The verdict in three sentences
A grey-box penetration test of an SMB web application costs EUR 4,000 to 12,000 for 3 to 8 days of testing covering the OWASP top 10, with a report your customer can act on. The real budget also includes the retest (EUR 1,000 to 2,500) and fixes (EUR 2,000 to 15,000), so EUR 7,000 to 30,000 in total in year one. A certified provider (CREST internationally, PASSI in France) is only mandatory in some regulated contexts, but it costs 20 to 40% more and reassures demanding buyers.
Audit levels and their price
2026 orders of magnitude in the Netherlands and France, for a mid-sized business web app (30 to 80 screens, 2 to 4 user roles, one API). A tester's day rate sits between EUR 1,000 and 1,500, EUR 1,200 to 1,700 at a certified provider.
| Audit level | What the tester does | Duration | Price |
|---|---|---|---|
| Automated vulnerability scan | Tools only, raw report, many false positives | 0.5 to 1 day | EUR 500 to 1,500 |
| Black-box pentest | Attack with no account, like an outsider on the Internet | 2 to 5 days | EUR 3,000 to 8,000 |
| Grey-box pentest | Attack with test accounts per role, full OWASP top 10 | 3 to 8 days | EUR 4,000 to 12,000 |
| Grey-box + API | Adds API testing (OWASP API Security top 10) | 5 to 10 days | EUR 7,000 to 15,000 |
| White-box with code review | Source code access, analysis of sensitive areas | 8 to 15 days | EUR 10,000 to 25,000 |
| Same scope at a certified provider | Accredited methodology and report | Same | +20 to 40% |
To satisfy a key customer, grey-box is the right trade-off: it tests what a malicious logged-in user could do, which is most of the risk for a B2B app (accessing another customer's data, privilege escalation).
The full budget: audit, fixes, retest
The audit fee is often only half the spend. Fixes depend on the number and severity of the flaws found.
| Item | Range | Comment |
|---|---|---|
| Scoping and rules of engagement | Included or EUR 500 | Scope, dates, test accounts, written authorisation |
| Grey-box audit | EUR 4,000 to 12,000 | 3 to 8 days depending on size |
| Fixing critical and high flaws | EUR 1,000 to 8,000 | Access control, injections, authentication |
| Fixing medium and low flaws | EUR 1,000 to 7,000 | Security headers, configuration, logging |
| Retest of fixed flaws | EUR 1,000 to 2,500 | 1 to 2 days, remediation certificate |
| Year-one total | EUR 7,000 to 30,000 | Following years often 30 to 50% cheaper |
The most frequent flaws on SMB apps in 2026 remain broken access control (OWASP A01), security misconfiguration (A05) and vulnerable, outdated components (A06).
Deliverables to demand
A useful report contains a one-page executive summary, the list of vulnerabilities ranked by severity (CVSS score), proof of exploitation, a precise fix recommendation and a prioritised action plan. Also ask for a certificate after the retest: it is often the document your customer actually wants to see. Finally, require a 1 to 2 hour debrief with your developers.
Mini case study
Thomas, IT director of an 80-employee SMB in Amsterdam, runs an order tracking portal used by his customers. A key account worth EUR 1,200,000 in annual revenue requires a yearly pentest before renewing the contract.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Grey-box audit: 5 days x EUR 1,200 = EUR 6,000.
- Result: 2 critical flaws (access to another customer's orders), 1 high and 5 medium.
- Fixes: EUR 7,500 of development, including EUR 4,000 to rebuild access control.
- Retest and certificate: EUR 1,500.
- Total: 6,000 + 7,500 + 1,500 = EUR 15,000, i.e. 1.25% of the annual contract secured.
The following year, Thomas budgets EUR 7,000: a 4-day audit and retest, since the structural fixes are already done.
FAQ
How much does a web app penetration test cost for an SMB?
For grey-box, budget EUR 4,000 to 12,000 for 3 to 8 days of testing. With fixes and retest, the year-one budget lands between EUR 7,000 and 30,000.
Do we need a certified provider?
Certifications such as CREST, or PASSI in France, are required by some public bodies, regulated operators or contracts that say so, notably under NIS2. For most private customers, an experienced non-certified provider is enough and costs 20 to 40% less.
Can an automated scan replace a pentest?
No, a EUR 500 to 1,500 scan finds known configuration flaws but misses business logic and access control issues. Those make up most critical flaws in a B2B application.
How often should we run a pentest?
Once a year and after every major change (new module, new API, authentication change). Follow-up audits often cost 30 to 50% less.
Can the pentest disrupt production?
The risk is low if testing targets a pre-production environment identical to production. Otherwise, time windows are agreed and denial-of-service tests are excluded in the rules of engagement.
Let's scope your project. Send us a description of your app (screens, roles, API) and your customer's requirement: we will scope a grey-box pentest between EUR 4,000 and 12,000, with fixes and retest priced separately, within 2 to 4 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
