The verdict in three sentences
For a customer-facing application exposed to the Internet, a 5 to 10 day grey-box pentest (EUR 5,000 to 15,000) before launch is the best risk-to-cost ratio of the whole project. An accredited provider (CREST in the UK, PASSI in France) is only mandatory in some regulated contexts, but it reassures enterprise buyers. Budget the retest (EUR 1,500 to 3,000) and 3 to 8 days of developer fixes from day one, otherwise the report just sits in a drawer.
What a web app pentest costs in 2026
Pricing is based on tester days, between EUR 900 and 1,500 a day in Western Europe depending on seniority and accreditation. UK CREST-accredited firms sit in a comparable day-rate band.
| Audit type | Days | 2026 budget | Typical use |
|---|---|---|---|
| Automated scan + light manual review | 1 to 2 | EUR 1,500 to 3,000 | brochure site, simple back office |
| Black-box pentest (no account) | 3 to 5 | EUR 3,500 to 7,000 | public surface only |
| Grey-box pentest (test accounts per role) | 5 to 10 | EUR 5,000 to 15,000 | customer app, extranet, SaaS |
| Grey-box + mobile API | 8 to 12 | EUR 9,000 to 18,000 | web and mobile apps sharing one API |
| Accredited provider (CREST, PASSI) | + 15 to 30% | EUR 7,000 to 20,000 | public sector, critical infrastructure, sensitive data |
| Retest after fixes | 1 to 2 | EUR 1,500 to 3,000 | proof of remediation for the end client |
| Targeted code review (auth, payment) | 2 to 4 | EUR 2,500 to 6,000 | on top of the pentest |
These figures are a 2026 order of magnitude for the European market. Grey-box is the most cost-effective format before launch: the tester gets one account per role (customer, manager, admin) and checks what a malicious logged-in user can do.
The flaws that actually show up
On business applications tested before launch, the same OWASP Top 10 categories keep coming back.
| Flaw | Observed frequency | Real example | Fix effort |
|---|---|---|---|
| Broken access control | very common | a customer reads another customer's invoice by changing the ID in the URL | 1 to 3 days |
| Injection (SQL, commands) | less common with an ORM | unparameterised search field | 0.5 to 2 days |
| Exposed configuration | common | .env file, admin console or public storage bucket reachable | 0.5 to 1 day |
| Weak authentication | common | no rate limiting, no admin MFA | 1 to 2 days |
| Sensitive data in clear text | medium | tokens or ID documents stored unencrypted | 1 to 3 days |
| Vulnerable components | common | dependencies not updated for 18 months | 0.5 to 2 days |
Broken access control comes first because no automated scanner catches it: you need a human who understands the business rules.
How to scope the pentest so you do not pay for nothing
- Freeze a version in staging, with realistic but anonymised data.
- List roles and critical journeys: login, payment, data export, user management.
- Ask for an actionable report: CVSS severity, proof of exploitation, remediation advice per finding.
- Plan 2 to 3 weeks between the report and go-live to fix and retest.
- Plan recurrence: a yearly pentest or one per major release, often required by enterprise contracts and cyber insurers.
Mini case study
Tom, CIO of a 600-employee distribution company in Leeds, is opening a customer portal for orders, invoices and credit notes. He orders a 7-day grey-box pentest at EUR 1,200 a day, i.e. EUR 8,400, plus a 2-day retest at EUR 2,400. Internal fixes take 5 developer days, about EUR 3,000 internal cost. Total: EUR 13,800.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
The report reveals broken access control on invoices: any logged-in customer could download those of the 4,000 other accounts. A breach of that kind for a mid-sized company, between regulator notification, crisis management and lost customers, is estimated at EUR 50,000 to 300,000. The pentest costs less than 30% of the best-case scenario.
FAQ
Is a pentest mandatory before go-live?
No law imposes it on every company, but GDPR and UK GDPR require appropriate security measures and the NIS 2 directive has tightened duties for many EU entities since 2024. In practice, 7 enterprise tenders out of 10 ask for a recent pentest report.
Do I need a CREST or PASSI accredited provider?
Only in some regulated contexts (government, critical infrastructure, some public tenders). For a private SME, an experienced non-accredited provider is often 15 to 30% cheaper for a comparable report.
How long does a web app pentest take?
5 to 10 testing days for a typical customer application, plus 3 to 5 days for reporting. Allow 4 to 6 weeks from order to final retest.
Is an automated scanner not enough?
A scanner at EUR 100 to 300 a month spots vulnerable components and misconfigurations. It does not detect business logic flaws such as broken access control, which account for most serious incidents.
What should I do with the report?
Fix critical and high findings first, retest, then keep the report and retest letter. They serve your customers, your cyber insurer and your GDPR records.
Let's scope your project. We prepare your application for the audit, coordinate the grey-box pentest and fix the findings before launch, with a firm budget and schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
