The verdict in three sentences
For a Berlin mid-sized company that must satisfy NIS2 and its cyber insurer, a grey-box pentest of its customer portal costs 8,000 to 20,000 EUR for 5 to 12 testing days. The real budget also includes remediation (4,000 to 15,000 EUR) and a retest of around 2,000 EUR, so 14,000 to 37,000 EUR in total. A report mapped to OWASP Top 10 and ASVS is what auditors, insurers and enterprise customers actually read.
What a web app pentest costs in 2026
Pricing is based on tester days, between 1,100 and 1,800 EUR per day in Germany depending on seniority and certifications (OSCP, OSWE, BSI-listed providers). The number of days depends on scope: user roles, screens, exposed APIs and sensitive functions such as payments, file uploads and data exports.
| Application scope | Testing days | Pentest budget (2026 estimate) | Report delivery |
|---|---|---|---|
| Brochure site with a form | 2 to 3 days | 3,000 to 5,000 EUR | 1 week |
| Customer portal, 2 roles, 20 screens | 5 to 6 days | 8,000 to 10,000 EUR | 1 to 2 weeks |
| Customer portal + public REST API | 7 to 8 days | 10,000 to 13,500 EUR | 2 weeks |
| Business app, 5 roles, payments | 10 to 12 days | 15,000 to 20,000 EUR | 2 to 3 weeks |
| Same scope, BSI-certified provider | 10 to 12 days | 17,000 to 23,000 EUR | 2 to 3 weeks |
| Retest after fixes | 1 to 1.5 days | 1,500 to 2,500 EUR | 3 to 5 days |
Grey-box testing, where the tester gets test accounts for every role, gives the best cost-to-coverage ratio because it exercises access controls, the number one category in the OWASP Top 10. Black-box testing is cheaper but misses most authorisation flaws.
OWASP Top 10 and ASVS: what the tester checks
A credible report relies on public standards so that an insurer or third-party auditor can read it. The OWASP Top 10 ranks the most common risks, while ASVS (Application Security Verification Standard) provides a verifiable control list by level.
| OWASP category | Concrete example on a customer portal | Observed frequency | Indicative fix cost |
|---|---|---|---|
| Broken access control | A customer opens another customer's invoice by changing the ID in the URL | Very common | 1,500 to 5,000 EUR |
| Cryptographic failures | Passwords hashed with MD5, cookies without the Secure flag | Common | 700 to 2,500 EUR |
| Injection | Search field vulnerable to SQL injection | Less common with an ORM | 1,000 to 3,500 EUR |
| Security misconfiguration | Missing CSP headers, debug mode in production | Very common | 400 to 2,000 EUR |
| Vulnerable components | JavaScript library with a known CVE | Common | 700 to 3,000 EUR |
| Weak authentication | No rate limiting on login, no MFA | Common | 1,500 to 4,000 EUR |
The standard deliverable includes an executive summary, each finding scored with CVSS, proof of exploitation and an actionable fix. Ask for a target ASVS level (level 2 fits most B2B portals): it lets your insurer compare results year on year.
NIS2, insurers and BSI: how high is the bar
Germany's NIS2 implementation law extends security obligations to roughly 30,000 companies, including many mid-sized manufacturers and service providers, with fines up to 10 million EUR or 2 % of global turnover for essential entities. Regular security testing is part of the expected risk management measures. Cyber insurers increasingly ask for a pentest report under 12 months old at renewal, and enterprise customers add the same requirement to supplier questionnaires.
Mini case study
Jonas, CISO of a 400-employee company in Berlin (illustrative example), must provide a pentest report on the customer portal before his cyber policy renews, at an annual premium of 45,000 EUR.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Grey-box pentest, 3 roles, API included: 8 days at 1,400 EUR, or 11,200 EUR.
- Findings: 2 critical (access control), 4 medium, 6 low.
- Fixes by the development team: 12 days at 700 EUR, or 8,400 EUR.
- Retest: 2,000 EUR.
Total: 21,600 EUR. The insurer keeps the cover and grants a 10 % premium reduction, or 4,500 EUR a year: the project pays back in under 5 years on the premium alone, before counting the avoided cost of a customer data breach and NIS2 exposure.
FAQ
How long does a web application pentest take?
5 to 12 testing days for a customer portal or business application, plus 1 to 3 weeks for the report. Allow 4 to 8 weeks from order to delivery given provider availability in Germany.
Do we need a BSI-certified provider?
Not for most private mid-sized firms, but critical infrastructure operators and some public tenders require it. Certified providers cost 15 to 20 % more on average, and their reports are rarely challenged.
Can testing be done in production?
It can with precautions, but an identical staging environment is better. It avoids altering real data and usually costs less than 250 EUR a month of temporary hosting.
How often should we repeat the pentest?
At least once a year and after every major change, such as a new payment module or API. Most insurers require a report less than 12 months old.
Is the retest really necessary?
Yes if you must prove that critical findings were fixed. For about 2,000 EUR, it turns a list of vulnerabilities into a remediation attestation.
Let's scope your project. We prepare your application for its pentest and handle the remediation work, with scope, testing days and fix budget clearly priced. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
