The verdict in three sentences
A grey-box web application penetration test costs 8,000 to 20,000 EUR in Dublin in 2026, for 5 to 10 days of testing aligned with OWASP ASVS level 2. Budget another 3,000 to 10,000 EUR for fixes and a retest, because the retest report, not the first one, is what the enterprise buyer will want to see. If the buyer asks for SOC 2, know that it is a different project: a 6 to 12 month programme at 30,000 to 80,000 EUR, which usually includes an annual pentest rather than replacing it.
What a pentest costs by scope
Price depends on test days, which depend on attack surface: number of user roles, screens, API endpoints and integrations. An experienced tester's day rate in Dublin sits between 1,200 and 1,800 EUR, above most continental markets.
| Scope | Example | Test days | 2026 budget (EUR) |
|---|---|---|---|
| Brochure site or landing with form | 10 pages, no accounts | 2 - 3 | 3,000 - 5,000 |
| Simple web application | 2 roles, 20 screens, internal API | 5 - 6 | 8,000 - 10,000 |
| B2B SaaS platform | 4 roles, multi-tenant, 60 API endpoints | 7 - 8 | 10,000 - 14,000 |
| Platform with payments and integrations | SSO, Stripe, ERP, webhooks | 9 - 10 | 14,000 - 20,000 |
| Mobile app and related APIs | iOS, Android, back end | 8 - 12 | 13,000 - 22,000 |
| Retest | Verification of fixes | 1 - 2 | 1,500 - 3,500 |
Grey box (you provide test accounts for each role) offers the best value: it tests cross-tenant leaks, privilege escalation and business logic flaws that a black-box test often misses for lack of time.
Pentest, SOC 2 or ISO 27001: what the buyer really needs
Enterprise security questionnaires mix these terms. Here is how they compare for a scale-up.
| Option | 2026 cost (EUR) | Time to obtain | What it proves | Accepted by |
|---|---|---|---|---|
| Grey-box pentest | 8,000 - 20,000 | 4 - 8 weeks | The application resists attacks today | Most enterprise buyers as a first step |
| Pentest plus retest | 11,000 - 30,000 (with fixes) | 6 - 10 weeks | Findings were fixed | Enterprise procurement, insurers |
| SOC 2 Type I | 20,000 - 40,000 (audit plus tooling) | 3 - 5 months | Controls are designed correctly | US buyers, early stage |
| SOC 2 Type II | 30,000 - 80,000 per year | 6 - 12 months | Controls work over time | US enterprise, fintech |
| ISO 27001 certification | 25,000 - 60,000 first year | 6 - 12 months | An information security management system exists | European enterprise, public sector |
| Automated scanner only | 100 - 500 per month | Immediate | Known issues only | Almost no enterprise buyer |
Compliance platforms such as Vanta or Drata add 10,000 to 25,000 EUR a year but cut SOC 2 preparation time by half. Under NIS 2, transposed in Ireland, essential and important entities also push security requirements down to their suppliers.
Fixes: the forgotten budget
A first pentest on a never-audited platform typically finds 1 to 3 critical or high issues and 8 to 15 medium or low ones: tenant access control, injection, security headers, session handling, outdated dependencies. Fixing them takes 3 to 12 development days, i.e. 3,000 to 10,000 EUR depending on your internal or external rate. Schedule fixes in the sprint after the report and book the retest 2 to 4 weeks later, so you can share a final report with no open critical finding.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Thomas, CTO of a Dublin logistics software scale-up, must sign a 480,000 EUR a year contract with a national shipper whose security team requires a pentest under 6 months old with no critical finding. He orders an 8-day grey-box test at 1,450 EUR, so 11,600 EUR. The report lists 2 high and 11 medium findings: 7 days of fixes at 700 EUR, so 4,900 EUR. The one-and-a-half-day retest costs 2,200 EUR. Total: 18,700 EUR, or 3.9 % of the first contract year. Timeline: 3 weeks waiting, 2 weeks testing, 10 days for the report, 2 weeks of fixes, retest: about 9 weeks. A SOC 2 Type II would have pushed signature back by 6 months, so Thomas proposes the pentest now and SOC 2 on the 12-month roadmap.
FAQ
What is the difference between black, grey and white box?
In black box the tester starts with no access; in grey box they get accounts per role; in white box they also see the source code. Grey box covers a B2B application best for 8,000 to 20,000 EUR.
Does a pentest replace SOC 2?
No. A pentest checks the application at a point in time; SOC 2 audits your controls over 3 to 12 months and usually requires an annual pentest as one of those controls.
How often should we repeat a pentest?
At least once a year, and after any major change (new payment module, SSO, public API). Many enterprise buyers require a report under 12 months old.
Is an automated scanner enough?
No: at 100 to 500 EUR a month it finds known vulnerabilities and misconfigurations, but not business logic flaws or cross-tenant leaks, which are often the critical findings.
What should the pentest contract include?
A signed authorisation letter, the exact scope, professional indemnity insurance, report confidentiality, and the retest included or priced, typically 1,500 to 3,500 EUR.
Let's scope your project. Describe your platform, roles and your buyer's requirements, and we will scope the pentest, fixes and retest, 11,000 to 30,000 EUR in total, over 6 to 10 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
