The verdict in three sentences
A grey-box penetration test of a business web application costs $15,000 to $40,000 in New York in 2026, against €5,000 to €12,000 excl. VAT in Bordeaux, for 5 to 10 days of testing depending on functional scope. Add €3,000 to €10,000 (or $5,000 to $20,000 in New York) for remediation, often missing from the initial budget. For an insurer handling health data, choosing a qualified provider (CREST or OSCP-certified testers in the US, PASSI in France) and testing before go-live is the best cost-to-risk ratio available.
What a business application pentest covers
In grey box, the tester has test accounts with different roles (member, claims handler, administrator). They look for flaws those roles can exploit: access to another member's files, privilege escalation, injection, authentication bypass, leaking supporting documents. The methodology follows the OWASP Top 10 and OWASP ASVS.
| Test type | Content | Duration | Bordeaux price (excl. VAT) | New York price |
|---|---|---|---|---|
| Automated vulnerability scan | Tools, no manual exploitation | 1 to 2 days | €1,200 to €2,500 | $3,000 to $6,000 |
| Black-box pentest | External attacker, no account | 3 to 6 days | €4,000 to €8,000 | $10,000 to $25,000 |
| Grey-box pentest | Test accounts, multiple roles | 5 to 10 days | €5,000 to €12,000 | $15,000 to $40,000 |
| White-box pentest + code review | Source code access | 8 to 15 days | €10,000 to €20,000 | $30,000 to $60,000 |
| API-only test | REST or GraphQL endpoints | 3 to 5 days | €3,500 to €7,000 | $10,000 to $20,000 |
| Retest after fixes | Verify fixed findings | 1 to 2 days | €1,000 to €2,400 | $2,500 to $6,000 |
| Cloud architecture and configuration review | Network, IAM, encryption | 3 to 5 days | €4,000 to €7,500 | $10,000 to $20,000 |
New York firms typically bill $2,500 to $4,000 a day for senior testers, versus €1,000 to €1,400 for French PASSI-qualified providers. For a US insurer, HIPAA, the NYDFS Part 500 cybersecurity regulation and cyber insurers all push for documented annual testing.
Full budget: test, fixes and retest
| Item | Simple app (20 screens) | Medium app (50 screens, API) | Critical app (100 screens, health data) |
|---|---|---|---|
| Grey-box pentest | $15,000 (Bordeaux €5,000) | $25,000 (€8,000) | $40,000 (€12,000) |
| Fixes by the dev team | $5,000 (€3,000) | $12,000 (€6,000) | $20,000 (€10,000) |
| Retest | $2,500 (€1,000) | $4,000 (€1,400) | $6,000 (€2,400) |
| Hosting hardening | $1,000 (€500) | $3,000 (€1,500) | $6,000 (€3,000) |
| Total | $23,500 (€9,500) | $44,000 (€16,900) | $72,000 (€27,400) |
| Overall timeline | 3 weeks | 5 weeks | 7 to 8 weeks |
Schedule the test 4 to 6 weeks before go-live: qualified firms often have a 3 to 4 week booking lead time, and critical fixes must ship before members get access.
The cost of doing nothing
The average cost of a data breach in the US is estimated at around $9 million in recent industry studies, and healthcare is consistently the most expensive sector. In France the average sits around €3.9 million. For a regional insurer, add breach notification duties, regulator scrutiny, potential HIPAA or NYDFS penalties and lost member trust. A $40,000 test is under 0.5 % of that average risk.
Mini case study
Nathalie, CISO of a regional health insurer with 60,000 members, must sign off a new online reimbursement portal. She compares a New York firm and a French PASSI firm for an 8-day grey-box test.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- New York: 8 × $3,000 = $24,000, plus retest $4,000 = $28,000.
- Bordeaux PASSI firm: 8 × €1,200 = €9,600, plus retest €1,800 = €11,400 (about $12,300).
- Fixes found (2 critical, 5 medium): about $8,000 with her own dev team in either case.
- Total range: $20,300 to $36,000.
- A single critical flaw exposing 5,000 members' files could easily cost several hundred thousand dollars in notification, crisis management and penalties.
FAQ
How much does a web application pentest cost in New York in 2026?
Plan on $15,000 to $40,000 for a 5 to 10 day grey-box test. With fixes and a retest, the full budget ranges from about $23,500 to $72,000.
Do we need a certified provider?
It is strongly recommended when health or financial data is involved: look for CREST accreditation or OSCP/OSWE-certified testers. In France the equivalent is ANSSI's PASSI qualification.
What is the difference between black box and grey box?
In black box, the tester attacks with no account, like a stranger. In grey box, they get test accounts, which typically uncovers 2 to 3 times more application flaws.
How often should we retest?
At least once a year and after every major release. Many insurers budget $40,000 to $100,000 a year for application testing.
Does the report help with cyber insurance?
Yes, a recent pentest report with a retest can lower the premium or be a condition of cover. Keep it with the dated remediation plan.
Let's scope your project. Describe your application, its user roles and your go-live date, and we will propose a test scope, a remediation budget and a realistic schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
