The verdict in three sentences
For a mid-sized company whose client-facing application must pass a major account's security audit, the realistic 2026 budget sits between EUR 25,000 and 65,000 excl. VAT over the year: pentest, remediation, retest and structural measures. The pentest itself is only the visible part: remediation usually costs 1.5 to 3 times the test price, especially when authentication and logging were never designed properly. Target OWASP ASVS level 2 as the contractual benchmark, plan 10 to 14 weeks between kickoff and the retest report, and check early whether your client pulls you into its NIS 2 supply-chain scope.
What a pentest costs in 2026
The price of a penetration test depends mainly on tester-days, which follow the number of roles, screens and exposed APIs. A qualified tester's day rate is around EUR 1,100 to 1,600 excl. VAT in 2026 in London and Paris (roughly GBP 950 to 1,400), more for CREST- or PASSI-accredited firms.
| Test type | Typical scope | Duration | 2026 budget (excl. VAT) |
|---|---|---|---|
| Black-box pentest | Public site, no account | 3-5 days | EUR 4,000 - 8,000 |
| Grey-box pentest | Business app, 2-3 user roles | 5-8 days | EUR 6,000 - 11,000 |
| Extended grey-box pentest | App + API + back office, 4-6 roles | 9-12 days | EUR 11,000 - 18,000 |
| Targeted code review | Authentication, access control, payments | 4-8 days | EUR 5,000 - 12,000 |
| Retest after fixes | Verification of reported flaws | 1-3 days | EUR 1,200 - 4,500 |
| Accredited provider (CREST, PASSI) | Required by some major accounts and the public sector | +15 to 30 % | depends on scope |
| Bug bounty (private programme) | Rewards + platform | continuous | EUR 2,000 - 10,000 / year |
For a client-mandated audit, grey-box is the right format: the tester receives test accounts for each role and hunts for the flaws that really matter, such as a sales rep able to read another customer's records (IDOR) or a standard user reaching an admin route.
The real cost item: remediation
A pentest report on a 5 to 8 year old business application often contains 15 to 30 findings, 2 to 6 of them critical or high. Remediation cost depends far more on the nature of the flaws than on their count.
| Remediation workstream | Estimated effort | 2026 budget (excl. VAT) |
|---|---|---|
| Quick fixes (headers, cookies, CSP, versions) | 3-6 days | EUR 2,500 - 6,000 |
| Access-control rework (IDOR, roles, multi-tenant) | 10-25 days | EUR 8,000 - 20,000 |
| MFA on all accounts (TOTP, WebAuthn) | 5-10 days | EUR 4,000 - 9,000 |
| Logging and alerts (logins, exports, permissions) | 6-12 days | EUR 5,000 - 11,000 |
| Dependency and framework upgrades | 5-20 days | EUR 4,000 - 16,000 |
| Security assurance plan and documentation | 3-6 days | EUR 2,500 - 6,000 |
Common total: EUR 10,000 to 40,000. The top of the range applies to applications that check permissions only in the user interface: every API route must then be reworked. These are 2026 estimates for a mid-sized application, to be refined once the report is in.
ASVS level 2, NIS 2 and timeline
OWASP ASVS level 2 is the standard a major account will accept without debate for an application handling personal or commercial data. It covers authentication, session management, access control, input validation, cryptography and logging. Writing « ASVS level 2 compliance, third-party verified » in your security questionnaire saves weeks of back-and-forth.
NIS 2 applies directly to essential and important entities in the EU, and indirectly to their suppliers: your client will impose security clauses, 24-hour incident notification and audit rights. In the UK, the Cyber Security and Resilience Bill pushes in the same direction. Prepare a security assurance plan describing your controls, backups and vulnerability management process.
Typical timeline: 2 weeks of scoping and vendor selection, 1 to 2 weeks of testing, 1 week for the report, 4 to 8 weeks of fixes, then the retest. Allow 10 to 14 weeks in total: if the client audit is 6 weeks away, start the pentest now and negotiate a dated remediation plan rather than promising a clean report.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Claire, CIO of a B2B services company in London (320 staff), must have her client portal audited before signing a EUR 1.2M per year contract with a banking group. She orders an 8-day grey-box pentest (EUR 10,400 excl. VAT). The report lists 22 findings, 4 of them high: IDOR on invoices, no MFA, incomplete logs, an end-of-life framework. Fixes: EUR 24,000 over 6 weeks, retest: EUR 2,800. Total: EUR 37,200 excl. VAT, or 3.1 % of the contract's first year. She adds a private bug bounty at EUR 6,000 per year to keep continuous coverage between annual tests.
FAQ
How much does a web application pentest cost in 2026?
A grey-box test on a business application costs EUR 6,000 to 18,000 excl. VAT for 5 to 12 days. A brochure site with no user accounts can be tested for EUR 4,000 to 8,000.
Do I need an accredited provider?
It is mandatory only in some regulated contexts and the public sector, but many major accounts ask for CREST or PASSI. Expect a 15 to 30 % premium and 3 to 6 weeks of booking lead time.
How long does remediation take?
Allow 4 to 8 weeks for a mid-sized application with 2 to 6 high findings. A 1 to 3 day retest (EUR 1,200 to 4,500) then proves the fixes to the client.
Does a bug bounty replace a pentest?
No, it complements it: EUR 2,000 to 10,000 per year for continuous coverage, while a pentest is still required once a year or after each major release.
Is my company in scope for NIS 2?
Directly if you are an essential or important entity (usually 50 staff and EUR 10M turnover in a listed sector). Otherwise, in-scope clients will impose security clauses through your contract.
Let's scope your project. Send us your application's scope (roles, APIs, audit deadline) and we will price the remediation, MFA and logging work with a schedule that fits your client audit. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
