The verdict in three sentences
An enterprise customer asking for a security audit does not want a report, it wants proof that critical flaws are fixed. For a mid-sized business app in Toronto in 2026, budget USD 6,000 to 18,000 for an application pentest and USD 4,000 to 25,000 for fixes, depending on code quality. Budgets blow up when the pentest starts before two-factor authentication, audit logging and an OWASP Top 10 review are in place, and North American buyers increasingly expect a path toward SOC 2.
What the enterprise customer will check
The CEO of a 120-person services firm receives an 80-question vendor security questionnaire from a US customer worth 30 % of revenue. The shared client portal holds schedules, contracts and personal data. The checks fall into the same categories almost every time.
| Requirement | What is checked | Typical SME state | Effort to fix |
|---|---|---|---|
| Authentication | MFA, password policy, lockout | password only | 3 to 5 days |
| Access control (OWASP A01) | users see only their own data | guessable IDs in URLs | 5 to 10 days |
| Injection (OWASP A03) | parameterised queries, input validation | concatenated queries on 10 to 20 % of screens | 5 to 15 days |
| Vulnerable components (OWASP A06) | library versions | 2 to 4 years behind | 3 to 10 days |
| Logging (OWASP A09) | logins and sensitive actions logged, kept 12 months | server logs only | 3 to 6 days |
| Encryption | TLS 1.2+, sensitive data encrypted at rest | TLS fine, database in clear | 2 to 5 days |
| Backup and recovery | documented restore test | backups never tested | 1 to 3 days |
In Canada, PIPEDA requires safeguards proportionate to data sensitivity and mandatory breach reporting to the Privacy Commissioner when there is a real risk of significant harm. US customers add their own lens: a SOC 2 Type II report or, at minimum, a recent third-party pentest.
What the audit costs and what you get
Prices below are 2026 estimates from security firms in Toronto and the wider Ontario market for a medium web app (30 to 60 screens, 3 to 4 user roles).
| Service | Duration | Market price (2026 estimate) | Deliverable |
|---|---|---|---|
| Configuration review and automated scan | 1 to 2 days | USD 1,800 to 3,500 | raw vulnerability list |
| Grey-box pentest, web app | 4 to 8 days | USD 6,000 to 12,000 | report with CVSS ratings |
| Grey-box pentest, web app and API | 8 to 12 days | USD 11,000 to 18,000 | report with exploitation evidence |
| Targeted code review | 3 to 6 days | USD 4,500 to 9,000 | weaknesses in source code |
| Retest after fixes | 1 to 3 days | USD 1,500 to 4,000 | remediation letter |
| SOC 2 readiness (policies, tooling) | 2 to 4 months | USD 20,000 to 60,000 plus auditor | gap assessment, then Type I |
For most mid-market deals, a pentest by a recognised firm plus a retest letter unlocks the contract, with SOC 2 as a 12-month roadmap item.
Where Kolonell fits
Kolonell does not replace the independent tester: it hardens the app before the pentest and runs the remediation plan afterwards. If the app needs rebuilding, the custom grid applies: simple, 2,500,000 to 4,000,000 FCFA (EUR 3,810 to 6,100), medium, 4,000,000 to 7,000,000 FCFA (EUR 6,100 to 10,670), complex, 7,000,000 to 15,000,000+ FCFA (EUR 10,670 to 22,870+). Remediation-only work, security documentation and hardened hosting are quoted separately. Maintenance at 35,000, 75,000 or 120,000 FCFA per month (EUR 53, 114 or 183) includes regular dependency updates, the top source of new vulnerabilities. See our cybersecurity service.
A realistic calendar: 2 weeks of preparation (MFA, logs, updates), 1 to 2 weeks of pentest, 2 to 5 weeks of fixes, 1 week of retest, so 6 to 10 weeks.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Daniel, CEO of a facilities services firm in Toronto, books USD 12 M in revenue, USD 3.6 M of it with one US industrial customer that requires the audit before renewal. Budget: preparation USD 5,000, app and API pentest USD 14,000, fixes USD 11,000, retest USD 2,500, total USD 32,500.
Against the protected contract, that is under 1 % of annual revenue from that customer. The pentest finds 2 critical issues (access to another site's documents by changing an ID, injection in search), 5 high and 11 medium. Critical and high items are fixed in 3 weeks. The 3-year contract is renewed, and the same report later supports two other RFPs while SOC 2 readiness starts.
FAQ
Do we need a pentest every year?
For an internet-facing app that keeps changing, an annual pentest is what 70 to 80 % of enterprise questionnaires ask for. Between tests, a monthly automated scan costs a few hundred dollars.
Black box or grey box?
Grey box, with test accounts for each role, usually finds 2 to 3 times more access-control flaws in the same number of days. It is the best value for a business app.
Is MFA enough?
No. It mainly stops stolen-password attacks, behind more than 60 % of portal intrusions. Access control and injection flaws still have to be fixed in the code.
Do we need SOC 2 right away?
Rarely for a first deal. Most buyers accept a recent pentest plus a dated SOC 2 roadmap; Type II needs at least 3 to 6 months of evidence.
What if the report shows critical flaws?
Fix criticals within 1 to 2 weeks, then highs, then request a retest. Customers nearly always accept a dated plan over a perfect report.
Let's scope your project. Share your customer's questionnaire or your last pentest report, and we will scope hardening and remediation over 6 to 10 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
