Web app pentest plus hardening
Technical audit with prioritized findings and implementation support.
Estimated investment
EUR 11,200
Range: EUR 6,300 – 16,800
Assumptions used in this scenario
- External + internal test
- OWASP focus
- 2 re-tests
- Management report
FAQ for this example
How should the range for “Web app pentest plus hardening” be read?
Technical audit with prioritized findings and implementation support. The stated range is EUR 6,300 – 16,800. It belongs to this case and is not a fixed quote.
Which assumption shapes “Web app pentest plus hardening” most?
The first lever is: External + internal test The other assumptions on this page move effort and sequence.
What follows “Web app pentest plus hardening”?
The interactive Security Audit calculator continues from this case. A call checks the assumptions against the real scope.
Related cost examples
- NIS2 readiness audit – Gap analysis with remediation roadmap and prioritization.
- ISO 27001 technical audit – Technical focus on controls, logging and access model.
- Red-team-lite program – Attack simulation with validation of defense processes.
- SaaS security baseline audit – Security baseline incl. IAM, secrets and logging.
All examples: More examples for Security Audit.
Typical pricing models (overview)
| Model | When it fits | Budget & flexibility | Typical risks |
|---|---|---|---|
| Fixed price (fixed scope) | Clearly defined scope, stable requirements, repeatable delivery. | Predictable total cost; little room for change without a change order. | Scope creep leads to change orders or quality trade-offs. |
| Time & Material | Discovery, legacy, evolving requirements, or close collaboration. | Maximum flexibility; budget transparent via hourly or daily rates. | Without prioritisation, effort can grow—backlog and reviews matter. |
| Retainer / maintenance package | Ongoing operations, updates, small features, and support. | Agreed capacity per month; predictable follow-on cost. | Large changes may still need a separate estimate. |
| Hybrid (milestone + T&M) | MVP or phased releases with clear go-lives, then iterate. | Core delivery fixed price; extensions on a time-and-materials basis. | Define contractually what is in scope vs. extra work. |
Calculators on this page provide indicative ranges; we choose the right model with you based on risk, scope, and planning horizon.
What determines the costs, and what comes next?
The ranges shown are indicative. For a binding quote we discuss scope, priorities and funding options in a free intro call. Many digitalization projects qualify for grants – try our funding calculator.
Browse all cost calculators, explore services and typical solutions. Questions about security audit? Contact us.
The calculator result for security audit is indicative only – a binding budget follows scope alignment, data review, and quality targets.
Plan follow-on costs
- Operations and maintenance separate from the initial build
- Internal key users and training
- Monitoring and support after go-live
Next steps after the calculator
- Intro call: funding and phased delivery
- Discovery, pilot, or rollout matched to risk
- Documented assumptions and exclusions in the quote
Compare related calculators in the costs hub for edge cases (integrations, compliance, parallel run).