The verdict in three sentences
A grey-box penetration test of a client portal costs between 8,000 and 20,000 GBP in London in 2026, for 5 to 10 testing days depending on functional scope. You should also budget 3,000 to 12,000 GBP for remediation and insist on a retest included so the report is acceptable to an enterprise procurement team. A CREST-accredited tester is not a legal requirement, but most bank and insurer security teams will only accept CREST or CHECK reports.
Which test for which stake
Enterprise buyers increasingly ask for a penetration test report under 12 months old in their supplier security questionnaire. The format you choose drives both price and credibility.
| Test type | Information provided | Duration | 2026 price (GBP) | Recommended use |
|---|---|---|---|---|
| Automated scan | URL only | 1 day | 1,000 to 2,500 | Monthly hygiene, not a pentest |
| Black-box pentest | URL only | 4 to 6 days | 6,500 to 12,000 | Simulate an external attacker |
| Grey-box pentest | User accounts per role | 5 to 10 days | 8,000 to 20,000 | Client portal, enterprise standard |
| White-box pentest | Source code and architecture | 8 to 15 days | 15,000 to 32,000 | Critical app, sensitive data |
| Cloud configuration review | Read access to AWS or Azure | 2 to 4 days | 3,500 to 7,500 | Infrastructure add-on |
| Retest after fixes | Initial report | 1 to 2 days | Included or 1,200 to 3,000 | Essential for the client file |
Grey-box is the best trade-off: the tester exercises every role (client, account manager, admin) and hunts for privilege escalation, the leading cause of data leaks on B2B portals.
Methodology: what the report must cover
A serious report follows the OWASP Top 10 and OWASP ASVS level 2. Here are the most frequent vulnerabilities found on mid-market client portals in 2025 and 2026, with average remediation cost.
| Vulnerability (OWASP 2021) | Observed frequency | Typical severity | Remediation cost (GBP) |
|---|---|---|---|
| A01 Broken access control (IDOR) | 45 to 60% of tests | Critical | 1,500 to 4,000 |
| A07 Weak authentication, no MFA | 35 to 50% | High | 1,000 to 3,000 |
| A05 Misconfiguration (headers, CORS) | 60 to 70% | Medium | 500 to 1,500 |
| A06 Outdated components | 40 to 55% | Variable | 1,000 to 5,000 |
| A03 Injection (SQL, XSS) | 15 to 25% | Critical | 1,000 to 3,500 |
| A09 Insufficient logging | 50 to 65% | Medium | 1,500 to 3,000 |
These frequencies are 2026 orders of magnitude from tester feedback, not an official statistic. The report must rate each finding with a CVSS score and propose a concrete fix.
DORA, ISO 27001 and timeline
Since DORA applies to EU financial entities from January 2025, UK fintechs serving EU banks see its third-party ICT risk requirements passed down through contracts, alongside the FCA operational resilience rules. An annual pentest with a tracked remediation plan is also expected evidence for ISO 27001 (control A.8.29). Allow 3 weeks: one week of scoping and written authorisation, one week of testing, one week of fixes and retest.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Daniel, CTO of a 120-person fintech in London, must provide a pentest report to sign a 1 million GBP contract with a tier-one bank. A 7-day grey-box pentest: 13,500 GBP. The test reveals 2 critical issues (IDOR on statements, no admin MFA) and 5 medium ones: fixes quoted at 7,500 GBP. Retest included. Total budget: 21,000 GBP, about 2.1% of the contract value. Without a compliant report, signature would have slipped by at least a quarter, deferring roughly 250,000 GBP of revenue.
FAQ
How much does a web application pentest cost in London in 2026?
Between 8,000 and 20,000 GBP for a 5 to 10 day grey-box test. The price depends on the number of roles, dynamic pages and exposed APIs.
Do we need a CREST-accredited tester?
Not legally, but banks and insurers usually require CREST or CHECK reports. CREST testers typically cost 10 to 20% more and shorten procurement reviews.
Is the retest really necessary?
Yes, procurement wants proof that critical issues are fixed. It takes 1 to 2 days and should ideally be included in the initial quote.
How often should we repeat a pentest?
At least once a year, and after any major change to the portal. Most supplier questionnaires reject reports older than 12 months.
Does Kolonell carry out the fixes?
Yes, we fix the findings, add MFA, logging and security headers, then coordinate the retest with the independent tester. A critical fix is usually delivered within 5 working days.
Let's scope your project. Share your portal URL, the number of user roles and your contract deadline, and we will scope the test, fixes and retest. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
