The verdict in three sentences
For a London SaaS vendor, an application pentest costs EUR 4,000 to 12,000 (about GBP 3,400 to 10,200) for 5 to 10 days of testing, depending on the number of roles, APIs and integrations. The real budget includes remediation, EUR 3,000 to 15,000, because a report without a fix plan reassures no buyer. With a recent report, MFA and encryption in place, you answer an enterprise security questionnaire in days instead of weeks.
What a pentest costs for your scope
Price depends on tester days, billed at EUR 900 to 1,300 in 2026 for SME engagements; CREST-accredited firms in London often sit at the top of that range. Here are the most common setups.
| Scope | Testing days | Indicative cost | For whom |
|---|---|---|---|
| Simple web app, 1 role | 4 to 5 days | EUR 4,000 to 6,000 | Internal tool, MVP |
| Multi-role SaaS, grey box | 6 to 8 days | EUR 6,500 to 9,500 | Vendor in sales phase |
| SaaS + public API | 8 to 10 days | EUR 8,500 to 12,000 | Client integrations |
| Companion mobile app | +3 to 4 days | +EUR 3,000 to 4,500 | Field apps |
| Retest after fixes | 1 to 2 days | EUR 1,000 to 2,500 | Required for attestation |
| Cloud configuration review | 2 to 3 days | EUR 2,000 to 3,500 | AWS, Azure, GCP hosting |
Grey box testing, where the tester has test accounts for each role, gives the best value: it checks authorisation flaws between tenants, the first concern of an enterprise buyer. The baseline framework is the OWASP Top 10, plus the OWASP API Security Top 10 if you expose an API. Many UK buyers specifically ask for a CREST accredited tester.
What the pentest finds, and what fixes cost
On an application built without security review, a typical report lists 10 to 25 vulnerabilities. The most frequent ones and their average fix cost:
| Common vulnerability | Typical severity | Fix cost | Lead time |
|---|---|---|---|
| Access to another client's data (IDOR) | Critical | EUR 1,500 to 4,000 | 1 to 2 weeks |
| No MFA on admin accounts | High | EUR 1,000 to 2,500 | 1 week |
| Long sessions, tokens not revoked | Medium | EUR 500 to 1,500 | 3 to 5 days |
| Sensitive data not encrypted at rest | High | EUR 1,500 to 4,000 | 1 to 2 weeks |
| Injection and input validation | Critical | EUR 1,000 to 3,000 | 1 week |
| Missing security headers and CSP | Low | EUR 300 to 800 | 1 to 2 days |
| Outdated vulnerable dependencies | Variable | EUR 1,000 to 3,000 | 1 to 2 weeks |
Depending on the starting point, total remediation sits between EUR 3,000 and 15,000. Prioritise critical and high findings before the retest, because the retest attestation is what the client will ask for.
Answering an enterprise security questionnaire
Procurement teams send questionnaires of 80 to 300 questions. The blockers are always the same: date of the last pentest (under 12 months), MFA, encryption in transit and at rest, tested backups, logging, UK or EU hosting, access management, incident response plan and often Cyber Essentials. Prepare a reusable 5 to 8-page security note: it cuts the time spent on each questionnaire by three.
Mini case study
Oliver, CEO of a construction site management SaaS in London (14 staff), is negotiating a EUR 85,000 a year contract with a construction group. The security questionnaire is a blocker: no pentest, no MFA.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
He orders a 7-day grey box pentest (EUR 8,000), targeted fixes (EUR 7,500: tenant data isolation, MFA, encryption of attachments) and a retest (EUR 1,500). Total: EUR 17,000 in 6 weeks. The contract is signed: the investment equals 20% of the first year from that single client, and the report is reused for the next three tenders.
FAQ
How often should you redo a pentest?
At least once a year, and after any major change such as a new API or a hosting move. Enterprise clients generally require a report less than 12 months old.
Is an automated scanner enough?
No. A scanner at EUR 100 to 300 a month finds known flaws but misses cross-tenant authorisation errors, which often make up more than 30% of a SaaS product's critical findings.
Do we need ISO 27001?
Not to get started. Certification costs EUR 25,000 to 60,000 in year one; a recent pentest and a written security policy are enough for most contracts under EUR 150,000 a year.
How long does the pentest itself take?
5 to 10 days of testing, plus 3 to 5 days for the report. Allow 6 to 8 weeks overall including fixes and retest.
Can the pentest disrupt production?
It is preferably run on an identical staging environment. If production is tested, destructive tests are excluded and scheduled outside business hours.
Let's scope your project. Describe your application, its roles and APIs: we scope the pentest, fixes and retest, between EUR 7,000 and 27,000 depending on scope, over 6 to 8 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
