The verdict in three sentences
In London in 2026, securing a business web app before it scales costs 6 000-25 000 GBP for a penetration test and 4 000-15 000 GBP for a code audit, plus remediation of 20-40% of the budget. The baseline scope remains the OWASP Top 10, extended per your GDPR or ISO 27001 obligations. Against the cost of a breach (GDPR fine up to 4% of global turnover, plus reputational damage), an audit is cheap insurance.
Audit types and 2026 costs
| Audit type | Scope | Timeline | 2026 cost (GBP) |
|---|---|---|---|
| Black-box pentest | External surface, OWASP Top 10 | 3-5 d | 6 000 - 12 000 |
| Grey-box pentest | Accounts + business logic | 5-10 d | 10 000 - 25 000 |
| Code audit (SAST + review) | Source code, dependencies | 3-8 d | 4 000 - 15 000 |
| Architecture / cloud audit | Config, IAM, network | 3-6 d | 5 000 - 15 000 |
| GDPR / compliance audit | Data, consent | 4-8 d | 6 000 - 18 000 |
| Post-remediation retest | Fix verification | 1-3 d | 2 000 - 6 000 |
For a business app before scaling, the relevant combination is often grey-box pentest + code audit + retest, i.e. a total budget of 15 000-36 000 GBP. Cyber Essentials certification can be layered on top for supply-chain requirements.
Deliverables, remediation and cost of a breach
| Item | Detail | 2026 order of magnitude |
|---|---|---|
| Vulnerability report | CVSS severity, evidence | Included in audit |
| Prioritised remediation plan | Fixes by severity | Included |
| Remediation (dev) | Fixing the flaws | 20-40% of audit budget |
| Retest | Validating the fixes | 2 000 - 6 000 GBP |
| GDPR fine (breach) | ICO | Up to 4% of global turnover |
| Average data breach cost | Notification, churn | 50 000 - 500 000 GBP+ |
Remediation is the item companies forget: finding flaws is not enough, you must budget their correction and a validation retest.
Mini case study
Julie, CISO of a B2B SaaS SME in London (HR management app, 4,500 end users), is preparing to scale and onboard a large account demanding security evidence. She commissions a grey-box pentest (17 000 GBP) + code audit (8 000 GBP) + retest (3 500 GBP) = 28 500 GBP.
The audit reveals an injection flaw and a broken access control (HR data exposed across tenants). Remediation costs 9 000 GBP (32% of the audit budget), for a total of 37 500 GBP. Compared with a potential GDPR fine and the risk of losing an enterprise contract worth 200 000 GBP/year, the audit pays for itself with the first secured sale, while reassuring the enterprise client via a report and retest.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
What is the difference between a pentest and a code audit?
A pentest attacks the app like a hacker would (black/grey box); a code audit reads the source and dependencies. They are complementary: one finds what is exploitable, the other the root cause.
Is OWASP Top 10 scope enough?
It is the minimum baseline in 2026. Depending on your data, add business-logic tests, multi-tenant access-control tests and GDPR compliance checks.
How much does remediation really cost?
Budget 20-40% of the audit budget to fix the identified flaws, plus a retest of 2 000-6 000 GBP to validate.
How often should we audit?
At least once a year, and always before scaling, a major new release, or onboarding a client sensitive to security requirements.
What is the risk of skipping an audit if a breach happens?
A GDPR fine up to 4% of global turnover, plus notification cost, customer churn and lasting reputational damage, often far exceeding the price of an audit.
Let's scope your project. Tell us your stack, user count and obligations (GDPR, ISO 27001): we will scope the audit and remediation. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
