How much does a code audit cost? Prices, cost drivers and what a fixed price must include

The short answer

There are hardly any published market prices for manual code audits. Because, like penetration tests, they are mostly billed in consultant days, in our assessment they usually end up at four to five figures. The price is days times day rate.

Figures for penetration tests show how high these day rates are: German trade press reported typical day rates of 1,000 to 1,800 euros in 2025 and a duration of two to ten days, so total costs of roughly 2,000 to 18,000 euros (ChannelPartner, June 2025, in German). A fictitious example: five review days at 1,200 euros come to 6,000 euros net before a single finding is fixed.

Our code audit costs €890 net at a fixed price, for applications of up to about 300,000 lines of code, delivered in 2 business days. That is not a teaser price but a different way of working: scanners and AI agents review the code in parallel, a second agent tries to refute every finding, and only what survives this cross-check goes into the report. Automation handles the routine work that eats up many days in a traditional audit. The result is a price you know in advance.

To be honest, that also means our code audit is not a penetration test and not a weeks-long manual review of every line. What it covers and what it does not is explained below.

What drives the price

Five factors decide what a code audit costs. Knowing them also explains why two quotes for the same application can be far apart.

Size of the codebase

The biggest cost driver is the amount of code. More lines mean more files, more dependencies and more possible paths. With day rates, the price grows almost linearly with size. Our fixed price applies to applications of up to about 300,000 lines of code. If yours is larger, we tell you before you book and make a separate offer.

Languages and repositories

A single repository in one language is reviewed faster than a set of frontend, backend, mobile app and several microservices. Every additional language brings its own tools, frameworks and typical mistakes. Ask which repositories and languages each quote includes.

Depth of review

This is where quotes differ most. A plain tool run produces a long list without context. A manual review by experienced auditors is thorough but expensive. Hybrid approaches sit in between. We combine tools with AI agents and a cross-check. In the full audit, an expert additionally approves every finding.

Report format

A scanner export is not a report. A useful report rates every finding (for example with CVSS), shows its location by file and line, recommends a concrete fix and sets priorities. A management summary makes it readable for executives, customers or investors. That takes time and belongs in the price.

Re-check

After the report you fix the findings. Then you want to know whether the fixes work. Some providers bill this re-check as a new engagement, others include it. With us it is included in the full audit and available as an add-on for the other packages.

Code audit, app audit, pentest: what costs what

The three methods are often confused, but they check different things. The overview shows what you get with each.

A pentest is mostly manual work. An experienced tester attacks the application deliberately, chains small weaknesses and proves what an attacker can actually achieve. That is valuable and has its price. We do not do pentests. If a customer or auditor explicitly requires one, none of our packages replaces it. The detailed comparison is in code audit or penetration test?

What the fixed price covers and what it does not

A low price rightly raises questions. So here is openly what the code audit includes:

• Secrets: API keys, passwords and tokens in the code and the Git history
• Dependencies: packages with known vulnerabilities (CVE) and outdated components
• Insecure patterns along the OWASP Top 10:2025, such as concatenated database queries, missing permission checks or weak cryptography
• Build and supply chain: CI/CD configuration, lockfiles, origin of packages
• Code quality: complexity, dead code, missing tests
• Report with location, CVSS rating and a prioritised action plan, plus the raw data of every tool

What it does not do: it does not attack your running application, does not check server and network configuration and is not a load test. Business logic that only your team knows is visible to us only as far as it shows in the code. For that there is the app audit with test accounts, the combination in the full audit, or a classic pentest by a provider who specialises in it.

Fixed price or day rate?

Both models have their place. Day rates fit when the scope is unclear, for example with very large or unusual systems. A fixed price fits when the scope is clear and gives you certainty: you know the amount before you sign.

A fixed price is only as good as what it includes, though. Look for these four points:

• Scope: which repositories, languages and how many lines of code are included? What happens if there is more?
• Delivery time: when does it start, and when is the report ready? With us 2 business days from payment and complete handover of the code.
• Report: how detailed is it, how are findings rated, is there an action plan? The full audit report has around 25–30 pages, every finding rated with CVSS.
• Re-check: is the review of your fixes included or a new engagement?

A fixed price without these details is a day rate with a different label.

Hidden costs

The price of the audit is rarely the largest item. Plan for these three costs:

• Fixing the findings: an audit finds problems, it does not solve them. Fixing them takes developer time, hours or days depending on the finding. A good action plan helps you start with what matters most.
• Retests: if the re-check is not included, you pay for it separately. With day rates, that can easily be another review day.
• Internal time: your team has to set up access, answer questions, read the report and set priorities. The clearer the report, the less time this takes.

A cheap audit with an incomprehensible report can end up costing more than a good one with a clear action plan.

Is there funding?

As of November 2026. We only list programmes we have checked on the official website.

• Germany, Digitalbonus Bayern: the Free State of Bavaria supports small commercial companies with a site in Bavaria, among other things in introducing or improving IT security. The grant covers up to 50 percent of eligible costs, at most 7,500 euros in the standard variant, and the programme runs until the end of 2027. Consulting is only funded together with implementing a solution, so an audit alone is usually not eligible; the granting authority decides whether your project qualifies. Important: you must apply before placing the order. Source: digitalbonus.bayern (in German)
• France, Diag Cybersécurité: for companies in France, the public investment bank Bpifrance subsidises a cyber diagnostic by an approved consultant by 50 percent, subject to eligibility, for independent SMEs with more than ten employees. That is a separate consulting service, not funding for a code audit. Source: diag.bpifrance.fr (in French)

Funding programmes change. Check the conditions on the official website before applying.

Checklist: comparing quotes

Put these eight questions next to every quote. Ask about anything left unanswered.

1. What exactly is reviewed? Which repositories, languages and how many lines of code?
2. How is it reviewed? Tools only, AI-assisted, manual or a mix? Who cross-checks the results?
3. Against what? For example along the OWASP Top 10, including dependencies and secrets?
4. What does the report look like? Is there a sample report? With location, rating and fix for every finding?
5. What is the total cost? Fixed price or day rate, and how many days are planned?
6. When is the report delivered? When does the clock start?
7. Is a re-check included? If not, what does it cost?
8. What happens to your code? Where is it processed, when is it deleted, is there an NDA and a data processing agreement?

What we offer

Four packages with fixed prices, from a free look from outside to the complete audit:

• Security check: free, passive from outside, results usually within 2 hours on working days
• App audit: automated tests with two test accounts, €490 net
• Code audit: the source code from inside, €890 net, for applications of up to about 300,000 lines
• Full audit: app and code, every finding additionally approved by an expert, report of around 25–30 pages and re-check, €1,690 net

For the code audit and the full audit there is an express option: report within 24 hours on working days, for €230 net extra. The re-check is available as an add-on for the other packages.

All prices net, plus VAT. Our offers are for businesses only.

Is your application larger, or are you unsure which package fits? Start with the free security check. It shows what is visible from outside, and afterwards we tell you which audit is worth it for you.

This article was created with the help of automated research and AI. David Kreutzer reviewed it and approved it on 4 November 2026.