The verdict in three sentences
In Dublin in 2026, a grey-box penetration test of a web application costs, as an order of magnitude, 7,000 to 16,000 EUR excluding VAT for 5 to 10 tester days, depending on roles, APIs and integrations. The real pre-launch budget also covers remediation (3,000 to 12,000 EUR) and a retest (1,500 to 3,000 EUR), because US enterprise buyers ask for proof that critical findings are closed. If you are heading for SOC 2 or ISO 27001, an annual independent pentest is expected evidence, so scope it once to serve both the deal and the audit.
What to test before launch
A SaaS vendor in Dublin selling into the US typically meets the pentest question in a security questionnaire before signature. A poorly scoped test is expensive and reassures nobody: the buyer's security team will read the scope and limitations section first.
| Scope item | Example | Impact on tester days |
|---|---|---|
| Main web application | React front end, Node or Python back end | 3 to 5 days |
| Public or mobile API | 40 to 120 REST or GraphQL endpoints | +1 to 3 days |
| Roles and multi-tenancy | Admin, manager, user, tenant isolation | +1 to 2 days |
| Authentication | SAML SSO, OAuth, MFA, password reset | +0.5 to 1 day |
| Exposed infrastructure | Cloud, storage buckets, headers, TLS, subdomains | +1 day |
| Report and readout | Technical report, executive summary, call | 1 day |
Grey-box testing (the tester holds accounts for each role) is the best pre-launch compromise: it covers privilege escalation and cross-tenant data leaks, the risks that worry B2B buyers most. Black-box mostly tests the public surface; white-box adds code review and costs more.
Reference the OWASP Top 10 (broken access control, injection, misconfiguration, vulnerable components) in the statement of work, plus the OWASP API Security Top 10 if your product exposes an API. Ask for CREST-accredited testers if your US buyers name that requirement.
The full budget, from test to clean report
| Item | 2026 order of magnitude (Dublin, ex VAT) | Duration |
|---|---|---|
| Black-box test, public surface | 4,500 to 7,500 EUR | 3 to 4 days |
| Grey-box test, application and API | 7,000 to 16,000 EUR | 5 to 10 days |
| Grey-box test by CREST-accredited firm | 9,000 to 20,000 EUR | 5 to 10 days |
| Remediation by your team or an agency | 3,000 to 12,000 EUR | 1 to 4 weeks |
| Targeted retest of fixed findings | 1,500 to 3,000 EUR | 1 to 2 days |
| Continuous automated scanning (SaaS tool) | 100 to 500 EUR per month | Ongoing |
| Compliance automation platform for SOC 2 | 8,000 to 25,000 USD per year | Ongoing |
Allow 4 to 8 weeks overall: 1 to 3 weeks to book a reputable firm, one to two weeks of testing and reporting, then remediation and retest. A SOC 2 Type II audit itself sits on top, commonly 20,000 to 50,000 USD with the auditor.
On Kolonell's side, remediating findings on an application we build or take over, and supporting the pentest, are quoted after reading the report. Minor fixes can fit within a monthly maintenance plan (35,000, 75,000 or 120,000 FCFA per month, that is 53, 114 or 183 EUR).
Reading the report the way your buyer will
| Severity | Typical example | Enterprise buyer expectation |
|---|---|---|
| Critical | Access to another tenant's data (IDOR) | Fixed and retested before signature |
| High | SQL injection, MFA bypass | Fixed before production |
| Medium | No rate limiting on login | Dated remediation plan within 30 to 90 days |
| Low | Missing security headers | Fixed in the next release |
| Informational | Visible library version | No requirement |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Niamh Byrne, CTO of a 35-person HR SaaS company in Dublin, must hand a pentest report to a US retail group before signing a USD 200,000 a year contract. She books a 7-day grey-box test at 1,350 EUR a day: 9,450 EUR. The report lists 1 critical, 3 high and 6 medium findings.
Fixes take two developers 6 days, so 12 days at a loaded 550 EUR: 6,600 EUR. The retest costs 2,000 EUR. Total: 18,050 EUR, roughly 10 % of first-year contract value, and the same report feeds her SOC 2 evidence and the next three security questionnaires.
FAQ
How much does a web application pentest cost in Dublin in 2026?
As an order of magnitude, 7,000 to 16,000 EUR excluding VAT for a 5 to 10 day grey-box test. Day rates of established Irish firms typically range from 1,200 to 1,700 EUR.
Does SOC 2 require a pentest?
SOC 2 does not name it explicitly, but auditors and US buyers almost always expect an annual independent pentest as evidence. ISO 27001 Annex A controls on technical vulnerability management point the same way.
How early should the pentest be booked?
Ideally 6 to 8 weeks before go-live or signature. That leaves 1 to 3 weeks to secure a slot, 1 to 2 weeks of testing and time for remediation.
Can an automated scanner replace a pentest?
Not for an enterprise buyer: a scanner at 100 to 500 EUR a month finds known flaws but rarely business logic or tenant isolation errors. It complements the annual test well.
How often should we retest?
At least once a year, and after any major rework of authentication or permissions. Many SaaS vendors budget 10,000 to 20,000 EUR a year for this line.
Let's scope your project. Send us your pentest report or planned scope, and we will schedule remediation and the retest ahead of your signature date. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
