The verdict in three sentences
A grey-box penetration test of a business web application costs about USD 7,000 to 16,000 (EUR 6,000 to 14,000) in 2026, for 5 to 10 days of testing depending on the number of roles and APIs. Budget another USD 3,500 to 9,300 for fixes, because a test without remediation reassures no enterprise client. Insist on a retest included and a report structured on the OWASP Top 10, reusable in your vendor due diligence and in NIS2 questionnaires from European customers.
Defining scope: what moves the price
The CISO of a Singapore precision engineering firm must prove the security of its customer portal before a contract with a large aerospace client. The vendor questionnaire asks for a pentest report under 12 months old, with critical vulnerabilities fixed. Price depends first on what is tested.
| Scope item | Effort impact | Price effect (USD) |
|---|---|---|
| App with 2 roles, 30 screens | Base 5 days | 7,000 to 8,100 |
| Each extra role (admin, partner) | +0.5 to 1 day | +700 to 1,400 |
| Exposed REST API (50 endpoints) | +1 to 2 days | +1,400 to 2,800 |
| File upload, PDF generation | +0.5 day | +700 |
| SSO or multi-factor authentication | +0.5 day | +700 |
| Exposed infrastructure (servers, DNS, TLS) | +1 day | +1,400 |
| Report in a second language for a foreign client | +0.5 day | +700 |
Grey-box testing is the right trade-off for a business app: the tester gets test accounts for each role, which lets them hunt for the costliest flaws, such as a user accessing another customer's orders. Pure black-box finds less for the same budget, and white-box with code review costs 30 to 50% more.
What the test looks for and what fixes cost
| OWASP Top 10 category | Example on a customer portal | Typical fix (USD) |
|---|---|---|
| Broken access control | Changing an ID in the URL shows another customer's invoice | 900 to 2,900 |
| Cryptographic failures | Passwords hashed with SHA-1, TLS 1.0 enabled | 450 to 1,400 |
| Injection | Search field vulnerable to SQL injection | 600 to 1,700 |
| Security misconfiguration | Verbose error messages, missing CSP headers | 350 to 900 |
| Vulnerable components | Framework not updated in 3 years | 1,200 to 4,600 |
| Weak authentication | No login attempt limiting | 450 to 1,200 |
| Insufficient logging | No trace of access to sensitive data | 700 to 1,700 |
On a business app that is 4 to 6 years old, testers typically find 2 to 4 high or critical vulnerabilities and 8 to 15 medium ones. The USD 3,500 to 9,300 fix budget covers this common case. Beyond that, the report often reveals deeper technical debt that should be handled as a separate project.
| Step | Duration | Deliverable |
|---|---|---|
| Scoping and rules of engagement | 1 week | Signed scope, test windows, accounts |
| Penetration testing | 5 to 10 days | Exploitation evidence |
| Report | 3 to 5 days | Executive summary, technical detail, CVSS scores |
| Fixes | 2 to 4 weeks | Patched code, regression tests |
| Retest | 1 to 2 days | Remediation attestation |
Mini case study
Wei Ling, CISO of a 400-employee firm in Singapore, receives a pentest quote of USD 11,400 for 8 days (3 roles, one API, exposed infrastructure). The test finds 3 high-severity flaws, including broken access control on delivery notes, and 11 medium ones. Fixes cost USD 6,300 and the retest is included. Total: USD 17,700. The target contract is worth USD 1,400,000 a year: the test represents 1.3% of year one and is a condition for onboarding.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Isn't an automated scan enough?
No, a USD 600 scanner finds outdated components and misconfigurations, but almost never access control flaws. Yet those have topped the OWASP Top 10 since 2021.
Do we need a CREST-accredited tester?
For regulated sectors such as financial institutions under MAS TRM guidelines, often yes, and the price rises 20 to 40%. For a private enterprise client, an experienced tester with a documented OWASP methodology is usually enough.
Can the test break production?
The risk is low when testing runs on an identical staging environment. Otherwise, we set test windows and exclude destructive actions in the rules of engagement.
Does the report help with NIS2 or similar frameworks?
Yes, it documents the assessment of security measure effectiveness that NIS2 asks of European suppliers and that Singapore's Cybersecurity Act ecosystem increasingly expects. Renewed every 12 months, it also shows your progress.
Who fixes the flaws if another vendor built the app?
We can fix them ourselves after a short 1 to 2 day code takeover, or hand a detailed report to your team. The retest stays included either way.
Let's scope your project. Describe your application, its roles and your client's requirement, and we will price the test between USD 7,000 and 16,000 plus the related fixes. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
