For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for testing. I really have no idea if an audit would cost $10-20k or well over $100k. I'm not asking for an exact quote, just a general guesstimate so that I know what to expect. If you could separate your estimates between blackbox and whitebox testing, that would also be helpful.


I'll try to list as many factors as I can.

  • Type of app: A web content management system similar to Wordpress, Joomla, or Drupal.
  • Types of testing: Broad penetration testing and a scan for common vulnerabilities. Code review for additional vulnerabilities as the source code will be publicly available.
  • LOC: Roughly 85,000.
  • Languages: PHP, JavaScript.
  • Audience for report: Developers.
  • Location of testing: It can be done remotely.
  • User roles are variable. They are assigned to groups and each group can be given any number of permissions. Any number of groups can be created.

I don't know what other information might be relevant. Really, I'm not looking for an ultra-specific number, just a ballpark figure like, "Based on the info you gave, you could probably expect to budget between $X and $X for a security audit." Even just a baseline price would be extremely helpful as I really have no idea what to expect.

  • I added the appsec tag to emphasize that this is refering to an application security audit, which is a very different creature from other kinds...
    – AviD
    Nov 29, 2010 at 19:15
  • But this is still a very localized question. Beyond anything else, differences in costs of manpower are simply huge, and depend greatly on location (amongst other things). Not just by a few percantage points, we're talkin multiples and more. Perhaps youd be better off asking a more open question, e.g. "how long does it take", or "what does it involve". While this is a great question, and it would be great to have the answers to this, "between X$ and X$" (not replacing the X) is really the closest you can get.
    – AviD
    Nov 29, 2010 at 19:19
  • I realize there is a huge range of prices depending on a large number of factors. I'm really just looking for a starting point for what to expect for a reasonable (in terms of both price and service) security audit, nothing more. Nov 29, 2010 at 19:50
  • This question appears to be off-topic because it is about pricing which is dependant on the hourly rate of a company. Dec 16, 2013 at 6:39

3 Answers 3


Here's my rough guesstimate:

Code review:

1000 LOC = 1 hour
85000 LOC = 85 hours

Hourly rate: 100$/hr

85 hours * 100$/hr = 8500$

If your software uses an ORM and a well documented MVC framework, it can speed up the code review significantly.

  • 1
    Approximately in two weeks - $8,5k. For PHP application. I am just curious - where are such prices? About documentation this is good point, it really helps.
    – anonymous
    Dec 1, 2010 at 0:14
  • 2
    1000 LoC per hour? That's pretty high... Industry figures have this at 50-100 LoC per hour for high-level languages, a very focused threat model (which could be priced seperately) can allow you to narrow your focus and get up to 500-800 LoC / hour. Even if 1000 is consistently possible (and in fact there were cases where I made this happen), it's very much an upper bound, and costs would not be based on that.
    – AviD
    Dec 1, 2010 at 0:46
  • 7
    I'd argue that if you can audit 1000 lines of code an hour, it's not a good security audit.
    – Steve
    Dec 1, 2010 at 1:18
  • 2
    I knew this would be a highly controversial answer but well, I was the only one who had the guts to throw out a number and actually answer the question :) My estimate of LoC/hour was a broad average since not all code is equally prone to vulnerabilities. The most critical parts might get you down at 100 LoC/hour while we the less critical parts (HTML/Javascript/domain model) can be mostly skipped. Anyways, it all boils down on how well the application is designed and documented. Dec 1, 2010 at 9:05
  • 2
    @AviD, actually, I was just wondering about prices and did not agree about them. @Olivier Lalonde, I would not agree also about mentioned "less critical parts" - how about DOM XSS? Web application assessment is not only PHP source code review - it might require Flash decompiling, configuration reviews, JS review, some other parts as well. Sure, there are other less critical parts, but they are often not included into main pricing.
    – anonymous
    Dec 1, 2010 at 10:57

Okay, there are a huge number of factors affecting cost and scope of a security audit, which is why it is so difficult to give you a ballpark without a lot more detail on the scope. For example:

  • What type of security audit do you require?
  • What do you consider black box? And why do you want it - it can increase the cost considerably.
  • Are you including code review?
  • What languages is the app written in?
  • What audience is the report to be written for?
  • What is the purpose of the test?
    Compliance, audit, certification,
  • Is testing on site, remote, on
    live environment or test?
  • What does the application do?
  • How many user roles exist?
  • etc.

See our taxonomy and extension to it. In fact, some of our other blog posts are very relevant here. Talk to your local vendors and get a quote.

  • I updated the question to address some of your factors. Nov 28, 2010 at 23:53

This really depends on a lot of factors that makes final price.

Costs for source code analysis can be counted by counting lines or amount of code in Kilobytes. As far as I have seen, more popular is second method - to count by size of code. While pricing per lines may be more accurate, such approach does not eliminate unexpected things like very poorly written code, that definitely will take much more time to assess. Others additionally counts found vulnerabilities in code.

Some people might say that pricing depends on the quality of service. I would disagree and say that this is not always the case. New services needs to proof themselves and usually starts with lower prices and middle quality of audit - not only practical experience is essential, but also personal management, users support, etc. Brand services can afford higher prices. But there is also possibility when the brand service starts to skive, or newbies are capable of doing better audit than the well known brand. So, it is advisable to get some background about service, read recommendations and comments.

Also, price may depend on the country of service provider. We all do have differently developed economical environment.

Now from the perspective of source code auditor. For web applications usually whitebox and blackbox testing is combined together. There is really no need in security through obscurity in such case. But well, others may prefer to make blackbox test first and then to give access to the source code. If the source code is given, then it definitely will be tested in live environment. If you have only access to web-site, customer may provide access to server.

Summing up all of this, it is hard to define some fixed price. Customers usually do discuss all details and their future collaborative work. Process may look like this: you give code, they reply with report after some time. You may give code again and those steps may require several loops till bugs in code are vanished. That's why you often see contact form rather than pricelist.

  • Thanks for the breakdown, Ams, it's helpful. Would you be able to venture a number as well? Assume that I would go with a lower priced service from North America. I'd like to think that my code quality is at least average, if not a little above in terms of the number of vulnerabilities. I'm really just looking for a very rough price so that I can budget accordingly. Nov 28, 2010 at 18:07
  • @VirtuosiMedia, we work mainly with ex-USSR customers and price is appointed during our dialogue, so I can't provide appropriate prices.
    – anonymous
    Nov 28, 2010 at 18:14

Not the answer you're looking for? Browse other questions tagged .