The verdict in three sentences
If an enterprise client makes signature conditional on your application's security, plan a grey-box pentest of 5 to 10 days, that is 8,000 to 25,000 GBP in London in 2026 with a CREST accredited provider, plus 1,000 to 3,500 GBP for the retest. Public sector and regulated buyers (finance, health) often require CREST or CHECK accreditation, which narrows the pool of suppliers. Scheduled 4 to 6 weeks before go-live, the test costs far less than fixing a critical flaw found by the client, or by an attacker.
What a penetration test costs in 2026
Price depends on the number of days, hence the tested surface: user roles, APIs, critical journeys (payments, data export, admin).
| Test type (2026 ballpark) | Duration | London price | Use case |
|---|---|---|---|
| Automated scan and quick review | 1 to 2 days | 1,500 to 3,000 GBP | First assessment, not audit-grade |
| Black-box pentest (no access) | 3 to 5 days | 4,500 to 10,000 GBP | External exposure of a website |
| Grey-box pentest (accounts provided) | 5 to 10 days | 8,000 to 25,000 GBP | B2B SaaS, enterprise requirement |
| Grey-box pentest with API and mobile app | 8 to 15 days | 14,000 to 35,000 GBP | Full platform |
| CHECK provider (public sector) | 5 to 10 days | 10,000 to 28,000 GBP | Government, critical infrastructure |
| Retest of fixed findings | 1 to 2 days | 1,000 to 3,500 GBP | Remediation letter |
| Targeted code review | 3 to 6 days | 4,500 to 12,000 GBP | Sensitive components (authentication) |
A senior tester's day rate sits between 1,200 and 1,800 GBP. Be wary of offers under 3,000 GBP for a full application: they are usually an automated scan, which will not satisfy your client's CISO.
Before or after go-live: the cost of a flaw
The baseline framework is the OWASP Top 10 (broken access control, injection, misconfiguration, vulnerable components). Access control flaws, such as a user reaching another customer's data by changing an ID, are the most common in B2B SaaS.
| When the flaw is found | Indicative fix cost | Consequences |
|---|---|---|
| Design (architecture review) | 1 to 2 development days | None |
| Before go-live (pentest) | 2 to 5 development days | Launch delayed 1 to 2 weeks |
| After go-live, found internally | 5 to 15 days plus data migration | Possible customer notice |
| Found by the enterprise client | 10 to 30 times the initial cost | Signature on hold, penalties |
| Confirmed data breach | ICO notification within 72 h, investigation | UK GDPR fine up to 4% of turnover |
| Ransomware through the app | Several weeks of downtime | SME cost of 40,000 to 250,000 GBP |
Recommended timeline: feature freeze, pentest 4 to 6 weeks before go-live, fixes in 1 to 2 weeks, retest, then the report and remediation letter go to the client.
Preparing the pentest to get your money's worth
- A staging environment identical to production, with dummy data.
- Two accounts per role (to test tenant isolation) and API documentation (OpenAPI).
- A written scope and signed authorisation, which protects you legally.
- A technical contact available during the test days.
- A two-part report: executive summary for leadership and the client, technical detail with CVSS scores and recommendations.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
James, CTO of a London SME selling a logistics planning tool, is negotiating a 200,000 GBP a year contract with a major retailer. The retailer's CISO requires a pentest report under 12 months old and a remediation letter. James orders an 8-day grey-box pentest at 1,400 GBP a day, that is 11,200 GBP, plus a 2,000 GBP retest. The test reveals 2 critical access control flaws, fixed in 4 development days, about 2,800 GBP of internal cost. Total: 16,000 GBP, or 8% of the contract's first year. Without the report, the deal was blocked.
FAQ
How much does a web application pentest cost in London in 2026?
A CREST grey-box pentest of 5 to 10 days costs 8,000 to 25,000 GBP. Retesting fixed findings adds 1,000 to 3,500 GBP.
Do we need a CREST or CHECK provider?
CREST is the de facto standard for enterprise buyers; CHECK is required for many UK government systems. Accredited providers cost 10 to 25% more than unaccredited freelancers.
How long before go-live should we test?
Schedule the pentest 4 to 6 weeks before go-live. That leaves 1 to 2 weeks for fixes and a few days for the retest.
How often should we repeat a pentest?
At least once a year, and after any major change (new module, new API, authentication change). Many enterprise clients require a report less than 12 months old.
Is a vulnerability scan enough?
Rarely: a 1,500 to 3,000 GBP scan detects known flaws but not business logic errors or tenant isolation issues, which make up most critical findings in B2B SaaS.
Let's scope your project. We design and build web applications secure by design, with a pentest scheduled before go-live: send us your scope and target date for an indicative budget and timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
