For Worcester and Malvern's security vendors, manufacturers and public sector suppliers. Retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Worcester combines an established manufacturing base with a security community that grew out of nearby Malvern, where government radar and electronics research ran for decades and the Malvern Hills Science Park now hosts technology firms. The city is also home to Worcestershire County Council and a university, so local software ranges from security products to connected devices and public service portals.
Buyers in this area are often technically literate. Security vendors need third-party testing of their own platforms to be credible, manufacturers face new product security law for connected devices, and council suppliers must answer procurement security questions. An independent CREST report covers each of these without a day-rate negotiation.
Firms in the Worcester and Malvern area sell security tools, analytics and services to demanding buyers. Their own portals and APIs must hold up to scrutiny, and customers expect independent proof rather than self-assessment.
What we focus onMulti-tenant separation in security dashboards, API key scoping, role escalation from analyst to admin, export and reporting functions, SSO and SAML configuration, and stored data that reveals customer infrastructure.
Manufacturers around Worcester increasingly ship products with companion apps, cloud dashboards and installer portals. The device is only as safe as the web service behind it, and UK product security law has raised the bar for connectable products.
What we focus onDevice-to-account binding, installer and homeowner role separation, remote control API authorisation, firmware download endpoints, default credential handling, and whether one device ID can be swapped for another to take control.
Suppliers to the county council, schools and the university handle resident, pupil or student data. Procurement teams ask for recent independent testing, and a weak supplier portal reflects badly on the authority that bought it.
What we focus onResident and pupil record access controls, safeguarding data exposure, bulk export functions, account provisioning from directory sync, staff role boundaries, and audit logging of sensitive record views.
Worcester's mix of security products and connected hardware produces a particular set of web and API weaknesses that we see again and again.
Companion APIs that trust a device serial number supplied by the app. Change the serial and you read or control someone else's product. With sequential serials, an attacker can work through an entire installed base.
Integration tokens issued with full admin rights because finer scopes were never built. On a security platform, one leaked token can expose every customer finding, asset list and user in the tenant.
Single sign-on implementations that accept unsigned assertions or fail to bind the response to the request. Enterprise buyers rely on SSO, so a flaw here undermines the control they trusted most.
Report and export endpoints that skip the permission checks applied in the interface. A standard user can pull a full resident or pupil list by calling the export URL directly.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Since April 2024, connectable consumer products sold in the UK must meet baseline security requirements. A pentest of your companion API does not certify compliance, but it finds the web-side weaknesses the regime is aimed at.
Manufacturers supplying industrial or building systems often work towards IEC 62443, whose product development requirements include security testing. A CREST report on the management portal provides evidence for that part.
Council and education buyers ask suppliers for recent independent security testing during tender and contract renewal. A dated CREST report with retest results answers that directly and shows issues were fixed.
Customers discount self-assessment, however skilled the team. Independent testers also lack your assumptions about how the product should be used, which is often where flaws hide. An external CREST report gives buyers evidence they can rely on, and spares your engineers from marking their own homework.
The £2,400 covers the web application and its API, including the endpoints that devices and companion apps call. Hardware, firmware and radio testing are separate work, and mobile apps are scoped separately too. Many manufacturers start with the cloud side, because one flaw there affects every device at once.
It depends on the contract. Many government-adjacent buyers accept a CREST web application test. If a contract specifically requires a CHECK company, the NCSC scheme for government and critical systems, you need a CHECK provider, and CyberFortify is not one. Check the wording before booking.
No. CyberFortify has no Worcester office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
