Per application · any size
£4,000flat
- One web app and its API, no endpoint cap
- Testing starts within a week, report in 4–7 working days
- Free retest, signed attestation letter
UK CREST Penetration Testing
£4,000 Flat per App
Any size. Retest included. No day rates.
Trusted by SaaS Teams Worldwide
£4,000. Not £12,000–£25,000.
What UK pricing guides put a SaaS app with an API and several user roles at.
Typical UK quote
CyberFortify
How it’s priced
Day rate, median £1,000 a day
£4,000 flat per application
SaaS app, API, several roles
£12,000–£25,000
£4,000
Retest of your fixes
Often extra, £2,000–£5,000
Included
App bigger than expected
More days, bigger invoice
Same £4,000, no size cap
Who tests
Varies by firm
CREST-accredited engineers
Sources: Stingrai Penetration Testing Price Index (Sept 2026, median of 30 G-Cloud 14 rate cards) and Cyphere’s UK cost guide (2026).
Got a UK Quote? See Your Saving
Your saving
Your UK quote£9,500
CyberFortify, retest included£4,000
£5,50058% less than your quote
Book my £4,000 pentest
One Price, Everything In It
Included in the £4,000
- AI-enabled testing, with every finding validated and exploited by CREST-accredited engineers
- Authentication, access control between user roles and business logic
- Criticals flagged within 24 hours, not held for the final report
- CVSS-scored findings with reproduction steps and the fix
- Clean report and signed attestation letter for customers, auditors and insurers
- ISO 27001 and ISO 9001 certified processes, professional liability cover and Koop cyber insurance
One application = one web product your users sign in to, plus its API. Mobile apps, internal networks and cloud reviews are scoped separately. Prices exclude VAT.
One Test, Every Place That Asks for It
ISO 27001
Independent test evidence for your certification or surveillance audit.
SOC 2
For UK SaaS teams selling to US customers who ask for a SOC 2 report.
Enterprise security reviews
The report and attestation letter procurement teams ask for before they sign.
NHS DTAC and DSPT
Penetration test evidence for health tech suppliers working with the NHS.
PCI DSS
Application testing evidence for requirement 11.4.
Investor due diligence
A dated, independent report to hand over in a data room.
Call to Clean Report in Two Weeks
- 1
Scope
A short call with Usama.
We confirm what is in scope and give you a start date. The price stays £4,000.
Fixed price on the call - 2
Test
Four to seven working days.
The AI Pentest Agent maps the app and API. CREST-accredited engineers then exploit, chain and validate what it finds.
Criticals flagged in 24h - 3
Fix
Findings your developers can act on.
Each finding arrives CVSS-scored, with reproduction steps and the fix.
Help on the fix included - 4
Retest
Clean report, attestation.
We re-run every exploit, then issue the clean report and signed attestation letter.
Free retest
Before you book.
Why is it cheaper than UK day-rate firms?
Our AI Pentest Agent covers the breadth of your app: mapping every page and API route and checking the known issues. That frees our CREST-accredited engineers for exploitation, access control and business logic. Fewer billable days means one flat fee instead of a day rate. Every finding is still validated by a person before it reaches your report.
Is CyberFortify really CREST accredited?
Yes. CyberFortify is a CREST member company, accredited for Penetration Testing and AI-Enabled Penetration Testing, and a signatory of the CREST AI Charter. You can check our listing on the CREST Marketplace before you book.
What counts as one application?
One web product your users sign in to, plus the API behind it. Size doesn’t change the price: a large SaaS platform with many roles is still £4,000. A mobile app, an internal network or a cloud configuration review is a separate scope, and we’ll quote it on the call if you need it.
Is the price really fixed?
Yes. £4,000 per application, agreed on the scoping call before testing starts. The retest of your fixes is included. There are no day rates, so the invoice doesn’t grow if testing takes longer.
Is Cyber Essentials Plus the same as a penetration test?
No. Cyber Essentials Plus is a certification with a hands-on check of five basic controls. It doesn’t test your application for vulnerabilities the way a penetration test does.
Are you a CHECK company?
No. CHECK is the NCSC scheme for UK government and critical national infrastructure systems. If your contract names CHECK, you need a CHECK company, and we’ll tell you so on the call. CyberFortify is CREST accredited.
How fast can you start?
Testing usually starts within a week of the scoping call, and most reports are ready in four to seven working days. Criticals are flagged within 24 hours of discovery.
What happens to our data?
CyberFortify works under ISO 27001 certified processes. Client data from the engagement is disposed of afterwards, as set out in the statement of work. Every assignment carries professional liability insurance and Koop cyber insurance.
A CREST pentest for £4,000.
Booked this week.
Your first call is with Usama Gul, the founder and the engineer who leads your test. You’ll leave with a confirmed scope and a start date.
Prices exclude VAT. Price comparisons use published UK guides; individual firms’ quotes vary.