The verdict in three sentences
When a UK enterprise or public sector buyer asks for security evidence, a grey-box web application pentest of 4 to 8 days is usually what they expect, at roughly GBP 4,000 to 12,000 in London. Many buyers specify a CREST-accredited testing company and Cyber Essentials Plus certification for your organisation, which are two different things and should be budgeted separately. Always reserve money for remediation and a retest, otherwise you hand over a report full of open findings.
Choosing the right test
A SaaS founder or a firm launching a client portal in London will meet the same sequence: a supplier security questionnaire, then a request for a recent independent pentest report. The type of test should match what the buyer needs to see.
| Test type | Tester access | Typical duration | Price (2026 market ballpark, London) |
|---|---|---|---|
| Black box | URL only | 3 to 5 days | GBP 3,500 to 8,000 |
| Grey box | Test accounts per role | 4 to 8 days | GBP 4,000 to 12,000 |
| White box with code review | Source code and architecture | 8 to 15 days | GBP 10,000 to 25,000 |
| Automated scan only | None | Under a day | A few hundred pounds |
| API-only test | Docs and tokens | 2 to 4 days | GBP 3,000 to 7,000 |
| Retest after fixes | Initial report | 0.5 to 2 days | GBP 500 to 2,000, sometimes included |
Grey box gives the best coverage per pound for multi-tenant B2B apps, because the most damaging real-world issues are logged-in users reaching another customer's data.
CREST, Cyber Essentials Plus and what buyers check
CREST accredits penetration testing companies and certifies individual testers, which gives buyers confidence in methodology and reporting. Cyber Essentials Plus is a government-backed certification of your own organisation's baseline controls, assessed by a certification body; it is frequently required in UK public sector contracts and many enterprise supplier lists. A pentest does not replace it, and Cyber Essentials Plus does not replace a pentest.
| What buyers look for | Why it matters |
|---|---|
| Executive summary | Readable by procurement, not just security |
| Exact scope and dates | Proves the tested version is the delivered one |
| Findings ranked by severity | Drives remediation priorities |
| Evidence of exploitation | Avoids arguments about whether an issue is real |
| Mapping to OWASP ASVS or OWASP Top 10 | Speaks the buyer security team's language |
| Retest results | Shows critical and high findings are closed |
| UK GDPR considerations | Confirms personal data exposure was assessed |
Under UK GDPR, you must protect personal data with appropriate technical measures, and a recent pentest is one of the clearest ways to evidence that to the ICO and to customers.
On the development side, Kolonell's prices for application maintenance are 114 EUR (Standard) or 183 EUR (Premium) a month, covering routine security updates; pentest remediation is quoted separately from the report. Kolonell does not perform CREST-accredited testing itself and works with the testing firm you or your buyer selects.
Mini case study
Illustrative example: Priya, co-founder of a London B2B compliance SaaS, needs a pentest report under 12 months old to close a GBP 150,000 three-year contract with a financial services firm.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
She orders a 6-day grey-box test at GBP 8,400. The report lists 1 critical finding (broken tenant isolation on an export endpoint), 3 high, 5 medium and 7 low. Remediation takes 5 developer days, about GBP 2,200 or 26 % of the test cost, and a one-day retest costs GBP 1,200. Total: GBP 11,800, under 8 % of contract value, plus a clean report she can reuse for every tender in the next year.
FAQ
How far before launch should we book the pentest?
Allow 4 to 6 weeks: 2 to 3 weeks to secure a slot, about a week of testing and 1 to 2 weeks for fixes and retest. CREST firms are often booked further ahead in the run-up to financial year end.
Should the test run against production?
Preferably against a staging environment identical to production, so customers are not disrupted. The report should name the exact build or version tested.
Is an automated scan enough for a UK enterprise buyer?
Rarely. A scan costing a few hundred pounds finds known vulnerabilities but misses access control logic flaws, which account for many critical findings in B2B apps.
How often should we retest?
At least annually and after major changes such as a new payment flow or public API. Most enterprise buyers ask for a report under 12 months old.
Is Cyber Essentials Plus expensive?
Certification fees for a small organisation typically run to a few thousand pounds (2026 estimate), with the cost depending on size and scope. The bigger effort is often fixing device and patching gaps before the assessment.
Let's scope your project. Send us your pentest report or your buyer's security requirements and we will price remediation, retest planning and ongoing security maintenance. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
