How much does a cyber security audit cost in Australia?

At the lightest end, a small number of Australian specialist firms offer a fixed-price rapid review — a one-to-two-day assessment of email and domain security, multi-factor authentication and basic exposure — for roughly $1,500 to $3,500. It is a starting point, not a substitute for a full audit.

A basic audit for a small business, combining a data-breach risk assessment, a vulnerability scan and a security-policy review, is commonly quoted from around $5,000. One published real-world example, a 50-user business holding around 1TB of data, totalled $8,800 across those three components.

A standalone vulnerability assessment, automated scanning plus a human-reviewed report without a policy review or an audit narrative, runs roughly $5,000 to $12,000 depending on the number of devices and users in scope.

An Essential Eight maturity assessment, rating a business's alignment with the Australian Cyber Security Centre's eight mitigation strategies from Maturity Level Zero to Three, is typically a fixed fee from around $8,500. A combined package that adds a costed uplift roadmap and implementation oversight commonly starts from $18,000.

Penetration testing, which actively attempts to exploit weaknesses rather than only identifying them, costs more: roughly $6,000 to $20,000 for a web application test, and $10,000 to $30,000 or more for a network or infrastructure test, depending on scope and depth.

For large or heavily regulated organisations, with multiple sites, cloud environments and obligations such as ISO 27001 or IRAP, a comprehensive audit commonly starts around $30,000 and can exceed $100,000.

These three terms get used interchangeably by buyers and inconsistently by providers, and confusing them is the most common way an enquiry ends up with the wrong quote.

An audit or assessment is a point-in-time review: someone examines your systems, policies and configuration and produces a report on where you stand, typically against a named standard or framework. It does not, on its own, fix anything.

A penetration test goes further, actively attempting to exploit a weakness the way an attacker would, rather than only documenting that it exists. It is more expensive than an equivalent-scope audit for exactly that reason.

Managed security services are different again: an ongoing, recurring service, ordinarily monitoring, detection and response, rather than a one-off engagement. Australian pricing for this runs roughly $50 to $150 per device per month, or as a fixed monthly fee: a 50-to-100-user business commonly sees $3,000 to $8,000 a month for comprehensive coverage including 24/7 monitoring.

If you arrived at this page looking for the cost of ongoing managed security or SOC monitoring rather than a one-off audit, the figures in this paragraph, not the table above, are the ones that apply to you.

Four factors explain most of the spread inside any one row of the table above.

Environment size is the single biggest driver. The number of endpoints, servers, sites and cloud tenancies in scope changes the engagement completely — a vulnerability assessment for 20 devices and one for 200 are not the same piece of work.

Target maturity or standard matters next. Assessing against a named framework such as Essential Eight or ISO 27001 at a higher maturity level takes more evidence-gathering than a general-purpose review, and costs more accordingly.

Documentation quality matters too. An organisation with existing, current network diagrams, asset registers and policies gives an assessor less work to do from scratch, which providers reflect in a lower quote.

Whether remediation is included matters last. A fixed fee that only covers the assessment and report is cheaper than one that also includes prioritised remediation guidance or implementation oversight, so ask which you are being quoted before comparing two numbers.

Most quotes for a scoped cyber security audit are fixed-price against a written scope of work, not open-ended hourly billing — several providers state this explicitly for Essential Eight assessments and packaged audits. Where a provider does bill by the hour, for a smaller or less-defined engagement, published Australian rates for external specialists run around $100 to $149 an hour. All the figures in this guide are quoted exclusive of GST, in line with how Australian providers publish them, so expect the invoice you actually receive to add 10 per cent on top of any number quoted to you verbally or in a scope document.