For Wolverhampton's housing, public service and manufacturing software suppliers. No day rates.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Wolverhampton is a Black Country city with deep manufacturing roots and a large public sector. Aerospace component makers have long operated here, and the i54 business park on the city's northern edge hosts major automotive and advanced manufacturing sites. The council, the University of Wolverhampton and a large NHS trust are among the biggest employers, and social housing is a major part of the local landscape.
That mix creates two kinds of software buyer. Public bodies and housing providers buy through formal procurement with security requirements written in. Manufacturers flow security clauses down their supply chains. Both expect a supplier to show recent, independent testing of the application they are about to rely on.
Housing providers use online portals for repairs, rent accounts, tenancy changes and complaints. Tenants' data includes vulnerabilities, benefits and household details, so landlords expect their software suppliers to test and protect it properly.
What we focus onTenant account security, repair and case record access, rent and payment information, contractor portal permissions, and whether one tenant can view another household's details or complaints.
Software sold to councils, colleges and public bodies often goes through government frameworks and local procurement. Buyers ask for independent testing evidence and expect suppliers to keep it current as the service changes.
What we focus onCitizen and staff role separation, case management permissions, evidence uploads, single sign-on with public sector identity providers, and features exposing personal data in reports or exports.
Component makers and engineering firms exchange orders, specifications and quality data with major customers through web portals. Those customers set supplier security requirements and check them during audits and contract renewals.
What we focus onPurchase order integrity, specification and drawing access, supplier-to-customer data separation, quality and inspection records, and any external route into production, planning or stock systems behind the portal.
Wolverhampton's housing, public service and supplier portals tend to share long lifespans, many user types and the access control problems that follow.
Tenant portals that fetch repairs or complaints by reference number without checking the tenancy expose other households' addresses, vulnerabilities and contact details to any logged-in tenant.
Recovery based on details such as date of birth and postcode is easy to guess for a known person. It lets an attacker take over a tenant or citizen account and change contact details.
Supplier portals sometimes allow quantities, prices or delivery terms to be changed after the customer approves an order, with no fresh approval and no clear record of the change.
Public service systems often run for many years. Outdated frameworks and libraries with published vulnerabilities are a common finding, and some can be exploited with freely available tools.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Suppliers on government frameworks are asked about security testing. A CREST report gives evidence for service descriptions and for council buyers reviewing your security answers.
Housing providers hold sensitive household and vulnerability information. Testing their portals supports Article 32 obligations and helps landlords answer questions from tenants, auditors and the ICO.
Manufacturing customers increasingly expect ISO 27001-aligned controls from their suppliers. A pentest provides the technical vulnerability evidence that auditors and customer assessments look for.
Yes, if it is part of your application and you are authorised to test it. Contractor portals are a common weak point, because they give external firms access to tenant addresses and job details. We test them with contractor-level accounts alongside the tenant and staff roles.
Test the version the council actually uses, or one that matches it closely. A report on a newer version will not reflect the risks in production. If you plan an upgrade soon, testing the upgraded version before rollout may be the better use of the budget.
For web applications, yes. Application testing is normally done remotely, and the auditor will look at the report, scope and retest results rather than where the testers sat. On-site audits of your premises and processes are separate and still apply.
No. CyberFortify has no Wolverhampton office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
