The verdict in three sentences
For a business web app handling HR data, a grey-box penetration test in London costs, as a 2026 order of magnitude, between EUR 6,000 and 15,000 (about GBP 5,100 to 12,800) for 5 to 10 days of testing, plus a retest of around EUR 1,500. Roughly 40% of flaws found in this type of application concern access control: an employee viewing a colleague's payslip by changing an ID in the URL. The useful security budget is not the pentest alone, but the trio of OWASP fixes, multi-factor authentication and logging, planned from development onwards.
Black, grey or white box: which pentest for an HR app
The test type drives price and depth. For an internal application with several roles (employee, manager, HR, admin), grey box is the best compromise: the tester receives test accounts for each role and checks that none can exceed its permissions.
| Test type | Information provided | Typical duration | London price 2026 (EUR) | Relevance for an HR app |
|---|---|---|---|---|
| Black box | URL only | 4 to 6 days | 5,000 to 9,000 | Low, misses internal flaws |
| Grey box | Accounts per role, API docs | 5 to 10 days | 6,000 to 15,000 | High, recommended |
| White box | Source code + accounts | 8 to 15 days | 10,000 to 22,000 | Very high, more expensive |
| Automated scan only | URL | 1 day | 500 to 1,500 | Not enough for a client audit |
| Retest after fixes | Initial report | 1 to 2 days | 1,200 to 2,000 | Essential to close findings |
| Cloud configuration review | Read access | 2 to 4 days | 2,500 to 6,000 | Useful on AWS or Azure |
The day rate of a CREST-accredited or OSCP-certified tester in London ranges from EUR 1,100 to 1,600 (about GBP 950 to 1,350). CREST accreditation is often required by the security teams of large accounts.
What pentests find in business applications
| OWASP Top 10 category | Share of findings | Concrete example | Typical fix cost |
|---|---|---|---|
| A01 Broken access control | 40% | Accessing another employee's record via its ID | 2 to 5 dev days |
| A07 Authentication | 18% | No MFA, no lockout after failed attempts | 2 to 4 days |
| A05 Security misconfiguration | 14% | Missing CSP headers, debug mode on | 0.5 to 1 day |
| A03 Injection | 9% | Vulnerable search filter | 1 to 2 days |
| A09 Insufficient logging | 11% | No trace of sensitive data views | 2 to 3 days |
| A06 Vulnerable components | 8% | Outdated front-end library | 0.5 to 2 days |
These splits are orders of magnitude observed on custom business apps, not an official statistic. They show one key point: the most serious flaws come from business logic, which only a test with real accounts can reveal.
The full remediation budget
| Item | Budget (EUR) |
|---|---|
| Grey-box pentest (7 days) | 9,800 |
| Access control and OWASP fixes | 6,000 to 12,000 |
| Multi-factor authentication (TOTP or Entra ID SSO) | 3,000 to 6,000 |
| Logging and alerts (HR data access) | 2,500 to 5,000 |
| Retest | 1,500 |
| Total | 22,800 to 34,300 |
Mini case study
Claire, CIO of a London services company (1,200 employees), must launch a custom HR app built for EUR 140,000. The group security team requires an audit before production.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
The 7-day grey-box pentest (EUR 9,800) reveals 23 flaws, 9 of them on access control. Fixes cost EUR 8,500, MFA via the existing SSO EUR 3,500, logging EUR 3,000, the retest EUR 1,500. Total: EUR 26,300, or 19% of the application cost. By comparison, an HR data breach reported to the ICO can exceed EUR 100,000 in notification, crisis management and potential fines, not counting the loss of employee trust.
FAQ
When should the pentest start?
Ideally 3 to 4 weeks before go-live, on a staging environment identical to production. That leaves 2 weeks to fix and 1 week for the retest.
Is a pentest enough for UK GDPR compliance?
No, it proves one technical security measure among others. UK GDPR also requires a DPIA for sensitive HR processing, often billed EUR 3,000 to 6,000.
Is a CREST-accredited provider mandatory?
Only for certain regulated operators, but many large accounts require it contractually. The price gap with a non-accredited provider is about 15 to 25%.
How long does the report stay valid?
A pentest is usually renewed every 12 months or after a major change. An annual budget of EUR 6,000 to 9,000 is realistic for a stable app.
Can the developer run the test themselves?
They can and should do code reviews and automated scans, but an independent audit is still needed. An external tester finds on average 2 to 3 times more business-logic flaws.
Let's scope your project. Describe your application, its user roles and your go-live date: we will price the audit, OWASP fixes and MFA within a EUR 22,000 to 35,000 envelope. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
