The verdict in three sentences
A security audit paired with a penetration test (pentest) on a web application costs in 2026 from 5,000 EUR (narrow scope, black box) to 18,000 EUR (broad scope, gray box, API included). The pentest follows the OWASP Top 10 and delivers a report with severities and remediation. Budget 1 to 3 weeks and a retest to validate fixes, often required by contract with large accounts.
What a pentest really covers
A penetration test is not just an automated scan. It combines tools and human expertise to reproduce an attacker's behaviour: injection, broken authentication, data exposure, misconfiguration. Scope drives the price.
| Test type | Approach | Scope | Timeline | 2026 cost (EUR) |
|---|---|---|---|---|
| Scan + light audit | Automated + review | 1 application | 1 week | 5,000 - 7,000 |
| Black-box pentest | No internal access | App + auth | 1-2 weeks | 7,000 - 10,000 |
| Gray-box pentest | Accounts provided | App + roles + API | 2 weeks | 10,000 - 14,000 |
| Full audit | Code + infra + API | Full ecosystem | 2-3 weeks | 14,000 - 18,000 |
The most frequent vulnerabilities and their severity
The report ranks each flaw by severity and estimated remediation cost. Here are the OWASP categories most often found in 2026 on B2B applications.
| OWASP category | Frequency | Typical severity | Remediation (EUR) |
|---|---|---|---|
| Broken access control | Very frequent | High | 1,500 - 4,000 |
| Injection (SQL, XSS) | Frequent | High | 1,000 - 3,000 |
| Misconfiguration | Very frequent | Medium | 800 - 2,500 |
| Weak authentication | Frequent | High | 1,200 - 3,500 |
| Data exposure | Medium | Medium to high | 1,000 - 3,000 |
The retest after fixes is usually included in serious offers: it verifies that critical flaws are closed and provides the attestation requested by large-account clients.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Ms. Leroy, CISO of an industrial SME in Lyon, must secure a web-based sales management application before go-live, a condition set by a large-account client. She picks a gray-box pentest with test accounts and API: budget 12,000 EUR, 2-week timeline, retest included.
The report reveals 2 critical flaws (access control, authentication) and 5 medium flaws. Remediation is estimated at 8,000 EUR. Total security: 20,000 EUR. Against this, a single customer data breach would have cost, as an estimate, over 50,000 EUR between notification, loss of the large-account contract, and recovery, not counting reputational impact. The audit pays for itself the moment the first critical flaw is closed.
FAQ
What is the minimum price of a pentest? An automated scan completing a light audit on a single application starts around 5,000 EUR in 2026. For a real manual black-box test, budget closer to 7,000 EUR.
Black box or gray box? Black box simulates an external attacker with no access; gray box, with provided accounts, finds more flaws and costs 10,000 to 14,000 EUR. Large accounts often require gray box.
Is the retest included? In a serious offer, yes. The retest verifies that critical and high flaws are closed and delivers the expected attestation. Make it explicit in the contract.
How much does remediation cost? It depends on the number and severity of flaws: from 800 EUR for a misconfiguration to 4,000 EUR for access control to rebuild. Budget a separate envelope from the pentest.
How often should a pentest be redone? At least once a year and after every major change. Many large-account contracts require it annually with an up-to-date attestation.
Let's scope your project. Tell us the scope (application, API, roles), the test type, and your contractual constraints: we will price the audit and pentest, with an indicative budget of 5,000 to 18,000 EUR. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
