How much does a security audit cost? Prices and what affects them
By Shayan Parsai · Published · 2 min read
With me, a website check starts at $1,200, a code review of one app at $3,900 and a full audit at $8,500, all at a fixed price. On the wider market, automated scans sell for about $99, while manual reviews are usually priced by the day. The size of the code and the number of systems set the price.
Lessons from this story4 points ▾
- Fixed prices beat hourly billsAsk for a fixed price before work starts. You know the cost from day one, and the consultant carries the risk of a slow review.
- A scan is a different productA scan for $99 finds known problems in known places. It can’t judge whether one customer can read another customer’s orders.
- Scope sets the priceMore code, more user roles and more integrations take more time, so a smaller first scope can bring the price down a lot.
- Count the fixes as wellA report you can’t act on is worth little. Check whether fixes and a retest are included, or how they’ll be charged later.
What it costs with me
| Service | Price | Time |
|---|---|---|
| Website check | from $1,200 | 1–2 days |
| Code review | from $3,900 | About a week |
| Full audit | from $8,500 | 2–3 weeks |
| Security watch | $500 a month | Ongoing |
You get a fixed price before anything starts. Fixes after the report are quoted separately, or I brief your team so they can do them.
What affects the price
- How much code there is, and how much of it handles logins, payments or personal data.
- How many user roles the system has, since every role needs its permissions checked.
- How many outside services it connects to, such as payments and email.
- Where it runs. A single site on one server takes less time than an app across several cloud services.
What others charge
Automated audits for small apps are sold from about $99. A secure code review listed on the UK government’s marketplace costs £750 a day. Swedish vendors quote about SEK 15,000–60,000 for a web application test. These are vendors’ own figures, so use them as a rough guide.
What this means for your site
The cheapest way to start is usually the smallest useful scope: a website check, or a code review of the part that handles logins and payments.
Contact meSources
Latest hacks
Binance
$6.3 billionMost of it moved in about 20 minutes. It may have begun with one laptop.
Node2Shell
Node.js 22, 24, 26A flaw in the Brotli decoder inside Node.js. On CISA’s list of exploited flaws.
PHP2Shell
7 in 10 websitesTwo critical PHP flaws under active attack, CISA confirms. Patched 21 October.