Web application penetration test before launch: cost and method

The verdict in three sentences

When an enterprise buyer demands a penetration test report before signing, the vendor has to think in calendar weeks as much as in budget: allow 4 to 8 weeks from purchase order to a clean retest report. A grey-box pentest of 5 to 10 days costs roughly GBP 900 to 1,400 a day in London and USD 1,500 to 2,500 a day in New York, so GBP 4,500 to 14,000 or USD 7,500 to 25,000, plus fixes and 1 to 3 retest days. For a six-figure contract, this rarely exceeds 10 to 15% of first-year revenue, and it often decides whether the deal closes.

Black, grey or white box: what enterprise buyers expect

Security teams at banks, insurers and large corporates almost always ask for a grey-box test: the tester gets user accounts at several permission levels, like an authenticated customer or a malicious insider. It is the best balance of realism and coverage.

The baseline is the OWASP Top 10, plus the OWASP API Security Top 10 if you expose an API. The findings that come up most often are broken access control (one user reaching another customer's data), injection, missing security headers and weak session handling.

What a pentest costs in London and New York in 2026

Rates depend on the provider's accreditation, application size and urgency. In the UK, buyers frequently require a CREST-accredited firm or CHECK-approved testers for public sector work. In the US, the report usually feeds a SOC 2 audit or a vendor security questionnaire.

Fixes are the least predictable line. A well-built application comes out with a handful of medium findings fixed in 3 to 5 days. An application that mixes customer data in one database without strict tenant isolation may need its access control rebuilt, which means 10 to 15 developer days.

From first report to retest: the method

The standard timeline has five steps. Preparation takes a week: written scope, test accounts, a staging environment identical to production, signed authorisation. Testing runs 5 to 10 working days. The report arrives within 5 to 10 days, with a CVSS score for each finding. Remediation takes 1 to 4 weeks depending on severity. The retest closes the loop with a short attestation you can send to the buyer.

Three precautions prevent surprises. Run a self-assessment first, with an automated scanner and a header review, so you are not paying GBP 1,200 a day for someone to find trivial issues. Freeze deployments during the test window. Ask at purchase for a two-part report: an executive summary for procurement and a technical section for your developers. If your application was custom built, plan remediation into the maintenance contract or as a dedicated work package; Kolonell includes this in its cybersecurity engagements, quoted on request.

Mini case study

Priya, CTO of a 25-person HR SaaS vendor in London, must deliver a pentest report to a bank ready to sign a GBP 150,000 a year contract. The chosen CREST firm quotes 7 days at GBP 1,150.

• Grey-box test: 7 × 1,150 = GBP 8,050.
• Fixes: 6 in-house developer days at GBP 650 loaded, plus GBP 4,000 of contractor work on tenant isolation, so GBP 7,900.
• Retest: 2 × 1,150 = GBP 2,300.
• Total: GBP 18,250, or 12.2% of the contract's first year.

The report stays usable for 12 months and also serves two insurance prospects, bringing the effective cost per contract to about GBP 6,080 if all three sign.

FAQ

How long is a pentest report valid?

Most enterprise buyers accept a report under 12 months old, provided no major rebuild has happened since. Beyond that, or after significant changes, plan a new 3 to 5 day test.

Do we need a CREST-accredited provider?

Not by law for a private vendor, but many UK banks and public bodies require it contractually. It usually adds 10 to 20% to the day rate.

Can we test directly in production?

It is possible with authorisation and safeguards, but an identical staging environment is better. A poorly controlled injection test on live data can corrupt customer records.

Isn't an automated scanner enough?

A scanner catches 30 to 40% of issues, mostly configuration. Cross-tenant access control flaws, the most serious for a SaaS product, are only found by manual testing.

What if the report reveals a critical flaw?

Fix it before anything else, usually within 5 working days, and order a 1-day targeted retest. Tell the buyer your timeline: transparency reassures more than a suspiciously clean report.

Let's scope your project. We scope the test perimeter, the remediation plan and the retest with you to hit your signing date. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.