For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for testing. I really have no idea if an audit would cost $10-20k or well over $100k. I'm not asking for an exact quote, just a general guesstimate so that I know what to expect. If you could separate your estimates between blackbox and whitebox testing, that would also be helpful.
I'll try to list as many factors as I can.
- Type of app: A web content management system similar to Wordpress, Joomla, or Drupal.
- Types of testing: Broad penetration testing and a scan for common vulnerabilities. Code review for additional vulnerabilities as the source code will be publicly available.
- LOC: Roughly 85,000.
- Audience for report: Developers.
- Location of testing: It can be done remotely.
- User roles are variable. They are assigned to groups and each group can be given any number of permissions. Any number of groups can be created.
I don't know what other information might be relevant. Really, I'm not looking for an ultra-specific number, just a ballpark figure like, "Based on the info you gave, you could probably expect to budget between $X and $X for a security audit." Even just a baseline price would be extremely helpful as I really have no idea what to expect.