The verdict in three sentences
For a Riyadh financial services company, a grey-box penetration test of its customer application costs roughly 30,000 to 70,000 SAR in 2026, for 5 to 10 days of testing covering the OWASP Top 10. The forgotten budget is remediation, often 20 to 40 days of development, which can exceed the cost of the test itself. A useful audit before a regulatory review delivers a prioritized report, a costed remediation plan and an included retest that proves the fixes.
What the audit must cover before a regulatory review
The Essential Cybersecurity Controls (ECC) issued by the National Cybersecurity Authority require covered entities to run regular penetration tests on internet-facing systems. For a financial company, the SAMA Cyber Security Framework adds expectations on application security testing and evidence of remediation. The Personal Data Protection Law (PDPL), supervised by SDAIA, requires customer data to be protected against unauthorized access.
| Audit area | Checks performed | Estimated effort |
|---|---|---|
| Access control (OWASP A01) | Privilege escalation, access to other customers' accounts (IDOR) | 1 to 2 days |
| Cryptographic failures (A02) | Encryption of sensitive data, TLS, password storage | 0.5 to 1 day |
| Injection (A03) | SQL, command, API injections | 1 to 2 days |
| Configuration and components (A05, A06) | Security headers, vulnerable libraries, exposed services | 0.5 to 1.5 days |
| Authentication and sessions (A07) | Brute force, password reset, multi-factor authentication | 1 to 1.5 days |
| Logging and SSRF (A09, A10) | Traceability of sensitive actions, server-side requests | 0.5 to 1 day |
| Report and debrief | Executive summary, technical detail, remediation plan | 0.5 to 1 day |
| Total | Customer web application and API | 5 to 10 days |
Web application pentest prices in Riyadh in 2026
| Audit format | Duration | Indicative price | Use |
|---|---|---|---|
| Automated scan with review | 1 to 2 days | 8,000 to 15,000 SAR | Basic hygiene, not enough for a regulator |
| Black box | 4 to 6 days | 22,000 to 42,000 SAR | External attacker view |
| Grey box (test accounts provided) | 5 to 10 days | 30,000 to 70,000 SAR | Recommended for a customer application |
| White box with code review | 10 to 15 days | 65,000 to 110,000 SAR | Critical and payment applications |
| Retest after fixes | 1 to 2 days | Included or 5,000 to 12,000 SAR | Proof of remediation |
| Companion mobile app audit | 3 to 5 days | 18,000 to 35,000 SAR | If the app exists |
Grey box gives the best cost to coverage ratio: the tester has customer and advisor accounts, which makes it possible to test access controls between profiles, the leading source of data leaks in financial applications.
The remediation budget: plan 20 to 40 days
An audit of a business application built over several years typically finds 2 to 4 critical vulnerabilities, 5 to 10 high or medium ones and about ten minor weaknesses. Fixing them takes 20 to 40 days of development. At a Riyadh day rate of 2,000 to 3,000 SAR for a senior developer, the remediation budget sits between 40,000 and 120,000 SAR. It must be provisioned when the audit is ordered, with a timeline compatible with the review date.
Mini case study
Faisal, CIO of a financial services company in Riyadh, must present an audit of his customer portal before a review scheduled in 4 months. He chooses an 8-day grey-box test at 55,000 SAR, retest included. The report identifies 3 critical flaws (including access to other customers' statements) and 7 medium vulnerabilities, fixed in 28 days of development at 2,500 SAR, or 70,000 SAR. Total budget: 125,000 SAR. In comparison, a customer data leak would expose the company to PDPL penalties, mandatory notifications and a loss of trust costing far more. Timeline met: audit in week 2, fixes in weeks 3 to 9, retest in week 10. Illustrative case.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
What is the difference between a vulnerability scan and a penetration test?
A scan automatically detects known flaws in 1 to 2 days for 8,000 to 15,000 SAR. A penetration test adds manual exploitation, especially of access controls, which automated tools miss.
How long before the review should we start the audit?
Ideally 3 to 4 months ahead: 2 weeks for testing and the report, 6 to 8 weeks for fixes, then the retest. With less than 6 weeks, only critical flaws can be addressed.
Is the retest really necessary?
Yes, it proves to the regulator that flaws were fixed without regressions. It takes 1 to 2 days and should be included in the offer or priced separately at 5,000 to 12,000 SAR.
How often should an OWASP audit be repeated?
At least once a year for an internet-facing financial application, and after every major release. Many entities budget 40,000 to 80,000 SAR per year for this cycle.
Does the tester need local accreditation?
For critical national infrastructure and some regulated entities, using an NCA-licensed provider is expected. Check your obligations before signing, since licensed providers typically cost 15 to 30% more.
Let's scope your project. Tell us your application scope, the review date and your tech stack, and we will send a costed remediation plan, a fix budget and a realistic timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
