The verdict in three sentences
For an SMB running a client portal or a SaaS, a web penetration test costs EUR 4,000 to 15,000 in 2026 (about USD 4,400 to 16,500), meaning 3 to 10 days of grey box testing at EUR 900 to 1,500 per day. Add a retest at EUR 1,000 to 3,000 and, above all, the remediation budget, often equal to the audit price. A provider with a government-recognised qualification (PASSI in France, CREST in the UK) costs 15 to 30% more but becomes essential if your customer is a regulated operator or public body.
What a pentest costs by scope
Price depends on the number of days, itself driven by application size: number of user roles, forms, API endpoints and sensitive functions (payment, data export, administration). Here are typical European ranges (2026 order of magnitude):
| Typical scope | Audit days | Price (EUR) | Example |
|---|---|---|---|
| Brochure site with form and back office | 2 to 3 days | 2,500 to 4,500 | CMS, admin area |
| Simple client portal (2 roles) | 3 to 5 days | 4,000 to 7,000 | member area, case tracking |
| B2B SaaS (3 to 5 roles, API) | 5 to 8 days | 6,500 to 12,000 | HR software, vertical CRM |
| SaaS with payment and multi-tenancy | 8 to 10 days | 10,000 to 15,000 | marketplace, fintech |
| Mobile app + related API | + 3 to 5 days | + 3,500 to 7,000 | iOS and Android app |
| Retest after fixes | 1 to 2 days | 1,000 to 3,000 | verification of fixed issues |
Grey box testing (the tester gets test accounts for each role) offers the best coverage for the price. Black box simulates an external attacker but leaves areas unexplored; white box, with code access, adds 30 to 50% to the budget.
The most common OWASP vulnerabilities and their remediation cost
The OWASP Top 10 structures most reports. On SMB applications, some flaws show up in almost every audit.
| Vulnerability (OWASP 2021) | Frequency in SMB audits | Typical severity | Estimated fix cost (EUR) |
|---|---|---|---|
| A01 Broken access control (IDOR) | 1 audit in 2 | critical | 1,500 to 6,000 |
| A05 Security misconfiguration (headers, CORS) | 3 audits in 4 | medium | 500 to 1,500 |
| A07 Authentication failures (no MFA, long sessions) | 1 audit in 2 | high | 1,500 to 4,000 |
| A03 Injection (SQL, stored XSS) | 1 audit in 4 | critical | 1,000 to 5,000 |
| A06 Vulnerable or outdated components | 2 audits in 3 | medium to high | 1,000 to 8,000 |
| A09 Insufficient logging and monitoring | 2 audits in 3 | medium | 2,000 to 6,000 |
| A10 SSRF on URL import or webhooks | 1 audit in 10 | high | 800 to 3,000 |
Rule of thumb: budget remediation at 80 to 120% of the audit price if the application has never been tested, and 30 to 50% for a second annual audit.
Qualified provider or not, and what the report must contain
A qualification such as PASSI (issued by France's ANSSI) or CREST guarantees method and confidentiality. It is required for critical infrastructure operators, often requested by banks, hospitals and public bodies, and optional for a typical private customer. An unqualified but experienced provider (OSCP, OSWE certifications) charges on average EUR 900 to 1,200 per day, against EUR 1,200 to 1,500 for a qualified firm.
A good report includes a management summary readable by an enterprise customer or insurer, a list of findings scored with CVSS 3.1, proof of exploitation, prioritised remediation advice and a retest certificate. Also require a one-hour debrief with your developers.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Tom, IT director of a 30-person HR software vendor in Manchester, must provide a pentest report to sign a EUR 180,000 per year contract with a retail group. He orders 6 days of grey box testing at EUR 1,100, or EUR 6,600. The report finds 2 critical issues (IDOR on payslip export, no admin MFA) and 5 medium ones.
Remediation takes 8 developer days at EUR 600, or EUR 4,800, followed by a EUR 1,500 retest. Total cost: EUR 12,900, or 7% of the contract's first year. Bonus: his cyber insurer cuts the annual premium by 10%, saving EUR 600 on a EUR 6,000 premium.
FAQ
What is the minimum price for a serious web pentest?
About EUR 2,500 to 4,000 for 2 to 3 days on a simple scope. Below that, it is usually an automated scan, which is not enough for an enterprise customer.
How often should a pentest be repeated?
Once a year and after every major change (new payment module, new API). Many cyber insurers ask for a report less than 12 months old.
Is an automated scan enough?
No. A scanner detects 30 to 40% of flaws, mostly configuration issues, but misses access control defects, the leading cause of data leaks.
Should we test in production?
Preferably on an identical staging environment with dummy data. Production testing is possible with an agreed window and a prior backup.
How long from order to report?
Plan 2 to 4 weeks of scheduling lead time, then 3 to 10 days of testing and 5 business days for the report.
Let's scope your project. Describe your application (roles, API, payment) and your customer's or insurer's requirement for a costed pentest scope and a realistic remediation budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
