What is a security audit and penetration test?
A security audit is a systematic review of your application and infrastructure to identify vulnerabilities before attackers do. A penetration test (pen test) goes further — a security professional actively attempts to exploit those vulnerabilities, simulating a real attack to see how far they can get.
There are two sides to this work. On the development side: code review for common vulnerabilities (injection, XSS, broken authentication, IDOR), dependency scanning for known CVEs, and static analysis tooling (SAST). On the infrastructure side: review of exposed ports, S3 bucket policies, IAM permissions, TLS configuration, and secrets management.
The development cost quoted here is the work involved in preparing your application for a security review — fixing the issues your own team can address and setting up automated scanning. The external pen test itself is a separate engagement, typically $5,000–$20,000 AUD from a specialist firm.
When does your app need it?
- You're selling to government, defence, or regulated industries in Australia (IRAP assessment may be required)
- Enterprise procurement requires evidence of security testing — SOC 2, ISO 27001, or a pen test report
- You handle sensitive data: financial records, health information, personal identity documents
- You're preparing for a Series A or significant funding round where investors will conduct technical due diligence
- You've made major architectural changes and want to validate security posture before launch
- A customer or partner has specifically requested a pen test report as a condition of contract
How much does it cost?
Security audit preparation typically adds 8–16 hours of development — roughly $1,000–$4,000 AUD.
Lower end: Automated dependency vulnerability scanning (Dependabot, Snyk) integrated into CI/CD, OWASP Top 10 review of the most sensitive code paths, and remediation of any straightforward issues found (outdated packages, missing security headers, insecure direct object references).
Higher end: Full SAST pipeline, DAST scanning against a staging environment, manual review of authentication flows, authorisation logic, file upload handling, and API endpoints, infrastructure security review (IAM, network ACLs, secrets in environment variables), and documentation of security controls for an external auditor. Remediation of findings is additional scope and depends on what's discovered.
How it's typically built
Automated tooling runs first. Dependabot or Snyk flags packages with known CVEs. A SAST tool (Semgrep, CodeQL) scans source code for injection patterns, hardcoded secrets, and insecure function calls. These tools integrate into CI/CD and block builds when critical findings are introduced.
DAST (dynamic testing) tools like OWASP ZAP scan a running instance of the application, testing endpoints for XSS, SQL injection, CSRF, and misconfigured security headers. This is typically run against a staging environment.
Manual review focuses on what automated tools miss: broken object-level authorisation (can user A access user B's data by changing an ID in the URL?), business logic vulnerabilities, and authentication edge cases.
Infrastructure review checks for publicly accessible resources that should be private, overly permissive IAM roles, secrets stored in environment variables or source code, and TLS configuration.
Questions to ask your developer
- Is this for an internal review or to produce a report for a third party? The deliverable changes the scope — an external pen test report requires an independent firm.
- What's in scope — application only, or infrastructure as well? Both are important; agree on the boundary upfront.
- Are automated scanning tools already in your CI/CD pipeline? If not, setting them up is a high-value, low-cost first step.
- How will findings be prioritised? Critical vs high vs medium determines the remediation sequence and timeline.
- Do you need an IRAP assessment? For Australian government work, IRAP is a specific framework — find an IRAP-authorised assessor.
See also: SOC 2 readiness · GDPR and privacy compliance · App cost calculator