The verdict in three sentences
A grey-box penetration test of a business web application costs EUR 4,000 to 12,000 in 2026 (about USD 4,400 to 13,000), meaning 5 to 10 days billed at EUR 900 to 1,300 per day; New York boutique firms often quote USD 1,200 to 2,000 per day. Add EUR 2,000 to 15,000 in fixes depending on findings and EUR 1,000 to 2,500 for a retest, essential to obtain a letter an insurer or enterprise client will accept. Require a methodology aligned with the OWASP Top 10 and, if your clients are regulated, testers with recognised accreditation (CREST, or PASSI for French clients).
Black, grey or white box: which test and at what price
The test mode changes coverage. For an application open to authenticated customers, grey box offers the best coverage for the cost: the tester gets test accounts at several permission levels.
| Test type | Information provided | Typical duration | 2026 price |
|---|---|---|---|
| Black box | URL only | 3 to 5 days | EUR 3,000 to 6,500 |
| Grey box | User and admin accounts | 5 to 10 days | EUR 4,000 to 12,000 |
| White box | Accounts + source code | 8 to 15 days | EUR 9,000 to 19,500 |
| API only (REST, GraphQL) | Docs + tokens | 3 to 6 days | EUR 3,000 to 7,800 |
| Companion mobile app | APK, IPA + accounts | 4 to 8 days | EUR 4,000 to 10,400 |
| Retest of fixed findings | Initial report | 1 to 2 days | EUR 1,000 to 2,500 |
Accredited firms usually bill at the top of the range, around EUR 1,100 to 1,300 per day. For an SME without regulatory obligations, a firm whose testers hold OSCP or OSWE certifications often delivers comparable quality at EUR 900 per day.
The OWASP Top 10 grid and the cost of fixes
The report ranks each finding by severity. Fixes are the most variable budget line, so plan for them.
| OWASP Top 10 category | Common SME example | Indicative fix cost |
|---|---|---|
| A01 Broken access control | A customer sees another's invoices by changing the ID | EUR 1,500 to 5,000 |
| A02 Cryptographic failures | Passwords hashed with MD5 | EUR 800 to 2,500 |
| A03 Injection | Search field vulnerable to SQL injection | EUR 1,000 to 4,000 |
| A05 Security misconfiguration | Missing security headers, debug mode on | EUR 400 to 1,500 |
| A06 Vulnerable components | Framework not updated in 3 years | EUR 1,500 to 8,000 |
| A07 Authentication failures | No rate limiting, no MFA | EUR 1,000 to 3,500 |
| A10 Server-side request forgery (SSRF) | URL import without filtering | EUR 800 to 3,000 |
On an application built without security review, expect 6 to 12 vulnerabilities on average, 1 to 3 of them critical. Hence the EUR 2,000 to 15,000 range.
Security clauses to require in your development contracts
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Pentesting costs less when security is contracted upfront. Three useful clauses: free fixing of critical and high findings attributable to the vendor for 12 months, explicit compliance with OWASP ASVS level 2, and delivery of an up-to-date software bill of materials (SBOM). For enterprise clients, attach the executive summary, the retest letter and the dated remediation plan to your security questionnaire.
Mini case study
Daniel, IT director of a 60-person SME in New York that runs a fleet management portal for trucking customers, must answer a cyber insurer's questionnaire and an enterprise logistics client's security review. He orders a 7-day grey-box pentest at EUR 1,050 a day, EUR 7,350. The report lists 9 findings, 2 of them critical (A01 and A06). Fixes cost EUR 6,800 and the retest EUR 1,500. Total: EUR 15,650 (about USD 17,000). On the other side: the cyber insurance premium drops by EUR 1,800 a year thanks to the letter, and the enterprise contract is worth EUR 140,000 in annual revenue, conditional on this report.
FAQ
How often should we retest? At least once a year, and after every major change (new payment module, opening an API). A targeted annual retest often costs 30 to 50% of the initial test.
Can a pentest break production? The risk is low but real. Testing preferably happens on an identical staging environment; otherwise intrusive tests are scheduled outside business hours with a backup less than 24 hours old.
Is an automated scanner enough? No. A scanner at EUR 100 to 300 per month finds known vulnerabilities and misconfigurations, but not business logic flaws such as accessing another customer's data, which often account for 40% of critical findings.
Do we need an accredited provider? It is mandatory for some critical infrastructure operators and often required by large public-sector clients. For an SME without such clients it is a plus, not an obligation, at a 15 to 25% premium.
What does the report contain? An executive summary, each finding with proof, its CVSS score and a fix recommendation. Expect 30 to 60 pages for a business application.
Let's scope your project. Describe your application, its user roles and your clients' requirements: we will price the pentest, fixes and retest within a EUR 7,000 to 25,000 envelope, on a 4 to 8 week schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
