Ryvx

If you run a small UK business and want your website tested, you have three realistic options. They differ in price by a factor of ten or more, and the right one depends on why you want the test.

Option 1: an automated scanner

Scanners cost from nothing to a few hundred pounds a year. They check your site against lists of known problems: an out-of-date server, a missing security header, a weak certificate. They are quick and worth running, but they cannot sign in, follow a checkout or notice that one customer can read another's order. They also report a lot of possible problems that turn out not to be real, and someone has to sort those out.

Option 2: a full manual penetration test

An accredited firm sends a tester for a set number of days. UK day rates in 2026 run from roughly £900 to £1,800, and a small website is usually scoped at 3 to 5 days, so most quotes land between £3,000 and £7,000 plus VAT. If a contract, regulator or payment card standard names this kind of test or a specific accreditation, this is the option to buy.

Option 3: a fixed-price AI security review

This sits between the two. A Ryvx Launch Security Review costs £495 per site. Our AI testing tools work through your site the way an attacker would: signing in, filling in forms, calling the APIs behind the pages and trying to reach data they should not. A finding only goes in the report if it comes with working proof, so you are not sorting through guesses. A person checks every report before you see it.

You get the report in 3 to 5 working days, with a plain summary for directors, full detail and fixes for your developer, answers to questions by email for 30 days, and one retest after you fix things. Nothing is tested until you prove the site is yours and agree the scope in writing, and anything that could change your data stays off unless you switch it on.

How to choose

If someone requires a specific accreditation, ask them exactly what they will accept and buy that. Ryvx is not CREST accredited and is not a PCI Approved Scanning Vendor. If you want to know whether your site is an easy target before a launch, after a redesign, or because an insurer or customer asked, a fixed-price review usually does the job for a fraction of the cost. No test of any kind can prove a site is secure.

You can see what you would get first: the sample report on ryvx.dev is a real Ryvx report from a test of a deliberately vulnerable practice site.