The verdict in three sentences
A grey-box penetration test of a client extranet costs 5,000 to 12,000 EUR excl. VAT in Western European tech hubs such as Amsterdam or Toulouse in 2026, for 5 to 10 days of testing against the OWASP Top 10. The remediation budget, 3,000 to 15,000 EUR excl. VAT, is often forgotten even though it determines your answer to a key account's security questionnaire. An annual test, plus a retest after fixes, is the rhythm expected by buyers in aerospace, healthcare and banking.
Why a key account's questionnaire triggers the pentest
The IT director of a 300-employee mid-sized company receives an 80-question questionnaire from a major customer: « Has your extranet undergone a penetration test in the last 12 months? Provide the report summary and remediation plan. » Without an answer, supplier onboarding is frozen. The extranet exposes drawings, quotes and sometimes personal data: the risk is real, and it is now contractual.
| Test type | What the tester knows | Typical duration | Indicative cost excl. VAT |
|---|---|---|---|
| Black box | Only the public URL | 3 to 6 days | 3,500 to 8,000 EUR |
| Grey box | Test accounts for each role | 5 to 10 days | 5,000 to 12,000 EUR |
| White box | Accounts and source code access | 8 to 15 days | 9,000 to 20,000 EUR |
| Retest after fixes | List of fixed findings | 1 to 2 days | 1,000 to 2,500 EUR |
| Automated scan only | No special access | a few hours | 0 to 1,500 EUR |
| Bug bounty programme | Crowd of researchers | ongoing | variable, bounty per finding |
2026 order of magnitude, based on day rates of 900 to 1,300 EUR excl. VAT for a qualified tester. Grey box is the best trade-off for an extranet: the tester checks what a malicious authenticated client could do, which is the most likely scenario. An automated scan is not enough for a key account: it almost never catches access control flaws.
What a pentest usually finds, and what fixing costs
| OWASP Top 10 category | Extranet example | Observed frequency | Indicative fix cost excl. VAT |
|---|---|---|---|
| A01 Broken access control | A client reads another client's documents by changing an ID in the URL | very frequent | 1,500 to 5,000 EUR |
| A02 Cryptographic failures | Weakly hashed passwords, outdated TLS | frequent | 500 to 2,500 EUR |
| A03 Injection | Search field vulnerable to SQL injection | less frequent on modern frameworks | 1,000 to 4,000 EUR |
| A05 Security misconfiguration | Missing security headers, verbose error pages | very frequent | 300 to 1,500 EUR |
| A06 Vulnerable components | Libraries not updated for 3 years | frequent | 1,000 to 6,000 EUR |
| A07 Authentication failures | No two-factor authentication, sessions that never expire | frequent | 1,000 to 3,500 EUR |
The overall remediation range, 3,000 to 15,000 EUR excl. VAT, depends mostly on technical debt. A well-maintained app with up-to-date dependencies is fixed in a few days. An 8-year-old app on an abandoned framework may need a heavier upgrade, priced separately. Ask for a report that ranks each finding by severity (CVSS score) with a precise recommendation: that document, not just a certificate, is what the key account will request.
Typical plan and annual budget
| Step | Duration | Deliverable |
|---|---|---|
| Scoping, perimeter, test accounts | 1 week | Signed rules of engagement |
| Penetration testing | 1 to 2 weeks | Technical report and executive summary |
| Priority fixes (critical and high) | 2 to 4 weeks | Patched version in production |
| Retest | 2 to 3 days | Remediation attestation |
| Answer to the key account questionnaire | 1 week | Supplier security file |
In steady state, a mid-sized company can plan an annual budget of 8,000 to 20,000 EUR excl. VAT: one pentest, one retest and a remediation envelope. Choosing a provider holding a recognised certification (CREST, or PASSI in France) reassures public buyers and regulated operators, for a premium of 10 to 25 %.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Julien, IT director of a 300-employee aerospace subcontractor, must answer the security questionnaire of a customer worth 2.4 million euros of annual revenue. He orders a 7-day grey-box pentest for 8,400 EUR excl. VAT. The report flags one critical access control flaw and four medium findings; fixes cost 6,200 EUR excl. VAT and the retest 1,500 EUR. Total: 16,100 EUR, i.e. 0.67 % of the revenue from that single customer. The contract is kept, and the same file serves two other tenders. Hypothetical persona and amounts.
FAQ
What is the difference between a pentest and a vulnerability scan?
A scan is automated and costs 0 to 1,500 EUR; it spots outdated components and misconfigurations. A pentest, 5,000 to 12,000 EUR in grey box, adds a human tester who exploits business logic, especially access control flaws.
Do we have to shut the application down during the test?
No, but testing on a staging environment identical to production is recommended. If testing in production, plan a recent backup and a 5 to 10 day window announced to the teams.
Is one pentest a year enough?
It is the minimum most key accounts expect. Add a targeted 2 to 4 day test after each major change, such as a new payment module or a new partner access.
Does GDPR require a pentest?
Not by name, but Article 32 requires appropriate security measures and a process to test their effectiveness. After a breach, a pentest report under 12 months old and its remediation plan are useful evidence for the data protection authority, the Autoriteit Persoonsgegevens in the Netherlands.
Who fixes the findings, the tester or the developer?
The tester does not fix, to stay independent. Fixes belong to the development team, in-house or outsourced, which prices each item from the report, often 3,000 to 15,000 EUR excl. VAT in total.
Let's scope your project. Send us your pentest report or your customer's questionnaire, and we will price the fixes by severity with a compliance timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
