The verdict in three sentences
A penetration test of a B2B web application costs 6,000 to 20,000 GBP in London in 2026, for 5 to 15 days of testing and a tester day rate of 1,000 to 1,500 GBP. The price depends almost entirely on scope: number of user roles, APIs and environments, not the size of your company. Plan from the start for 2 to 4 weeks of critical fixes and a retest, otherwise the report will not reassure your enterprise client.
What a pentest costs by scope
Enterprise buyers (banks, insurers, manufacturers) increasingly ask for a report less than 12 months old before signing. These are the market ranges seen in London.
| Scope (2026 market estimate, London) | Testing days | Budget excl. VAT | Report delay |
|---|---|---|---|
| Brochure site or landing page with form | 2 to 3 | 2,500 to 4,500 GBP | 1 week |
| SaaS app, 2 roles, no public API | 5 to 6 | 6,000 to 9,000 GBP | 1 to 2 weeks |
| SaaS app, 3 to 4 roles + REST API | 7 to 10 | 8,500 to 14,000 GBP | 2 weeks |
| Multi-tenant platform + public API + mobile | 10 to 15 | 12,000 to 20,000 GBP | 2 to 3 weeks |
| Retest after fixes | 1 to 3 | 1,200 to 4,500 GBP | 3 to 5 days |
| Source code review on top | 3 to 8 | 3,500 to 12,000 GBP | 2 weeks |
A 3,000 GBP pentest for a multi-tenant platform is usually an automated scan dressed up as a report. It will not pass a bank CISO's review.
Black, grey or white box: what to ask for
The choice of approach changes the outcome far more than the firm's name.
| Approach | What the tester receives | What it finds well | Recommended use |
|---|---|---|---|
| Black box | The URL only | External exposure, misconfigurations | Complement, rarely enough alone |
| Grey box | Test accounts per role | Access control, cross-tenant leaks, business logic | Standard for B2B SaaS |
| White box | Accounts + source code + architecture | Deep flaws, secrets, subtle injections | Sensitive data, health, finance |
| Methodology | OWASP Top 10 and OWASP ASVS level 2 | Coverage the client can verify | Require it in the proposal |
| Accreditation | CREST-certified provider (or CHECK for UK public sector) | Credibility with banks and public bodies | If your client requires it |
For B2B SaaS, a grey box test with one account per role and two separate tenants is the right compromise. The most frequent flaw remains broken access control (OWASP A01): a user from client A reading client B's invoice by changing an ID in the URL.
Preparing the app and fixing the flaws
A pentest needs preparation: a staging environment identical to production, dummy data, test accounts, an API list and a technical contact available during testing. Count 2 to 3 days of internal preparation.
Kolonell is not a penetration testing firm and does not issue pentest reports. Our role sits before and after: security review during development, CSP headers, secrets management, per-tenant access control, then fixing the flaws listed by the tester. The applications we build fall within our 2,500,000 to 15,000,000+ FCFA ranges depending on complexity (about 3,810 to 22,870 EUR), and continuous security follow-up runs through our maintenance plans at 35,000, 75,000 or 120,000 FCFA per month.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative example: Priya, CTO of an HR SaaS scale-up in London, must provide a pentest report to sign an enterprise contract worth 150,000 GBP per year. The grey box test is priced at 10 days at 1,200 GBP, i.e. 12,000 GBP excl. VAT, plus 2 days of retest at 2,400 GBP. The report lists 2 critical and 5 medium flaws, fixed in 12 development days, about 6,000 GBP of internal cost. Total: 20,400 GBP, i.e. 13.6% of the contract's first year. Without the report, the contract does not get signed. The same report will then serve 2 or 3 other prospects for 12 months.
FAQ
How long does a web application penetration test take?
Between 5 and 15 testing days depending on scope, plus 1 to 2 weeks for the report. Add 2 to 4 weeks of fixes and 1 to 3 days of retest.
Is an automated scan enough for an enterprise client?
No, a scanner mostly detects known flaws and misconfigurations. Business logic and access control flaws, which make up most critical findings on SaaS, require a human tester with test accounts.
Do we need a CREST-certified provider?
It is not a legal requirement, but many UK banks, insurers and public buyers ask for it. CREST-certified firms often charge 10 to 20% more than non-certified freelancers.
How often should we repeat a pentest?
At least once a year, and after any major overhaul of authentication or APIs. Many enterprise clients require a report less than 12 months old.
Can we test directly in production?
It is possible but risky: a test can create data or slow down the service. An identical staging environment costs a few dozen pounds a month in hosting and avoids that risk.
Let's scope your project. Send us your tester's report or your application scope: we will price the fixes and security upgrade with a 2 to 4 week plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
