The verdict in three sentences
For a customer-facing business portal, a grey-box penetration test of 5 to 10 days costs roughly GBP 5,000 to 14,000 in London in 2026, with CREST-accredited tester day rates between GBP 900 and 1,400. The budget almost everyone forgets is remediation, ranging from GBP 3,000 to 18,000 depending on code age and finding severity. Before an enterprise tender, the right sequence is test, fix, retest, allowing 6 to 10 weeks in total.
Why enterprise buyers demand a recent pen test
A London distribution group bidding for a national retailer finds the same line in the security questionnaire: "penetration test report less than 12 months old, carried out by an independent third party". Without it, the bid loses points or is excluded. Procurement teams increasingly rely on Cyber Essentials Plus, ISO 27001 controls and their own supplier security policies.
| Common tender requirement (2026) | What to provide | Estimated effort |
|---|---|---|
| Penetration test under 12 months old | report and executive summary | 5 to 10 test days |
| Critical and high vulnerabilities fixed | retest evidence | 2 to 5 retest days |
| Accredited provider | CREST or CHECK accredited tester | provider selection |
| OWASP Top 10 coverage | code review or targeted tests | 3 to 8 days |
| Security assurance documentation | 10 to 30 page document | 3 to 6 days |
| Hosting and backups | hosting attestation, DR plan | 1 to 3 days |
| Access management | MFA, logging, access reviews | depends on current state |
What a business web app pen test costs in 2026
Price depends on scope (number of user roles, screens, APIs), test type and the tester's accreditation. A customer portal with three profiles (customer, sales rep, admin) and a REST API usually takes 6 to 10 days.
| Service type | Typical duration | Budget (2026 order of magnitude) |
|---|---|---|
| Black-box test (no account) | 3 to 5 days | GBP 3,000 to 7,000 |
| Grey-box test (accounts per role) | 5 to 10 days | GBP 5,000 to 14,000 |
| White-box test with code access | 8 to 15 days | GBP 8,000 to 20,000 |
| OWASP-focused code review | 3 to 8 days | GBP 3,000 to 10,000 |
| Retest after fixes | 1 to 3 days | GBP 1,000 to 4,000 |
| Automated vulnerability scanning (subscription) | continuous | GBP 100 to 450 per month |
| Private bug bounty programme | continuous | GBP 5,000 to 25,000 a year in bounties |
Automated scanning does not replace a pen test: it catches known flaws and misconfigurations, not business logic errors such as a customer viewing another customer's orders by changing an ID in the URL.
The hidden budget: fixing what the test finds
| Common finding on a business portal | Usual severity | Indicative fix cost |
|---|---|---|
| Broken access control (IDOR) | critical | GBP 1,800 to 7,000 |
| SQL or NoSQL injection | critical | GBP 1,300 to 5,500 |
| No MFA on admin access | high | GBP 900 to 2,700 |
| Outdated libraries with known CVEs | high to medium | GBP 1,300 to 9,000 |
| Missing security headers and CSP | medium | GBP 450 to 1,300 |
| Weak password and session policy | medium | GBP 700 to 2,200 |
On code older than 5 years that has never been tested, budget a remediation envelope at least equal to the pen test price. On a recent application built along OWASP guidance, fixes often stay within GBP 3,000 to 4,500.
Mini case study
Illustrative scenario: James, IT director of a 600-employee distribution group in London, must supply a pen test report for a tender worth an estimated GBP 1,600,000 in revenue over 3 years. He books an 8-day grey-box test at GBP 1,100 per day, i.e. GBP 8,800, plus a 2-day retest at GBP 2,200.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
The test finds two critical and five medium issues, fixed for GBP 8,500. Total cost: GBP 19,500. If the report lifts his win probability from 20% to 30%, expected revenue rises by GBP 160,000. At an 8% net margin, that is GBP 12,800 of expected margin on this bid alone, before the following tenders that reuse the same report for 12 months.
FAQ
How often should we repeat a pen test?
At least once a year, and after every major change such as a new API or user role. Most enterprise buyers require a report less than 12 months old.
Do we need a CREST-accredited provider?
It is not a legal requirement for a private company, but it is a strong signal in tenders and expected by many regulated buyers. The premium over a non-accredited tester is around 10 to 25% of the day rate.
Can testing be done in production?
It is possible with precautions, but an identical staging environment is preferable. Setting one up usually costs GBP 900 to 2,700 and removes any risk to customer data.
How long from order to report?
Allow 2 to 4 weeks to get a slot with a recognised firm, then 1 to 2 weeks of testing and a week of reporting. With fixes and retest, the full cycle takes 6 to 10 weeks.
Is an automated scan enough to reassure a client?
No, a scan at GBP 100 to 450 a month complements the pen test but does not catch business logic flaws. Enterprise security questionnaires explicitly ask for manual testing.
Let's scope your project. Share your portal architecture, user roles and tender deadline, and we will price preparation, remediation and coordination with the tester on a realistic timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
