Pentest or bug bounty for a web app: budget and choice in 2026

The verdict in three sentences

For a client portal going live, start with a grey-box pentest (4,000 to 15,000 EUR excl. VAT for 3 to 10 days): it gives you a formal report, methodical coverage of the OWASP Top 10 and a fixed end date. Choose a PASSI-certified provider (20 to 40% more expensive) only if a client, a regulator or a tender requires it. A private bug bounty comes afterwards, once obvious flaws are fixed, otherwise you pay bounties for what a pentest would have found more cheaply.

The three options compared

A pentest is a fixed-price engagement run by a team of auditors over a set period. A bug bounty is an ongoing programme where independent researchers are paid per vulnerability found. The PASSI certification, issued under the French cybersecurity agency ANSSI, attests that the provider follows a set of requirements on method, confidentiality and skills.

How a pentest budget is built

Price depends on auditor-days, which in turn depend on the attack surface: number of user roles, screens, APIs and sensitive functions (payment, data export, permission management). A senior auditor's day rate in France ranges from 900 to 1,500 EUR excl. VAT in 2026.

On the bug bounty side, 2026 bounty tables generally range from 100 to 300 EUR for a low-severity flaw, 500 to 1,500 EUR for a medium one and 1,500 to 3,000 EUR or more for a critical one. On a never-audited app, the first 20 reports can cost more than a full pentest.

The recommended sequence for an SME

Before any audit, baseline hardening avoids paying auditors to find the obvious: security headers (CSP, HSTS), secure cookies, login rate limiting, dependency updates, access control enforced server-side. Then the grey-box pentest, with one account per role. Then fixes and a retest. Finally, if the app handles sensitive data or a large user base, a private bug bounty with 20 to 50 invited researchers and a capped bounty pool.

Mini case study

Illustrative scenario: Sophie, CISO of a 120-employee financial services SME in Bordeaux, is opening a client portal with document upload and e-signature. Her main enterprise client requires an audit report but does not mandate PASSI. She plans 2,500 EUR of prior hardening, a 7-day grey-box pentest at 1,200 EUR excl. VAT per day, i.e. 8,400 EUR, then 1,800 EUR of fixes and 1,200 EUR of retest. Total: 13,900 EUR excl. VAT. The same client would have accepted a PASSI report at about 11,000 EUR for the audit phase alone, i.e. 2,600 EUR more with no contractual benefit. She postpones the bug bounty to the following year, with a pool capped at 8,000 EUR.

FAQ

How much does a web app pentest cost in 2026?

Between 4,000 and 15,000 EUR excl. VAT for a grey-box client portal, over 3 to 10 days. A senior auditor's day rate ranges from 900 to 1,500 EUR excl. VAT.

Is PASSI certification mandatory?

Not for most SMEs. It is required by some public bodies, critical infrastructure operators or tenders, and usually costs 20 to 40% more than a standard pentest.

Does a bug bounty replace a pentest?

Rarely at the start. On a never-audited app, bounties pile up quickly, often 3,000 to 15,000 EUR in year one, while a pentest would have covered the same scope at a fixed price.

What is the OWASP Top 10?

It is the reference list of the ten most common risk categories in web applications, such as broken access control or injection. A serious pentest covers these categories and states so in its report.

How often should a pentest be repeated?

Once a year and after every major change, for example adding a payment module. A targeted 1 to 2 day retest is enough for a minor change.

Let's scope your project. We prepare your application before the audit and apply the fixes afterwards: send us your stack and the report or target scope for an indicative budget and a 1 to 4 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.