For Wrexham's manufacturing, food production and pharma software teams. Flat price per app, retest included.
Tell us about your app. We reply within 1 business day with a fixed quote. No call needed.
Wrexham became a city in 2022, but its industrial base is much older. Wrexham Industrial Estate is one of the largest in the UK, home to manufacturers in engineering, food and drink, plastics and pharmaceuticals. Software here is practical: supplier portals, production dashboards, traceability and quality systems, often built by small digital firms or in-house teams.
Manufacturers face supplier audits from their customers, and those audits now include cyber security. Pharmaceutical producers must also protect the integrity of their records. When a Wrexham firm or its software supplier is asked to prove its web systems are secure, a CREST pentest gives an independent answer.
Factories connect production planning, supplier portals and customer order tracking to the web. Large customers audit their suppliers and want to know an attacker cannot reach orders, drawings or schedules.
What we focus onSupplier and customer portal separation, technical drawing and specification access, order and schedule changes, remote access dashboards for production data, and default credentials on web-managed systems.
Food producers sell to retailers who audit traceability and product safety. Web systems that record batches, allergens and recalls must be trustworthy, and retail buyers ask how they are secured.
What we focus onBatch and allergen record integrity, recall notification features, retailer and supplier logins, approval workflows for labels and specifications, and exports shared with auditors and customers.
Pharma producers must show their computerised systems keep accurate, unaltered records. Web applications for quality, documents and batch release are tested because a security flaw can become a data integrity finding.
What we focus onElectronic signature and approval controls, completeness of audit trails, role separation for quality release, document version control, and authentication on every system that holds batch records.
Wrexham's manufacturing software protects orders, batches and records. These are the problems we most often find in that kind of app.
Production dashboards and equipment web interfaces left with vendor default passwords and reachable from the internet. They are found by automated scanning within days of exposure.
Quality or batch data that can be changed through the API without a full audit trail. That breaks data integrity rules, hides tampering and is the kind of gap an MHRA or customer auditor will question.
Workflows where the interface enforces review and approval, but the API lets a user call the final step directly. Labels or batches can be released unapproved.
Specification and drawing downloads checked for login only. One customer can retrieve another's confidential designs and specifications simply by changing a file reference in the request.
What UK pricing guides put a SaaS app with an API and several user roles at.
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Per application · any size
£2,400flat
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
9 gates, the same sequence on every engagement.
Discovery
We send a short questionnaire to understand your infrastructure, business requirements and security concerns.
Agreement
We analyse your answers, define a clear scope and issue the Statement of Work.
Initiation
We walk through methodology, timeline and requirements, and access is handed over securely.
Active testing
AI-enabled coverage, then accredited engineers validate and exploit. High and critical findings are sent to you immediately.
Reporting
Every finding with risk rating, technical detail and step-by-step remediation, mapped to your controls.
Walkthrough
A session with your technical team to explain findings, priorities and remediation approaches.
Remediation
Your teams implement fixes. We stay available for guidance throughout.
Verification
We re-test every previously identified issue to confirm the fix and check nothing new was introduced.
Attestation
A final report confirming remediation and your improved security posture, ready to share with auditors.
Manufacturing customers include cyber security in supplier audits. A CREST report on your web portal or production systems gives auditors dated, independent evidence and closes a common audit action.
Pharmaceutical firms must keep reliable records in computerised systems. A pentest checks whether security weaknesses could let users alter data, supporting your validation and data integrity work.
Standards like IEC 62443 cover industrial control systems. Our test covers web apps and APIs only, which customers often ask for alongside, not instead of, industrial assessments.
Yes, if it is a web application. We can test through a VPN or a jump host you provide, or on a staging copy. Testing the factory network or the machines it talks to is separate work. We agree access and safety rules before the test so production is not disrupted.
No. Validation is your quality team's process. A pentest is security evidence that supports it, by showing whether users could bypass controls on approvals, signatures or audit trails. The report gives your quality team findings they can assess and record in their own validation documentation.
Usually an independent test of that portal and proof that findings were fixed. We test the web application and API, then retest your fixes, and the report records both. Check the audit wording; some retailers also ask for Cyber Essentials, which is a separate certification.
No. CyberFortify has no Wrexham office. Web application and API tests run remotely, which is how almost all application pentests are delivered. Kick-off, critical alerts and the report walkthrough happen in UK working hours, and the price is the same £2,400 flat.
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £2,400. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Yes. £2,400 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
Already have your scope written up? Send full scope details
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.
