The verdict in three sentences
A grey-box pentest of a web application costs 40,000 to 120,000 MAD excl. VAT (about USD 4,200 to 12,600) in 2026, for 5 to 15 days of testing. The real budget also includes fixes (20,000 to 60,000 MAD) and the retest, included by some vendors and billed at around 20% by others. A partner bank will ask for a final report with no open critical or high findings, so plan 6 to 10 weeks end to end. Figures come from the Moroccan market; Dubai rates typically run 1.5 to 2 times higher.
What drives pentest pricing
The CISO of a services company must have the client portal audited before signing with a bank. Price depends on scope (number of roles, APIs, user journeys), approach and auditor seniority. An experienced pentester's day rate in Morocco sits around 7,000 to 10,000 MAD (USD 740 to 1,050).
| Audit type | Description | Duration | Indicative 2026 price (MAD excl. VAT) |
|---|---|---|---|
| Automated scan | Tools only, no manual exploitation | 1 to 2 days | 8,000 to 20,000 |
| Black-box pentest | External attacker without access | 4 to 8 days | 30,000 to 70,000 |
| Grey-box pentest | Test accounts per role, business scenarios | 5 to 15 days | 40,000 to 120,000 |
| White-box pentest | Source code and architecture access | 10 to 20 days | 80,000 to 180,000 |
| API-only audit | REST or GraphQL endpoints, authentication | 3 to 6 days | 25,000 to 55,000 |
| Retest | Verification of fixes | 1 to 3 days | Included or 20% of pentest |
Grey-box is the format banks and insurers expect: it tests access controls between customers, the leading source of data leaks on a portal.
Full budget, from audit to final report
| Step | Duration | Indicative cost (MAD excl. VAT) |
|---|---|---|
| Scoping and rules of engagement | 1 week | Included |
| Grey-box testing (portal + API) | 2 weeks | 60,000 to 90,000 |
| Report and debrief | 1 week | Included |
| Fixes by the development team | 2 to 4 weeks | 20,000 to 60,000 |
| Retest and final report | 1 week | 0 to 18,000 |
| Total | 6 to 10 weeks | 80,000 to 168,000 (USD 8,400 to 17,700) |
The most frequent vulnerabilities remain those in the OWASP Top 10: broken access control, injection flaws, misconfiguration, outdated components. Code designed well from the start often halves remediation costs.
Choosing the right vendor
Ask for the methodology (OWASP WSTG, OWASP ASVS), recognised auditor certifications (OSCP, OSWE or equivalent), an anonymised sample report and a signed rules-of-engagement agreement. Check that the report scores each finding with CVSS and gives developers actionable recommendations. Data protection laws, Morocco's Law 09-08 or the UAE's PDPL, make a formal report even more valuable.
Mini case study
Mr Benjelloun, CISO of a 120-person services firm, must deliver a pentest report before a bank contract worth 2,400,000 MAD per year. He picks an 8-day grey-box pentest at 9,000 MAD per day, or 72,000 MAD, with retest billed at 20% (14,400 MAD). The audit finds 2 high and 6 medium issues, fixed in 12 development days at 3,500 MAD, or 42,000 MAD. Total budget: 128,400 MAD (about USD 13,500), roughly 5.4% of the first year of the contract it secures.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How much does a web application pentest cost?
For grey-box, count 40,000 to 120,000 MAD (USD 4,200 to 12,600) depending on roles, APIs and journeys. An automated scan costs 8,000 to 20,000 MAD but is not enough for a bank.
How long does a pentest take?
Testing itself takes 5 to 15 days. With scoping, fixes and retest, plan 6 to 10 weeks.
Is the retest included?
It depends on the vendor. Some include it within 60 days of the report, others bill about 20% of the initial price.
How often should we repeat a pentest?
At least once a year, and after every major release. A follow-up audit often costs 30 to 50% of the first one.
How much do fixes cost?
As a 2026 order of magnitude, 20,000 to 60,000 MAD for a mid-sized portal. Access control flaws take the longest to fix.
Let's scope your project. Describe your application, its roles and your client's deadline, and we will price the audit, fixes and retest within a 80,000 to 170,000 MAD budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
