The verdict in three sentences
A grey-box penetration test of a business web application exposed to your customers costs, as a 2026 ballpark, 4,000 to 12,000 EUR excl. VAT in London (about 3,400 to 10,300 GBP), for 5 to 10 days of testing. A CREST-accredited provider charges 20 to 40% more, which is justified if your clients, a public tender or a certification require it. Budget 2,000 to 8,000 EUR for fixes and a retest right now, otherwise the report stays a document with no effect.
Black, grey or white box: which scope to buy
The testing mode drives both the price and the value of the report. In black box, the tester has no access; in grey box, they get user accounts for different roles; in white box, they also read the source code. For a business application with a customer portal, grey box offers the best balance between cost and coverage, because most severe flaws (access control, privilege escalation) only show once logged in.
| Test type | Access provided | Typical duration | 2026 ballpark (EUR excl. VAT) | When to choose it |
|---|---|---|---|---|
| Black box | URL only | 3 to 5 days | 3,000 to 6,000 | Check external exposure |
| Grey box | Accounts for 2 to 3 roles | 5 to 10 days | 4,000 to 12,000 | Business app with customer portal |
| White box | Accounts and source code | 8 to 15 days | 8,000 to 18,000 | Sensitive data, finance, health |
| API-only test | OpenAPI documentation and tokens | 3 to 6 days | 3,000 to 7,000 | Mobile backend or partner API |
| Retest of fixes | List of findings | 1 to 2 days | 800 to 2,000 | Always after remediation |
| CREST-accredited provider | Depending on scope | Same | +20 to 40% | Contractual or regulatory requirement |
A senior tester's day rate in London sits around 900 to 1,300 EUR excl. VAT. Be wary of offers under 2,500 EUR for a full application: they are often an automated scan renamed as a pentest.
What the report must cover
The baseline reference remains the OWASP Top 10 (2021 edition, 2025 revision being adopted), complemented by OWASP ASVS to set a requirement level. A usable report ranks each flaw by severity (CVSS score), describes the proof of exploitation and proposes a concrete fix.
| OWASP category | Example in a business app | Observed frequency (ballpark) | Indicative fix cost (EUR excl. VAT) |
|---|---|---|---|
| Broken access control | A customer sees another's file by changing an ID | Very frequent | 1,000 to 3,000 |
| Cryptographic failures | Poorly hashed passwords, misconfigured TLS | Frequent | 300 to 1,200 |
| Injection | Search or filter vulnerable to SQL injection | Medium | 500 to 2,000 |
| Security misconfiguration | Missing security headers, debug mode on | Very frequent | 300 to 1,000 |
| Vulnerable components | Outdated libraries | Frequent | 500 to 2,500 |
| Weak authentication | No attempt limit, sessions too long | Frequent | 600 to 2,000 |
A first pentest on a never-audited application typically surfaces 8 to 20 findings, 1 to 4 of them critical or high. That is where the 2,000 to 8,000 EUR fix range comes from.
Prepare the test to pay less
Four preparations cut billed days and improve report quality:
- A staging environment identical to production, with dummy data, so the tester can work without risk.
- Test accounts for each role (customer, manager, administrator) delivered before day 1.
- A signed rules of engagement document: scope, dates, source IP addresses, emergency contact.
- A dependency scan and HTTP header review done upfront by the development team, so the tester spends billed days on logic flaws.
Mini case study
Hannah, CISO of a digital services company in London (illustrative persona), must have a contract tracking application used by 140 clients tested before go-live. She compares two offers.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Offer A, non-accredited provider: 7 grey-box days at 950 EUR, so 6,650 EUR excl. VAT.
- Offer B, CREST-accredited provider: 7 days at 1,250 EUR, so 8,750 EUR excl. VAT, required by two enterprise clients in their security assurance plan.
The two enterprise clients represent 180,000 EUR of annual revenue. The 2,100 EUR premium (about 32%) therefore equals 1.2% of the revenue it secures. She adds 4,500 EUR of fixes and 1,500 EUR of retest: a total budget of 14,750 EUR excl. VAT, scheduled over 6 weeks before launch.
FAQ
Is an automated scan enough before go-live?
No, a scanner mostly detects known flaws and misconfigurations, a limited share of the risk. Access control flaws, the most frequent category, require a human tester for 5 days or more.
How often should we repeat a pentest?
One test a year and after each major change (new payment module, new API) is common practice. For a highly exposed application, an annual budget of 6,000 to 15,000 EUR excl. VAT covers the test and retest.
What is the difference between CREST and a regular provider?
CREST accreditation guarantees an assessed methodology and certified testers. It is often required by regulated firms and public buyers and is billed 20 to 40% higher.
How long between ordering and receiving the report?
Allow 2 to 4 weeks of scheduling lead time at a London firm, then 5 to 10 days of testing and 3 to 5 working days of reporting. Plan the pentest at least 6 weeks before launch.
Who fixes the flaws found?
The application's development team, not the tester, to keep independence. Allow 3 to 10 development days depending on severity, then a 1 to 2 day retest.
Let's scope your project. Share your application scope and launch date: we will price test preparation, fixes and remediation with an indicative budget and schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
