What Actually Determines the Cost of a Small Business Security Review

"How much does a security audit cost?" is the wrong first question, even though it's the one everyone asks first. The honest answer is: it depends entirely on scope, and anyone who quotes you a number without understanding your actual systems first is guessing. Here's what actually drives the number, so you can have a more useful conversation when you do get a quote.

1. What's Actually in Scope

A review of a single web application is a different job from a review of your entire network, every employee's device, your email system, and your third-party vendor access. "Security audit" as a phrase covers an enormous range — the first real question isn't cost, it's what specifically are we looking at.

2. How Deep the Review Goes

There's a real difference between:

• A checklist review — comparing your setup against a standard list (fast, cheaper, catches the obvious gaps)
• An adversarial review — someone actually trying to find what's exploitable, the way an attacker would (slower, more expensive, catches what checklists miss)

Both have their place. A checklist review is a reasonable starting point for a business with no prior security work done at all. An adversarial review matters more once the basics are covered and you want to know what's actually still exploitable.

3. How Much Documentation Already Exists

If nobody can tell the reviewer what systems exist, who has access to what, or what changed last month, a meaningful chunk of the engagement becomes reconstructing that picture before the actual review can start. Basic asset and access documentation, even informal, meaningfully reduces cost.

4. Whether It's a One-Time Review or Ongoing

A single point-in-time review answers "where do we stand today." An ongoing arrangement (periodic reviews, monitoring, retained availability) is priced differently because it's a different kind of commitment on both sides — and for most small businesses starting out, a one-time scoped review is the right first step, not a retainer.

The Honest Answer

I scope and quote after a free discovery call, once I actually understand what's in scope — not before. That's not evasiveness; a fixed number quoted blind is either padded to cover the unknown, or it's an underestimate that turns into scope creep later. Neither serves you well.