The short answer
A code audit examines your software from inside: it reads the source code and finds the cause of a vulnerability, with file and line. A penetration test examines it from outside: it attacks the running application and shows what an attacker can actually achieve.
Both methods find security vulnerabilities. Each one simply sees a different part of the problem.
What a code audit examines
In a code audit, the reviewer gets read access to the repository. They see everything an attacker can only guess at from outside:
- Secrets in code and Git history, such as API keys and passwords
- Dependencies with known vulnerabilities (CVEs) and outdated packages
- Logic errors in permissions that are only visible in the code
- Insecure patterns such as concatenated SQL queries or missing validation
- Code quality: complexity, dead code, missing tests, technical debt
The advantage: a code audit also finds vulnerabilities in paths that a tester working from outside never reaches. And every finding points directly to the place where your team has to start.
What a penetration test examines
In a penetration test, a tester attacks the running application, with your written authorisation and within an agreed scope. They see what the code alone does not reveal:
- Configuration of server, TLS, headers and cloud services
- Network and infrastructure around the application
- Chained attacks, where several small weaknesses add up to a large one
- Runtime behaviour, such as error messages, timing and session behaviour
The advantage: a pentest proves that a vulnerability can really be exploited and shows the impact. What is not reached within the testing time remains undiscovered, though.
Side by side
| Code audit | Penetration test | |
|---|---|---|
| Perspective | From inside, the source code | From outside, the running application |
| Prerequisite | Read access to the repository | Reachable environment and written authorisation |
| Result | Cause with file and line | Proof of exploitability and impact |
| Coverage | The entire code, including rarely used paths | What is reachable within the testing time |
| Duration | 2 working days | Often one to three weeks including planning |
| Cost | Code audit with us €890 net, fixed price | In the market usually four to five figures, depending on scope |
What a code audit costs, what the price depends on and how to compare quotes is covered in What does a code audit cost?
When you need which
A code audit first, if you develop software yourself or have it developed and want to know where you stand. Typical cases: you have taken over code from an agency, a large part of it was written with AI, the Cyber Resilience Act requires a bill of materials for your components (SBOM) from December 2027, or the budget is limited and you want to fix the biggest risks first.
A penetration test, if a customer or auditor requires it, for example within ISO 27001 or TISAX, where pentests are a common form of evidence, if infrastructure and configuration are the focus, or if a particularly critical system is going live.
Both, if the application is critical. The sensible order: the code audit first, which finds the causes at low cost. Then the pentest, which checks whether anything still gets through from outside. That way you do not pay the more expensive test to find errors that were obvious in the code.
Three common misunderstandings
- “We have a scanner, so that is a pentest.” An automated vulnerability scan is a good start. A pentest goes further: it chains weaknesses together and thinks like an attacker.
- “The pentest was clean, so the code is secure.” The pentest only shows what it reached within the testing time. Vulnerabilities behind a login the tester did not have remain invisible.
- “A code audit replaces the pentest.” No. It finds different things, and many of them earlier and at lower cost. If a customer explicitly requires a pentest, a code audit does not replace it.
What we offer
We do not carry out manual penetration tests or load tests. We review in an automated, AI-assisted way, and every finding is backed by its location:
- Security check: free, passive and external, result usually within 2 hours on working days
- App audit: automated tests with two test accounts, €490 net
- Code audit: the source code from inside, €890 net
- Full audit: app and code, every finding additionally signed off by an expert, €1,690 net
Our methodology shows how we proceed.
Is a launch coming up? Read what a security check before go-live covers.