When an Enterprise Customer Demands a Pentest: SaaS Remediation Budget in Berlin (2026)

The verdict in three sentences

A grey-box pentest of a SaaS application costs EUR 6,000 to 15,000 (excl. VAT) in 2026 for 5 to 10 days of testing, and you should set aside 20 to 40% of that amount to fix what is found. The enterprise buyer does not want a blank report: it wants proof that you test, fix and retest using a recognized method. Scoped well, the pentest becomes a sales asset you can reuse with every demanding customer.

What the enterprise customer actually expects

The security team of a DAX group or a large Mittelstand company usually sends a questionnaire of 80 to 200 questions, then asks for a pentest report under 12 months old. It checks four things: the tested scope (application, API, authentication, multi-tenancy), the methodology (OWASP Top 10, OWASP ASVS, PTES), the severity of findings with a CVSS score, and proof of remediation through a retest.

A useful report includes an executive summary, the technical detail of each vulnerability, reproduction steps and an attestation letter you can share without disclosing sensitive details.

2026 price grid in Europe

For a Berlin vendor with 20 to 50 staff, the most common combination is a 7-day grey-box pentest with an API module, EUR 9,000 to 13,000, plus a retest. ISO 27001 is required only in some sectors (banking, health, defense); ask whether a pentest report plus an action plan is enough for year one.

Typical fixes and their cost

At a senior developer day rate of EUR 550 to 750, a 4 to 8 day remediation costs EUR 2,200 to 6,000, which matches 20 to 40% of a EUR 10,000 audit. The most expensive flaw is almost always tenant isolation in a multi-tenant architecture, and it is also the one that worries buyers most.

Mini case study

Thomas, CTO of a 30-person HR SaaS vendor, must provide a pentest to sign a EUR 180,000 a year contract with a retail group. He orders a grey-box pentest with API at EUR 11,500. The report reveals 2 critical flaws (cross-tenant access), 3 medium and 6 low.

Remediation takes 7 days at EUR 650, or EUR 4,550, then a retest at EUR 1,500. He adds an automated scan at EUR 250 a month (EUR 3,000 a year). Total year-one budget: EUR 20,550, 11.4% of the annual contract. The same report and retest attestation then support two other tenders. 2026 order of magnitude.

FAQ

How long between ordering and receiving the report?

Allow 3 to 6 weeks: 1 to 3 weeks of lead time at a qualified provider, 5 to 10 days of testing and about a week of reporting. Plan for it during negotiation.

Do we need a certified provider?

In Germany, some public and critical-infrastructure customers expect BSI-recognized providers, in France PASSI qualification from ANSSI. Certification often raises the price by 15 to 30%, but it reassures enterprise buyers.

Can we test in production?

It is possible within an agreed window, but an identical staging environment is better. It usually costs EUR 150 to 600 a month in infrastructure.

How often should we repeat the pentest?

At least once a year and after every major change (new API, authentication rework). Most enterprise customers require a report under 12 months old.

Does Kolonell perform the pentest itself?

We prepare the application, fix the flaws and organize the retest with an independent auditor, because customers require the auditor not to be the developer. Our remediation is priced as a fixed package from EUR 3,000.

Let's scope your project. We define your pentest scope, price remediation based on your stack and schedule the retest to meet your enterprise customer's signing date. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.