The verdict in three sentences
In London in 2026, a grey box penetration test of a web application costs GBP 5,000 to 20,000 for 5 to 15 days of testing, with the OWASP Top 10 as the minimum baseline. Enterprise security teams usually expect a CREST accredited provider, which sits at the upper half of that range. The real budget also includes remediation and a retest, which add 30 to 60% to the initial test price.
Black, grey or white box: which test to buy?
A scale-up CTO who must reassure an enterprise buyer does not need the longest test, but the one that produces a report the client's security team will trust. Grey box testing, where the tester gets user accounts for each role, is the standard format before launch.
| Test type | Information given to the tester | Typical duration | Indicative 2026 price (GBP) | Use |
|---|---|---|---|---|
| Black box | URL only | 4 to 8 days | 4,500 to 11,000 | Simulate an external attacker |
| Grey box | Test accounts per role, API documentation | 5 to 15 days | 5,000 to 20,000 | Standard before launch or signature |
| White box | Source code and architecture access | 10 to 20 days | 13,000 to 30,000 | Sensitive apps, health or financial data |
| Code review only | Source code | 5 to 10 days | 6,000 to 14,000 | Complement to a pentest |
| API test only | OpenAPI spec, tokens | 3 to 8 days | 3,500 to 11,000 | Back end consumed by partners |
| Automated scan | URL | Under a day | 0 to 1,500 | Continuous hygiene, never enough on its own |
These ranges are 2026 estimates observed in London, with day rates of GBP 1,000 to 1,400 for an experienced tester.
How many days for your application?
| Application profile | Grey box test days | Non-accredited provider (GBP) | CREST accredited provider (GBP) |
|---|---|---|---|
| Website with form and simple client area | 3 to 5 | 3,000 to 5,500 | 4,000 to 7,000 |
| B2B SaaS with 2 to 3 roles | 5 to 8 | 5,000 to 9,500 | 6,500 to 11,500 |
| Multi-tenant SaaS with public API | 8 to 12 | 8,000 to 14,000 | 10,000 to 17,000 |
| Platform with payments and sensitive data | 10 to 15 | 10,000 to 17,000 | 13,000 to 20,000 |
| Mobile app and its back end | 10 to 15 | 10,000 to 17,000 | 13,000 to 20,000 |
The number of roles, screens and API endpoints drives the duration. The most frequent findings on B2B SaaS remain broken access control (one client reads another client's data), injection and security misconfiguration, all at the top of the OWASP list.
After the report: fix and prove it
| Step | Timeline | Indicative cost | Owner |
|---|---|---|---|
| Debrief and prioritization of findings | 1 day | Included in the pentest | Tester and CTO |
| Fixing critical and high findings | 1 to 3 weeks | GBP 2,000 to 10,000 of development | Product team or contractor |
| Fixing medium findings | 2 to 6 weeks | Variable | Product team |
| Targeted retest | 1 to 3 days | GBP 1,200 to 4,000 | Same tester |
| Attestation letter for the client | Within 1 week | Included or GBP 300 to 800 | Tester |
If no team is available to fix findings quickly, Kolonell can take over the remediation as part of application maintenance, with plans at FCFA 35,000, 75,000 or 120,000 a month (about EUR 50, 110 or 180) depending on the volume of work, or on quote for a one-off batch of fixes.
Mini case study
Priya, CTO of a London scale-up selling an HR SaaS (illustrative profile), must provide a pentest report to a bank ready to sign a GBP 150,000 annual contract.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Grey box pentest of 9 days with a CREST accredited provider: 9 days at GBP 1,300, or GBP 11,700.
- Fixing 2 critical and 5 high findings: 8 days of development at GBP 600, or GBP 4,800.
- 2-day retest: GBP 2,600.
Total cost: GBP 19,100, about 13% of the first contract year. Without the report, signature slips by at least a quarter, or GBP 37,500 of delayed revenue.
FAQ
Is a CREST accredited provider mandatory?
No, unless the client, a regulator or a public sector buyer requires it explicitly. The premium, often 20 to 30%, is justified as soon as the enterprise security questionnaire mentions it.
How long before launch should the test be booked?
Book 3 to 6 weeks ahead: 1 to 3 weeks to get a slot, 1 to 2 weeks of testing, then time to fix. A test the day before launch leaves no room.
Can an automated scan replace a pentest?
No, it catches misconfiguration but rarely access control flaws between tenants. It costs GBP 0 to 1,500 and is a useful complement to an annual pentest.
How often should the test be repeated?
Once a year and after every major change, such as a new API or a payment module. Enterprise buyers often ask for a report less than 12 months old.
Should production be tested?
An identical staging environment is preferable to avoid altering real data. Plan 1 to 2 days to prepare test accounts for each role.
Let's scope your project. Send us the pentest report or the list of findings to fix, with your signature date: we will quote the remediation batch, an indicative budget and the timeline up to the retest. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
