them are FCA regulated and expected to manage cyber risk.
What we focus onClient and adviser separation, document vaults containing identity and pension statements, fact-find forms, account recovery, and whether one adviser's clients are visible to another firm on a shared platform.
In the resident, client and matter-based systems that Winchester suppliers build, these findings come up repeatedly.
A client or compromised account can change payout details through the portal with no second check or alert. This is the core of conveyancing and payment diversion fraud.
Sensitive case notes are protected in the interface but returned by an API to any caseworker. Councils treat exposure of safeguarding data as a serious incident.
Documents uploaded to a client portal are served from guessable or permanent links. Confidential legal or financial files can then be reached without logging in.
Recovery flows rely on information that is easy to find, such as date of birth and postcode. For elderly or vulnerable clients this makes account takeover far too simple.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Councils often ask for Cyber Essentials Plus first. It checks basic controls on your devices and network, not your application. A pentest covers the platform residents actually use, and buyers increasingly ask for both.
Suppliers listing on government frameworks are asked about security testing. A CREST report gives you a clear answer. Where a buyer specifies CHECK, we will tell you, as we are not a CHECK company.
As a processor for councils or law firms, you must apply appropriate security under Article 28 contracts. A dated pentest with retest results is practical evidence your controllers can rely on.
Usually, yes, if every council uses the same version of the same application. We test it once and issue a report plus an attestation letter you can share with each buyer. If some councils run customised modules or separate hosting, tell us at scoping, since those differences may need to be covered too.
Payment diversion first. We look at every way bank details or completion instructions can be changed, who can change them, and whether clients and fee earners are alerted. We also test matter separation and document access, since one leaked file can reveal the timing of a completion.
Yes, normally against a staging environment with synthetic data, which is what most councils prefer. We will confirm any conditions the council sets, such as data handling or tester location, before booking. If the council requires a CHECK company for that system, we will say so.
No. CyberFortify has no Winchester office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
