The verdict in three sentences
A grey-box penetration test of a business web app costs 4,000 to 12,000 EUR excl. VAT in the Amsterdam area in 2026, for 5 to 10 audit days. The full budget ahead of a client security review or an ISO 27001 certification also covers fixes (2,000 to 8,000 EUR) and a retest (1,000 to 2,500 EUR). A CIO who budgets only the test itself underestimates the final bill by 40 to 60 %.
What drives the price of a pentest
Price depends first on tester days, and those depend on the attack surface: number of user roles, screens, exposed APIs and sensitive flows (payments, data exports, admin). A firm with CREST or OSCP-certified testers charges on average 900 to 1,400 EUR a day, against 650 to 900 EUR for an uncertified freelancer. For ISO 27001 or an enterprise client's security questionnaire, a specific certification is not always required, but it reassures both the certification auditor and the client, and helps with NIS2 supply chain requirements.
| Application scope | Audit days | Pentest budget excl. VAT | Report and debrief |
|---|---|---|---|
| Simple app, 2 roles, 20 screens | 4 to 5 days | 4,000 to 6,000 EUR | technical report and executive summary |
| Business app, 4 roles, REST API | 6 to 7 days | 6,000 to 9,000 EUR | report, exploitation proofs |
| Multi-tenant app with SSO | 8 to 10 days | 9,000 to 12,000 EUR | report, prioritised remediation plan |
| Companion mobile app | +3 to 5 days | +3,000 to 6,000 EUR | dedicated section |
| Exposed infrastructure test | +2 to 3 days | +2,000 to 3,500 EUR | service mapping |
| Retest after fixes | 1 to 2 days | 1,000 to 2,500 EUR | remediation letter |
Grey box, where the tester receives test accounts for each role, gives the best cost to coverage ratio for a business app. Black box needs fewer days but misses most authorisation flaws, which are precisely the most common.
Common vulnerabilities and cost to fix
On business apps built quickly, the same OWASP Top 10 categories show up in most reports. Fix cost depends on the architecture and the quality of the existing code.
| OWASP vulnerability | Observed frequency (order of magnitude) | Concrete example | Fix cost excl. VAT |
|---|---|---|---|
| A01 Broken access control | very common | a user reads another client's files by changing an ID | 1,500 to 4,000 EUR |
| A02 Cryptographic failures | common | weakly hashed passwords, cookies without Secure flag | 500 to 1,500 EUR |
| A03 Injection | medium | search filter concatenated into an SQL query | 800 to 2,500 EUR |
| A05 Security misconfiguration | very common | missing CSP headers, debug mode on in production | 300 to 1,000 EUR |
| A06 Vulnerable components | common | libraries not updated for 18 months | 500 to 2,000 EUR |
| A07 Weak authentication | medium | no rate limiting on login attempts | 500 to 1,500 EUR |
| A09 Insufficient logging | common | no trace of data exports | 800 to 2,000 EUR |
The remediation plan must rank each flaw by severity (critical, high, medium, low) and assign an owner and a date. Allow 2 to 6 weeks to fix critical and high findings, then the retest that produces the letter the ISO 27001 auditor expects.
Building the full budget
A careful mid-sized company in Amsterdam splits its security budget into three lines: the initial pentest, a fix envelope worth 50 to 70 % of the test price, and the retest. If a vendor maintains the app, check that the maintenance contract covers security updates. Kolonell's Premium maintenance at 120,000 FCFA (180 EUR) a month includes dependency updates and monitoring of known vulnerabilities.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Pieter, CIO of a mid-sized distribution company in Amsterdam, must hand a pentest report to a key account within three months. His app has 4 roles and a REST API: 7 days at 1,100 EUR, so 7,700 EUR excl. VAT. The report finds 2 critical access control flaws and 5 medium ones, fixed for 4,800 EUR. The retest costs 1,800 EUR. Total budget: 14,300 EUR, against a 380,000 EUR a year contract that depends on the report, or 3.8 % of the contract's annual value.
FAQ
Is a certified tester mandatory for ISO 27001?
No, the standard requires appropriate security testing, not a specific certification. A CREST or OSCP-certified tester costs 900 to 1,400 EUR a day and makes the discussion with the certification auditor and enterprise clients easier.
How long from order to report?
Count 2 to 4 weeks to book a tester, 5 to 10 days of testing, then 5 working days for the report. Plan 6 to 8 weeks in total.
Should we test production or staging?
Staging is better if it faithfully mirrors production, anonymised data included. Testing production requires a test window and the vendor's insurance, often 1 to 2 extra days of coordination.
How often should we repeat a pentest?
Once a year and after each major change, such as a public API or a payment module. A targeted 1 to 2 day retest is enough for a limited change.
Can we lower the cost of fixes?
Yes, by building security in from development: code review and automated dependency scanning cut the number of findings in a pentest by 30 to 50 %.
Let's scope your project. Send us your pentest report or your application scope: we price the remediation plan, the fixes and the time to retest. Detailed quote within 48 h. WhatsApp +221 77 596 93 33 or request a free quote.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
