Security Testing · April 28, 2026 · 14 min read

Penetration Testing in 2026: The Complete Guide for European Businesses

Q: Is penetration testing required under NIS2?

NIS2 (effective October 2024) requires 'essential' and 'important' entities to implement appropriate security measures including regular security testing. While penetration testing is not explicitly mandated by name, it is the standard method for fulfilling the risk assessment and vulnerability management requirements. Regulators in Germany, France, and the Netherlands have issued guidance recommending annual pentests.

Q: What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated — tools like Nessus or OpenVAS check for known CVEs and misconfigurations. A penetration test goes further: a human tester attempts to exploit discovered vulnerabilities to assess real business impact. Scans find what might be broken; pentests prove what can actually be compromised.

With NIS2 now fully enforced and GDPR fines reaching record levels, the question for European businesses is no longer whether to test their security posture — it's how to do it right. This guide covers everything you need to know: methodologies, legal obligations, realistic cost expectations, and how to evaluate a penetration testing provider.

Henrik Schulz

Senior Security Consultant · WebGuard Agency · April 28, 2026

📋 TL;DR — Key Takeaways

✅NIS2 effectively mandates annual security testing for essential and important entities
✅Web app pentest: €3,500–€8,000. Full infrastructure: €12,000–€40,000
✅Always require a penetration test report with CVSS scores, not just a vulnerability scan output
✅Retest after remediation to close the evidence loop for regulators and insurers

What Is Penetration Testing?

A penetration test (pentest) is an authorised, simulated cyberattack against your systems, carried out by security professionals to discover exploitable vulnerabilities before malicious actors do. Unlike automated vulnerability scanning, a penetration tester brings human creativity and adversarial thinking — chaining together seemingly low-risk findings into critical attack paths that no automated tool would detect.

The key distinction:

Aspect	Vulnerability Scan	Penetration Test
Execution	Automated	Human-led
Depth	Known CVEs & misconfigs	Chained exploits, business logic flaws
Output	List of potential vulnerabilities	Proven impact with evidence
Duration	Hours	Days to weeks
Regulatory value	Low	High (accepted by NIS2 auditors)

Penetration Testing Methodologies

The three main engagement types serve different objectives:

Black Box

The tester starts with zero internal knowledge — simulating an external attacker. Best for testing your perimeter defences and detection capabilities. Least efficient in terms of coverage per day-rate spent.

Grey Box

The tester receives partial information (user credentials, architecture diagrams). The most common and cost-effective approach for web applications and internal network assessments.

White Box

Full access to source code, architecture documentation, and credentials. Maximum coverage. Ideal for pre-production code reviews, API security testing, and NIS2 compliance evidence.

NIS2 and GDPR: Legal Requirements in 2026

The NIS2 Directive (transposed into national law across EU member states by October 2024) introduces a clear obligation for “essential” and “important” entities to implement appropriate and proportionate technical measures to manage cybersecurity risks. Article 21 specifically calls out vulnerability handling and testing of security measures as required capabilities.

Practically, this means regulators in Germany (BSI), France (ANSSI), and the Netherlands (NCSC-NL) now expect annual third-party security assessments as evidence of compliance. A professionally conducted penetration test — with a signed scope document, written findings report, and remediation tracking — is the standard way to meet this bar.

Under GDPR, a penetration test also strengthens your Article 32 defence: demonstrating that appropriate technical measures are in place to protect personal data. In the event of a breach, companies that can show they regularly test their security typically receive significantly lower fines.

Get your penetration test scoped in 24 hours

Our certified testers (OSCP, CREST) assess your attack surface and deliver a written scope with fixed-price quote within one business day.

Request a fixed-price pentest quote

Cost Breakdown: What to Budget in 2026

Engagement Type	Typical Duration	Cost Range
Web Application (single app)	3–5 days	€3,500–€8,000
External Network Assessment	2–4 days	€4,000–€9,000
Internal Network Assessment	5–10 days	€8,000–€18,000
Full Infrastructure + Web	10–20 days	€12,000–€40,000
Red Team Engagement	4–12 weeks	€50,000+

Prices vary by provider certification (CREST-accredited firms command a premium), scope complexity, and required retest. Always include a retest in your budget — a pentest without remediation verification is incomplete evidence for regulators.

How to Evaluate a Penetration Testing Provider

Certifications: CREST, OSCP, OSCE, GPEN. Avoid providers who list only vendor certifications (CompTIA Security+) as their main credential.
Sample report: Always request a redacted sample report. It should include CVSS scores, proof-of-concept screenshots, and clear remediation guidance — not just a list of CVE numbers.
Scoping process: A professional provider scopes before pricing. Avoid fixed-price quotes without a scoping call.
GDPR data handling: Confirm where test artifacts (credentials, traffic captures) are stored and deleted post-engagement.
Retest included: The engagement should include at least one retest cycle to verify critical findings are resolved.

5 Red Flags in a Pentest Report

⚠️ Findings section is a raw Nessus or Qualys export — no manual analysis, no context, no business impact.

⚠️ No executive summary — makes the report unusable for board-level or regulator conversations.

⚠️ CVSS scores without contextualisation — a CVSS 9.8 that requires authenticated LAN access is not the same risk as an internet-facing CVSS 7.

⚠️ No proof-of-concept evidence — a claimed critical finding without a screenshot or PoC payload cannot be verified by your team.

⚠️ Boilerplate remediation guidance copy-pasted from OWASP — not adapted to your tech stack.

Frequently Asked Questions

How much does a penetration test cost in Europe in 2026?

A web application penetration test starts at €3,500–8,000 for a single application. Full infrastructure pentests range from €12,000 to €40,000. Enterprise red team engagements start at €50,000. Most SMEs find the best ROI in a focused web app pentest at €5,000–8,000.

Is penetration testing required under NIS2?

NIS2 requires appropriate security measures including regular testing. While not mandated by name, penetration testing is the industry standard for fulfilling risk assessment and vulnerability management obligations. German (BSI), French (ANSSI), and Dutch (NCSC-NL) guidance recommends annual pentests.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated — it checks for known CVEs. A penetration test is human-led: testers exploit vulnerabilities to prove real business impact. Scans find what might be broken; pentests prove what can actually be compromised and demonstrate the blast radius.