Software development
Digitization in the middle class: How to measure your success
Digitization is no longer a trend for medium-sized enterprises, but a need to remain competitive. But how to measure the success of Digitalisie...
IT Security Costs: Audits, Penetration Tests and Secure Development
What security audits, penetration tests and secure development cost – transparent ranges and models.
In brief
One investment range for IT security
The investment range for IT security is EUR 1,514 – 229,435 excl. VAT. Pentest, audit and compliance scale the scope inside that span, not as a monthly rate or a loss figure.
Interactive cyber risk calculator
IT security calculator
How secure is your company?
Assess your IT security risk and the ROI of a security audit
Step 1 of 425%
What industry are you in?
How the IT-security investment range is built
The calculation follows six visible stages. All figures remain planning values until scope and assumptions have been reviewed.
1. Capture inputs
The calculator records the visible project, volume, complexity and operating parameters selected on this page.
2. Add fixed components
Fixed base modules and selected add-ons are added without mixing them with recurring charges.
3. Apply multipliers
Quantity, complexity and scope factors multiply only the cost components identified for them in the calculator model.
4. Create the range
The calculator applies its documented lower and upper uncertainty factors to the base result; ROI views keep investment and savings visible separately.
5. Round and calibrate
Monetary result fields are rounded to the nearest whole euro. Public project-cost components are calibrated with the centrally maintained display factor.
6. Classify the result
The result is shown as non-binding guidance. A binding quote requires scope, data, integrations, risks and acceptance criteria to be reviewed.
Included
- Inputs shown in the calculator
- Calculator-specific base values and factors
- Displayed one-off and recurring result components
Not included
- Requirements not selected in the calculator
- Unknown data migration and third-party licence costs
- Taxes, legal advice and a binding delivery commitment
Efficiency or discount factor: A central display factor of 0.7 is applied to public project-cost components to keep all calculators aligned with the currently reviewed pricing basis. It is not a customer-specific discount; customer-entered wages, revenues and existing operating costs are not reduced.
Why this is not a binding quote: The calculator cannot verify complete requirements, third-party dependencies, data quality, legal constraints or acceptance criteria.
Technical responsibility and review
- Technical owner
- Björn Groenewold
- Role
- Managing Director and software engineer
- Expertise
- Software development and software estimation
- First published
- Last technical review
- Price basis
- September 2026
Sample calculations & scenarios
Concrete project profiles with assumptions and indicative budgets—useful for internal alignment alongside the calculator.
Software leasing spreads this investment range over 72 months. Terms are on the software financing page.
IT security: typical costs
Security audits and penetration tests use one investment range: EUR 1,514 – 229,435 excl. VAT. Secure development (security by design, code reviews, hardening) stays inside that range. We clarify scope before a fixed quote.
What influences IT security costs?
The scope of an IT security project depends on the size of the system, the number of interfaces and the depth of the audit. A simple website has fewer attack surfaces than a multi-tenant SaaS platform with APIs and integrations. Penetration tests can focus on the web front end only or include infrastructure, authentication and business logic. We define the scope in a short briefing and then provide a fixed quote. Secure development – building security into architecture, code reviews and hardening – is often included in our development rates or quoted as a separate phase so you can plan budget clearly.
Ongoing security (monitoring, incident response, updates) can be billed as a retainer or as part of a maintenance contract. We recommend starting with an audit or penetration test to identify the most critical risks, then prioritising remediation and optionally integrating secure development into your next project. Use the calculator below to estimate risk and potential impact; for a tailored quote for audits, penetration tests or secure development get in touch – we outline options and typical cost ranges without obligation.
Request a quoteFAQ
IT Security Costs
Audits & Ongoing Security
How much does a security audit or penetration test cost?
A web-app test, a broader audit and a red-team exercise sit in the investment range EUR 1,514 – 229,435 excl.
VAT. Scope changes the variant, not a second price.
What influences IT security costs?
Scope depends on system size, number of interfaces and audit depth.
A simple website has fewer attack surfaces than a multi-tenant SaaS platform. Penetration tests can focus on the front end only or include infrastructure, authentication and business logic.
Is secure development included in development projects?
Building security in from the start – security by design, code reviews, hardening – normally rides along with the development project or adds a defined percentage.
Where you prefer, we split it out as its own phase so the budget stays clear.
What about ongoing security?
Monitoring, incident response and updates can be billed as a retainer or as part of a maintenance contract.
We recommend starting with an audit to identify critical risks, then prioritising remediation.
Get a security quote
Tell us your goals in a brief call and receive a fixed price for the assessment.
IT security: calculate protection measures
How we calculate the cost of your IT security measures
Risk analysis, technical measures, and training—so security becomes a shield, not a gut-feeling expense.
1. Risk and protection-needs analysis
We check protection needs (confidentiality, integrity, availability) per system and prioritize measures.
2. Technical measures with effort
We calculate hardening, MFA, backups, monitoring, SIEM/SOC, and pentests separately. So you see what is really needed.
3. Organizational measures
We calculate policies, training, phishing simulations. People are often the biggest weak point—training is cheaper than damage.
4. Ongoing operations and audits
We calculate patching, audits, and regular reviews. So security stays active—not 'introduced once and forgotten'.
Typical pricing models (overview)
| Model | When it fits | Budget & flexibility | Typical risks |
|---|---|---|---|
| Fixed price (fixed scope) | Clearly defined scope, stable requirements, repeatable delivery. | Predictable total cost; little room for change without a change order. | Scope creep leads to change orders or quality trade-offs. |
| Time & Material | Discovery, legacy, evolving requirements, or close collaboration. | Maximum flexibility; budget transparent via hourly or daily rates. | Without prioritisation, effort can grow—backlog and reviews matter. |
| Retainer / maintenance package | Ongoing operations, updates, small features, and support. | Agreed capacity per month; predictable follow-on cost. | Large changes may still need a separate estimate. |
| Hybrid (milestone + T&M) | MVP or phased releases with clear go-lives, then iterate. | Core delivery fixed price; extensions on a time-and-materials basis. | Define contractually what is in scope vs. extra work. |
Calculators on this page provide indicative ranges; we choose the right model with you based on risk, scope, and planning horizon.
What determines the costs, and what comes next?
The ranges shown are indicative. For a binding quote we discuss scope, priorities and funding options in a free intro call. Many digitalization projects qualify for grants – try our funding calculator.
Browse all cost calculators, explore services and typical solutions. Questions about IT security? Contact us.
The calculator result for IT security is indicative only – a binding budget follows scope alignment, data review, and quality targets.
Plan follow-on costs
- Operations and maintenance separate from the initial build
- Internal key users and training
- Monitoring and support after go-live
Next steps after the calculator
- Intro call: funding and phased delivery
- Discovery, pilot, or rollout matched to risk
- Documented assumptions and exclusions in the quote
Compare related calculators in the costs hub for edge cases (integrations, compliance, parallel run).