The verdict in three sentences
A grey-box penetration test of a business web application costs EUR 6,000 to 15,000 (about GBP 5,100 to 12,800, excl. VAT) in London in 2026, for 5 to 10 days of testing depending on roles and APIs. You also need EUR 2,000 to 8,000 for fixes and around EUR 1,500 for a retest, a total budget of EUR 10,000 to 25,000. Compared with the average cost of a data breach, estimated at EUR 4.2 million in France and similar in the UK, it is the cheapest insurance in your project.
Black, grey or white box: which scope to choose
For a client portal exposing personal or financial data, grey box is the right balance: the tester receives test accounts for each role (client, account manager, administrator) and tests what a malicious authenticated user could do. Black box simulates an external attacker but often misses authorisation flaws, the leading cause of breaches in business applications.
| Test type | What the tester receives | Typical duration | 2026 price excl. VAT |
|---|---|---|---|
| Black box | URL only | 3 to 5 days | EUR 4,000 to 8,000 |
| Grey box (recommended) | accounts per role, API documentation | 5 to 10 days | EUR 6,000 to 15,000 |
| White box | source code, architecture | 8 to 15 days | EUR 10,000 to 22,000 |
| Code review only | source code | 4 to 8 days | EUR 5,000 to 12,000 |
| API test only (REST, GraphQL) | request collection, tokens | 3 to 6 days | EUR 3,500 to 9,000 |
| Retest after fixes | initial report | 1 to 2 days | EUR 1,200 to 2,000 |
A senior tester's day rate in London sits between EUR 1,000 and 1,500 (GBP 850 to 1,280), slightly more at CREST-accredited firms.
The standard: OWASP Top 10 and ASVS level 2
Require the report to be structured around the OWASP Top 10 and coverage to follow ASVS level 2, the recommended level for applications handling sensitive data. A serious report ranks each vulnerability by severity (CVSS score), provides proof of exploitation and a remediation your developers can act on.
| ASVS level 2 control | Example finding | Estimated fix effort |
|---|---|---|
| Access control (IDOR) | a client reads another client's invoices by changing an ID | 1 to 3 days |
| Authentication | no rate limiting, no admin MFA | 1 to 2 days |
| Session management | token still valid after logout | 0.5 to 1 day |
| Input validation | injection in a search filter | 1 to 2 days |
| File upload | executable file accepted | 1 day |
| Configuration and headers | missing CSP, exposed versions | 0.5 day |
| Logging | no trace of admin access | 1 to 2 days |
CREST or not: how to decide
In the UK, CREST accreditation (the counterpart of the French PASSI qualification) is required by many regulated buyers, public bodies and large clients through their supplier contracts. For a company opening a client portal without such a requirement, an experienced non-accredited tester with references and a written methodology is enough in most cases, at a 15 to 25% lower rate. Check professional indemnity insurance, a signed rules-of-engagement document and how data obtained during the test is handled. Schedule the test at least 4 weeks before go-live to leave time for fixes and a retest.
Mini case study
Sophie, CISO of a financial services SME in London, is about to open a portal where 12,000 clients view contracts and statements. She orders an 8-day grey-box test for EUR 10,400. The report finds 2 critical flaws (IDOR on statements, no admin MFA) and 6 medium ones. Fixes take 7 development days, EUR 5,600, and the retest EUR 1,500. Total: EUR 17,500. A breach exposing 12,000 financial records would cost, between ICO notification, crisis management, legal support and lost clients, several hundred thousand euros at the very least: the test is under 5% of that risk.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How much does a web application penetration test cost in 2026?
Budget EUR 6,000 to 15,000 for a 5 to 10 day grey-box test in London. Fixes add EUR 2,000 to 8,000 and a retest about EUR 1,500.
Do we need a CREST-accredited provider?
Not always, unless a regulator, public contract or major client requires it. CREST firms cost on average 15 to 25% more.
When should the pentest be scheduled?
At least 4 weeks before go-live, on a staging environment identical to production. That leaves 2 to 3 weeks for fixes and 1 week for the retest.
What should the report contain?
An executive summary, each flaw ranked by CVSS score with proof of exploitation, and a remediation recommendation. Expect 30 to 60 pages for a business application.
Should we pentest every year?
Yes for an application exposing sensitive data, and after any major release. A lighter annual test of 3 to 5 days costs EUR 4,000 to 7,500.
Let's scope your project. Describe your application, its roles and go-live date: we will organise a grey-box pentest and price the fixes with an indicative budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
