What does a code audit cost? Prices, cost drivers and what a fixed price must include

The short answer

There are hardly any published market prices for manual code audits. Because, like penetration tests, they are mostly billed by consultant days, in our assessment they usually end up at a four- to five-figure amount. The price is days multiplied by day rate.

Figures for penetration tests show how high these day rates are: in 2025 the trade press quoted typical day rates of €1,000 to €1,800 and a duration of two to ten days, which means total costs of roughly €2,000 to €18,000 (ChannelPartner, June 2025, in German). A calculation example, fictional: five days of testing at €1,200 come to €6,000 net, before a single finding has been fixed.

Our code audit costs €890 net at a fixed price, for applications of up to about 300,000 lines of code, delivered in 2 working days. This is not a loss leader but a different way of working: scanners and AI agents review the code in parallel, a second agent tries to refute every finding, and only what survives this cross-check goes into the report. Automation does the routine work that takes many days in a classic audit. The result is a price you know in advance.

To be honest, this also means: our code audit is not a penetration test and not a weeks-long manual review of every line. What it does and does not cover is set out further down.

What the price depends on

Five factors determine what a code audit costs. If you know them, you also understand why two quotes for the same application can differ considerably.

Amount of code

The most important cost driver is the amount of code. More lines mean more files, more dependencies and more possible paths. With day rates, the price grows almost linearly with scope. Our fixed price applies to applications of up to about 300,000 lines of code. If your application is larger, we tell you before you book and make a separate quote.

Languages and repositories

A single repository in one language is reviewed faster than a combination of frontend, backend, mobile app and several microservices. Every additional language brings its own tools, its own frameworks and its own typical errors. With every quote, ask which repositories and languages are included.

Depth of review

This is where quotes differ most. A pure tool run delivers a long list without context. A manual review by experienced reviewers is thorough but expensive. In between there are hybrid approaches. We combine tools with AI agents and a cross-check. In the full audit, an expert additionally signs off every finding.

Report format

An export from a scanner is not a report. A usable report rates every finding (for example by CVSS), shows the location with file and line, recommends a specific measure and sets priorities. A management summary makes it readable for management, customers or investors as well. This takes time and therefore belongs in the price.

Re-check

After the report, you fix the findings. Then you want to know whether the fixes work. Some providers bill this re-check as a new engagement, others include it. With us it is included in the full audit and can be booked as an add-on for the other packages.

Code audit, app audit, pentest: what costs what

The three methods are often confused, but they examine different things. The overview shows what you get with each.

A pentest is mostly manual work. An experienced tester attacks the application in a targeted way, chains small weaknesses together and shows what an attacker can actually achieve. That is valuable and has its price. We do not do pentests. If a customer or auditor explicitly asks for one, none of our packages replaces it. You can read the detailed comparison in Code audit or penetration test?

What the fixed price covers and what it does not

A low price rightly raises questions. So here is, openly, what the code audit contains:

• Secrets: API keys, passwords and tokens in the code and in the Git history
• Dependencies: packages with known vulnerabilities (CVEs) and outdated components
• Insecure patterns along the OWASP Top 10:2025, such as concatenated database queries, missing permission checks or weak cryptography
• Build and supply chain: CI/CD configuration, lockfiles, origin of packages
• Code quality: complexity, dead code, missing tests
• Report with location, CVSS rating and a prioritised action plan, plus the raw data of all tools

What it does not cover: it does not attack your running application, does not review server and network configuration and is not a load test. Business logic that only your team knows is recognised only as far as it is visible in the code. For that there is the app audit with test accounts, the combination in the full audit or, indeed, a classic pentest from a provider that specialises in it.

Fixed price or day rate?

Both models have their place. Day rates suit unclear scope, for example with very large or unusual systems. A fixed price suits clear scope and gives you planning certainty: you know the amount before you sign.

A fixed price is only as good as what it includes, though. Pay attention to these four points:

• Scope: Which repositories, languages and how many lines of code are included? What happens if there is more?
• Delivery time: When does it start, and by when is the report available? With us it is 2 working days from payment and complete handover of the code.
• Report: How extensive is it, how are findings rated, is there an action plan? The report in the full audit runs to about 25–30 pages, and every finding is rated by CVSS.
• Re-check: Is the re-verification of your fixes included, or is it a new engagement?

A fixed price without these details is a day rate with a different label.

Hidden costs

The price of the audit is rarely the largest item. Allow for these three costs:

• Fixing the findings: An audit finds problems, it does not solve them. Fixing them costs developer time, hours or days depending on the finding. A good action plan helps you start with the most important ones.
• Re-tests: If the re-verification is not included, you pay for it separately. With day rates, that can quickly be another day of testing.
• Internal time: Your team has to set up access, answer questions, read the report and set priorities. The clearer the report, the less time this takes.

A cheap audit with an incomprehensible report can end up more expensive than a good one with a clear action plan.

Is there funding?

As of November 2026. We only list programmes here that we have checked on the official website.

• Digitalbonus Bayern: The Free State of Bavaria funds small commercial companies with a business location in Bavaria, among other things for introducing or improving IT security. The grant is up to 50 per cent of eligible expenses, in the standard variant a maximum of €7,500; the programme runs until the end of 2027. Consulting is only funded together with the implementation of a solution, so an audit on its own is generally not eligible. The approving authority decides whether your project qualifies. Important: the application must be submitted before you place the order. Source: digitalbonus.bayern (in German)
• France, Diag Cybersécurité: For companies in France, the development bank Bpifrance subsidises a cyber diagnosis by an approved consultant at 50 per cent, subject to eligibility, for independent SMEs with more than ten employees. This is a consulting service of its own, not funding for a code audit. Source: diag.bpifrance.fr (in French)

Funding programmes change. Check the conditions on the official website before you apply.

Checklist: comparing quotes

Put these eight questions next to every quote. Ask about anything that is not answered.

1. What exactly is reviewed? Which repositories, languages and how many lines of code?
2. How is it reviewed? Tools only, AI-assisted, manual or a mix? Who cross-checks the results?
3. What is it reviewed against? For example the OWASP Top 10, with checks of dependencies and secrets?
4. What does the report look like? Is there a sample report? With location, rating and measure for each finding?
5. What does it cost in total? Fixed price or day rate, and how many days are planned?
6. When is the report available? When does the clock start?
7. Is a re-check included? If not: what does it cost?
8. What happens to your code? Where is it processed, when is it deleted, is there an NDA and a data processing agreement?

What we offer

Four packages with fixed prices, from a free external look to the complete audit:

• Security check: free, passive and external, result usually within 2 hours on working days
• App audit: automated tests with two test accounts, €490 net
• Code audit: the source code from inside, €890 net, for applications of up to about 300,000 lines
• Full audit: app and code, every finding additionally signed off by an expert, report of about 25–30 pages and re-check, €1,690 net

For the code audit and the full audit there is an Express option: report within 24 hours on working days, for a €230 net surcharge. The re-check can be booked as an add-on for the other packages.

All prices are net plus VAT. Our services are aimed exclusively at businesses.

Is your application larger, or are you unsure which package fits? Start with the free security check. It shows what is visible from outside, and afterwards we tell you which audit is worth it for you.