The verdict in three sentences
A grey-box penetration test on a health platform costs between EUR 6,000 and 15,000 excl. VAT (about USD 6,500 to 16,200) in 2026, for 5 to 10 days of testing billed at EUR 1,000 to 1,400 per day. You must also budget EUR 3,000 to 12,000 for fixes and a retest, either included or billed at around EUR 1,500. To reassure a hospital group, a certified provider (PASSI in France, BSI-listed IS penetration testers or CREST in Germany and the UK) and a report aligned with OWASP ASVS matter more than price.
What hospitals actually expect
Certified health data hosting (HDS in France, C5-attested cloud in Germany) covers infrastructure, not your application code. Hospital IT departments therefore ask, before connecting your flows to their systems, for proof that the application itself holds up: access control between patients and professionals, isolation between facilities, strong authentication and API robustness. A security questionnaire of 80 to 200 questions often comes with the tender, and a pentest report less than 12 months old is its centrepiece.
| Test type | Typical scope | Days | 2026 price (EUR excl. VAT) |
|---|---|---|---|
| External black box | Internet surface, no account | 3 to 5 | 3,500 to 7,000 |
| Grey-box web application | Patient, clinician, admin accounts | 5 to 8 | 6,000 to 11,000 |
| Grey-box web + mobile API | Web app, REST API, iOS and Android app | 8 to 10 | 10,000 to 15,000 |
| Targeted code review | Authentication, permissions, encryption | 3 to 5 | 4,000 to 7,000 |
| Cloud configuration audit | Hosting accounts, IAM, backups, logs | 2 to 4 | 2,500 to 5,500 |
| Retest | Fix verification | 1 to 1.5 | 0 (included) to 1,500 |
For a platform with 40,000 patients, a web app, an API and a mobile app, the realistic scenario is around 9 to 10 days, i.e. EUR 11,000 to 14,000 excl. VAT.
Certified or not: the budget impact
A government-recognised certification guarantees a method, assessed auditors and secure handling of your test data. It is not mandatory for a private company, but it becomes decisive when facing a university hospital or a public tender.
| Criterion | Certified provider | Non-certified provider | Bug bounty platform |
|---|---|---|---|
| Day rate | EUR 1,200 to 1,400 | EUR 800 to 1,100 | Bounties of EUR 100 to 5,000 per flaw |
| Recognition by hospitals | Very strong | Medium | Weak as sole evidence |
| Formal report and action plan | Yes | Variable | No, individual reports |
| Health data confidentiality | Framed | Must be contracted | Tricky |
| Lead time | 3 to 8 weeks | 1 to 4 weeks | Immediate |
| Cost for 8 days | EUR 9,600 to 11,200 | EUR 6,400 to 8,800 | Unpredictable |
Fixes, the forgotten line item
A first pentest on a never-audited platform usually uncovers 2 to 5 critical or high vulnerabilities and 8 to 15 medium ones. The most frequent in healthcare: access to another patient's record by changing an identifier (IDOR), overly long session tokens, no multi-factor authentication for clinicians, unlogged CSV exports. Fixing costs range from EUR 3,000 (settings and headers) to EUR 12,000 when the permission model must be redesigned. The retest then confirms each flaw is closed, and that report is what you send to facilities.
Plan an annual renewal and a targeted test after each major change (new API, new teleconsultation module).
Mini case study
Julien is CTO of a care coordination platform (40,000 patients, 600 professionals) bidding for a hospital group contract worth EUR 180,000 per year in licences. The tender requires a pentest less than 12 months old.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Grey-box web + API pentest by a certified provider: 9 days at EUR 1,250 = EUR 11,250
- Fixes (3 high, 9 medium flaws): 6 days of in-house work, i.e. EUR 5,400
- Retest: EUR 1,500
- Total budget: EUR 18,150, about 10% of the contract's first year
Without this report, the bid would have been rejected at the eligibility check. The same report is then reused for two other prospected facilities.
FAQ
How long does it take to get the report?
Allow 3 to 8 weeks of lead time for a certified provider, 1 to 2 weeks of testing, then 5 to 10 working days for the final report.
Should we test in production?
Preferably on an identical staging environment loaded with dummy data. Testing in production with real health data requires strict contractual framing and a low-activity window.
Does a pentest replace certified health hosting?
No. Hosting certification covers the provider; the pentest assesses your application. Both are complementary and often requested together.
What frequency is reasonable?
One full test per year and a targeted 2 to 3 day test, i.e. EUR 2,500 to 4,000, after each major change.
What does OWASP ASVS add?
It is a standard of about 280 requirements across 3 levels. Targeting level 2 gives hospitals a clear grid that is comparable between suppliers.
Let's scope your project. Describe your platform, APIs and tender deadlines: we will scope the pentest, fixes and retest, from EUR 6,000 to 15,000 excl. VAT for the audit. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
