The verdict in three sentences
When an enterprise buyer's security team asks for a penetration test report before signing, they expect a grey-box pentest run by a third party, on the scope customers actually use, with a retest proving that critical findings are fixed. Budget 5 to 10 testing days at 900 to 1,400 EUR per day in Western Europe (often 1,200 to 2,000 USD per day in the US), and above all 3 to 6 weeks from purchase order to final report. Most signing delays come not from the test itself but from the fixes and retest nobody scheduled.
What the enterprise buyer really expects
Security questionnaires from banks, insurers, manufacturers and public bodies look alike: they want to know who tested, on what scope, against which framework, and what remains open. An automated vulnerability scan is not enough, and a report older than 12 months is often rejected.
| Common enterprise requirement | What to provide | Common pitfall |
|---|---|---|
| Test by an independent third party | Engagement letter and tester identity | Test run in-house by the dev team |
| Recognised framework | OWASP Top 10 and ASVS level 2 coverage | Report with no described methodology |
| Grey-box mode | Test accounts per role (user, admin, tenant) | Black-box test that only sees the login page |
| Report under 12 months old | Explicit test date | Report on a previous version of the app |
| No open critical or high findings | Retest letter | Fixes made but never verified |
| Summary readable by non-technical staff | 2-page executive summary | 80-page report with no prioritisation |
Grey-box mode is the right compromise for a B2B SaaS: the tester gets accounts with different roles and can check isolation between customers, which is the first concern of an enterprise buyer.
What a pentest costs in 2026
The figures below are 2026 orders of magnitude from specialist firms in Western Europe. Certified providers required by some regulated or public buyers (CREST in the UK, PASSI in France) sit at the top of the range, and US rates typically run 20 to 40% higher.
| Scope tested | Testing days | Market budget, excl. VAT |
|---|---|---|
| Simple web app, 1 role | 4 to 5 days | 3,600 to 7,000 EUR |
| B2B SaaS, 3 roles, multi-tenant | 6 to 8 days | 5,400 to 11,200 EUR |
| B2B SaaS with public API | 8 to 10 days | 7,200 to 14,000 EUR |
| Mobile app on top of web | +3 to 5 days | +2,700 to 7,000 EUR |
| Retest after fixes | 1 to 2 days | 900 to 2,800 EUR, sometimes included |
| Reporting and debrief | 1 day | Usually included |
Always ask whether the retest is included. A 6,000 EUR quote without retest can end up costing more than a 7,500 EUR quote that includes it.
A realistic timeline, from order to report
The painful delay is not the testing week but waiting for the provider's availability and then the fix loop.
| Step | Typical duration | Who acts |
|---|---|---|
| Scoping, quote and engagement letter | 3 to 5 days | CTO and provider |
| Waiting for a provider slot | 1 to 3 weeks | Provider |
| Preparing the test environment | 2 to 3 days | Engineering team |
| Grey-box test | 5 to 10 working days | Provider |
| Preliminary report | 3 to 5 days | Provider |
| Fixing vulnerabilities | 1 to 3 weeks | Engineering team or agency |
| Retest and final report | 2 to 5 days | Provider |
In practice, if signing is planned in 6 weeks, the order must go out this week. Test on a staging environment identical to production, never on production with real customer data.
Fixing findings: where Kolonell comes in
The findings that recur most on a B2B SaaS are broken access control between tenants, predictable IDs in URLs, no rate limiting on login, missing security headers and outdated dependencies. Kolonell handles vulnerability remediation, quoted per project, starting from the preliminary report, along with hardening the application before the test, through its cybersecurity offer. The test itself must stay with an independent third party, otherwise the enterprise buyer will reject it.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Thomas, CTO of a 35-person B2B scale-up in Amsterdam, must provide a report to an insurance group for a contract worth 180,000 EUR a year. His SaaS has 3 roles, an API and a multi-tenant architecture: he books 8 testing days at 1,100 EUR, i.e. 8,800 EUR, plus 2 retest days at 1,100 EUR, i.e. 2,200 EUR, for a total of 11,000 EUR excl. VAT.
The test surfaces 2 high and 5 medium findings. Fixing them takes 9 development days. Measured against the contract, the pentest is 6.1% of first-year revenue, and the same report will serve the next three tenders for 12 months. Thomas ordered it 7 weeks before the signing date, which left one week of margin.
FAQ
Black, grey or white box: which one for an enterprise buyer?
Grey box covers a B2B SaaS best, because the tester checks each role's permissions and isolation between customers. White box, with code access, adds 30 to 50% more days and is mainly justified for financial applications.
Can a 200 EUR per month automated scan replace the pentest?
No, scanners mostly detect known vulnerabilities and misconfigurations. They almost never find broken access control, which often accounts for more than 30% of high findings on a SaaS.
Do we need a certified provider?
Some regulated sectors and public bodies require one (CREST, PASSI or equivalent), private buyers rarely do. Certified providers often charge 1,200 to 1,400 EUR per day in Europe.
How long does the report stay valid?
Most enterprise buyers accept a report under 12 months old, provided there has been no major rebuild in between. An annual pentest is standard for a SaaS selling to large accounts.
What if a critical finding appears a week before signing?
Fix it, retest and send the customer the preliminary report with a dated remediation plan. A finding fixed within 5 days and verified builds more trust than a report with no remarks at all.
Let's scope your project. We prepare your application before the test and handle the fixes from the preliminary report, on a schedule built around your signing date. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
