What does a security audit cost for a small web app?

The whole market on one page

Tier 0 — what $0 actually buys you in 2026

More than most people assume, and this is where a solo builder should start.

The honest framing: stack ZAP + Nuclei + Dependabot + Snyk Free + Observatory + SSL Labs and you have covered configuration, known CVEs, vulnerable dependencies and the classic injection and XSS classes — for nothing.

What $0 cannot buy is business logic flaws, broken access control between tenants or roles, and authentication bypass. That is precisely what human testers are paid to find, and precisely what breaks small SaaS apps. It's also, not coincidentally, what the research keeps finding in AI-generated code — one study of five agentic coding tools found them "very prone to business logic vulnerabilities" while encountering not a single exploitable SQL injection or XSS.

Tier 1–2 — automated scanners with published prices

Tier 3–4 — human penetration testing

The vendors who publish a rate card

This short list is the useful part of this page, because it's what the rest of the internet doesn't give you.

What the opaque vendors actually charge

For two of the biggest names, aggregated real signed-contract data exists — stronger evidence than any published guide:

Note Cobalt's floor: $8,937 is a real price a small buyer has actually achieved, well below the five-figure minimums usually implied. Buyers routinely negotiate 15–30% off list.

Market ranges, and where the guides disagree

The disagreement is almost entirely about the floor. For a small, simple web app under about 20 pages with no API, published guides range from $2,500–$6,000 at the low end to $5,000–$30,000 at the high end. For a medium SaaS with a REST API and multiple roles, the consensus is roughly $6,000–$15,000; complex enterprise work runs $15,000–$40,000+, and full-stack with source code review reaches $20,000–$60,000+.

The 2026 average across the market is put at around $18,300, with most organisations spending $10,000–$30,000 per test.

What drives the price

Tester-days is the real unit; everything else is a proxy for it. A grey-box test of a medium SaaS application takes a minimum of 5–10 business days of active testing. At mid-market day rates of $1,500–$3,500 that arithmetic alone produces $7,500–$35,000.

Day rates themselves span roughly seven times across the market — from about $985/day published at the budget end to $4,000–$7,000/day at boutique and Big Four firms, with the Big Four typically charging 2–3× a boutique for identical scope.

• Scope — page and endpoint count, number of authenticated roles, whether there's an API, multi-tenancy, SSO, payment flows.
• Methodology — grey box is the best value: give the tester credentials and you stop paying skilled people to spend days on reconnaissance you could have handed over for free. Black box costs more for less depth on internal logic.
• Retest — the biggest hidden difference. Some vendors include it (unlimited on subscription tiers, or 1–3 rounds); others charge $2,000–$5,000 standalone. A $10,000 engagement that bills $3,000 to verify your fixes is a 30% surcharge to prove you did the work. Ask before signing.
• Report type. Three different artefacts: the full technical report (findings, evidence, CVSS, reproduction steps — internal audience), the executive summary inside it, and the letter of attestation, a standalone external-facing document that deliberately omits exploit paths and infrastructure detail. The letter is what enterprise procurement and vendor security questionnaires actually ask for. Confirm whether it's included.

Compliance — the part most guides get wrong

Bug bounty is not the budget option

A common assumption, and it's backwards. Real contract data puts HackerOne's median at $40,000/year. A vulnerability disclosure programme with no bounties still runs $20,000–$50,000/year in platform fees. First-year totals for a small or mid-market company land at $40,000–$120,000 — the platform floor alone exceeds a full mid-tier human pentest before a single bounty is paid.

The genuinely free version is a self-run disclosure programme: publish a security.txt, a clear disclosure policy and an email address. You pay nothing but triage time, and researchers do find things.

What small companies actually spend

We looked for a survey of solo-founder or small-SaaS application security spend and couldn't find one. That absence is itself part of why this question is answered so badly online. The closest available data is general small-business security spend:

• 47% of businesses with under 50 employees have no cybersecurity budget at all.
• Around a third of small businesses rely on free, consumer-grade tools.
• Nearly half spend under $1,500/month on cybersecurity in total.
• Typical small-business prevention spend: $5,000–$15,000/year — across everything, not just application testing.

Put those together and the real answer emerges: a typical small business's entire annual security budget is one mid-tier penetration test. That's why the honest recommendation for most small apps is not "save up for a $15,000 pentest." It's: exhaust the free tier properly, add an automated scanner for the price of a lunch, and buy human testing when you have something specific that needs it — money, regulated data, or an enterprise customer asking.

So what should you actually buy?

Common questions