The verdict in three sentences
For a customer-facing business application at a 600-employee company in Berlin, a penetration test costs between 5,000 and 15,000 EUR in 2026 depending on scope, and the real budget includes 10 to 30 days of fixes plus a retest at 1,500 to 3,000 EUR. Large accounts subject to NIS2 (implemented in Germany through the NIS2UmsuCG) now ask suppliers for a pentest report less than 12 months old and proof that critical findings are fixed. The right order is simple: scope, test, fix by priority, retest, then make it an annual cycle.
What each security audit component costs
The figures below are 2026 estimates for the German market from qualified providers, not Kolonell prices. They vary with the number of user roles, APIs and environments tested.
| Service | Typical scope | 2026 market price (EUR, excl. VAT) | Duration |
|---|---|---|---|
| Black-box penetration test | Web app, no account | 5,000 to 8,000 | 4 to 6 days |
| Grey-box penetration test | 3 user roles + API | 8,000 to 15,000 | 6 to 10 days |
| Source code audit | Manual + tool-assisted review | 800 to 1,200 per day | 5 to 15 days |
| Cloud configuration audit | Hosting, IAM, backups | 3,000 to 7,000 | 3 to 5 days |
| Fixes by the development team | Per report | 600 to 800 per day | 10 to 30 days |
| Retest of fixed findings | Targeted verification | 1,500 to 3,000 | 1 to 3 days |
| Continuous vulnerability scanning | SaaS tool | 150 to 600 per month | Ongoing |
A BSI-certified provider usually costs 15 to 25% more, which is justified when a public-sector client or critical infrastructure operator requires it.
The most frequent OWASP flaws and what they cost to fix
The OWASP Top 10 (2025 edition) remains the shared reference between auditors and developers. In a business app built 3 to 6 years ago, the same categories appear almost every time.
| OWASP category | Example in a business app | Observed frequency (estimate) | Fix effort |
|---|---|---|---|
| Broken access control | A customer sees another customer's orders by changing the ID in the URL | Very high | 3 to 8 days |
| Security misconfiguration | Missing CSP headers, debug mode on | Very high | 1 to 3 days |
| Software supply chain failures | Outdated npm or Composer libraries | High | 2 to 6 days |
| Cryptographic failures | Poorly hashed passwords, weak TLS | Medium | 1 to 4 days |
| Injection | Hand-built SQL query in an export | Medium | 2 to 5 days |
| Insecure design | No rate limit on password reset | Medium | 3 to 10 days |
| Authentication failures | No MFA, sessions never expire | High | 2 to 5 days |
| Software or data integrity failures | Update deployed without verification | Low to medium | 2 to 4 days |
| Logging and alerting failures | No trace of admin logins | High | 2 to 4 days |
| Mishandling of exceptional conditions | Error messages revealing database structure | Medium | 1 to 3 days |
Access control often accounts for half the effort: every API route must be reviewed, not only the affected screen.
Mini case study
Jonas, CIO of a 600-employee distribution company in Berlin, receives a 140-question NIS2 questionnaire from a large retail account. That client represents 4,000,000 EUR of annual revenue at an 8% margin, so 320,000 EUR of margin is at stake. Jonas orders a grey-box penetration test at 12,000 EUR. The report lists 2 critical, 5 high and 9 medium findings. Fixes take 22 days at 700 EUR, so 15,400 EUR, followed by a retest at 2,500 EUR. Total budget: 29,900 EUR, less than 10% of the annual margin of the account it protects. This scenario is illustrative and does not describe a Kolonell client.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How often should a penetration test be repeated?
At least once a year, and after any major change such as opening an API or a new portal. Most large-account NIS2 questionnaires ask for a report less than 12 months old.
Black box or grey box: which one?
For an app with customer accounts, grey box gives better value: the tester covers each role with real credentials. It costs 8,000 to 15,000 EUR and typically reveals 2 to 3 times more access control flaws.
Is an automated scan enough?
No, a scanner at 150 to 600 EUR a month catches outdated versions and missing headers. It almost never finds business logic flaws, which often make up more than 40% of critical vulnerabilities.
Who should fix the flaws: the auditor or the developer?
The developer, because the auditor must stay independent for the retest. Plan 10 to 30 days depending on the age of the code and the quality of its documentation.
How do we answer the client's NIS2 questionnaire in the meantime?
Document a dated action plan: test scheduled, critical fixes within 30 days, logging in place. A credible 90-day plan is often accepted in the first year.
Let's scope your project. Send us your penetration test report or your client's questionnaire: we will quote the fixes, hardening and maintenance of your business app with a realistic schedule, free quote. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
