Code audit or penetration test? Differences, costs and the right choice

The short answer

A code audit checks your software from the inside: it reads the source code and finds the root cause of a flaw, with file and line. A penetration test checks from the outside: it attacks the running application and shows what an attacker can actually achieve.

Both find security flaws. Each simply sees a different part of the problem.

What a code audit covers

In a code audit, the reviewer gets read access to the repository. They see everything an outside attacker can only guess at:

• Secrets in code and Git history, such as API keys and passwords
• Dependencies with known vulnerabilities (CVE) and outdated packages
• Logic flaws in permissions that are only visible in the code
• Unsafe patterns such as concatenated SQL queries or missing validation
• Code quality: complexity, dead code, missing tests, technical debt

The advantage: a code audit also finds flaws in paths an outside tester never reaches. And every finding points straight to where your team has to act.

What a penetration test covers

In a penetration test, a tester attacks the running application, with your written approval and within an agreed scope. They see what the code alone does not reveal:

• Configuration of server, TLS, headers and cloud services
• Network and infrastructure around the application
• Chained attacks, where several small weaknesses add up to a big one
• Runtime behaviour, such as error messages, timing and sessions

The advantage: a pentest proves that a flaw is really exploitable and shows its impact. Whatever is not reached during the test window stays undiscovered.

Side by side

When you need which

A code audit first if you build software or have it built and want to know where you stand. Typical cases: you took over code from an agency, a large part was written with AI, the Cyber Resilience Act requires a bill of materials (SBOM) for your components from December 2027, or the budget is limited and you want to fix the biggest risks first.

A penetration test if a customer or auditor asks for one, for example under ISO 27001 or TISAX, where pentests are common evidence, if infrastructure and configuration are the focus, or if a particularly critical system goes live.

Both if the application is critical. The sensible order: the code audit first, which finds root causes at low cost. Then the pentest, which checks whether anything still gets through from outside. That way you do not pay the more expensive test to find mistakes that were obvious in the code.

Three common misconceptions

• “We run a scanner, so that is a pentest.” An automated vulnerability scan is a good start. A pentest goes further: it chains weaknesses and thinks like an attacker.
• “The pentest was clean, so the code is secure.” A pentest only shows what it reached in its time window. Flaws behind a login the tester did not have stay invisible.
• “A code audit replaces the pentest.” No. It finds different things, many of them earlier and cheaper. If a customer explicitly requires a pentest, a code audit does not replace it.

What we offer

We do not do manual penetration tests or load tests. We test automatically and with AI support, and every finding is evidenced with its location:

• Security check: free, passive from outside, results within 2 business hours
• App audit: automated tests with two test accounts, €490 net
• Code audit: the source code from inside, €890 net
• Full audit: app and code, every finding additionally approved by an expert, €1,690 net

How we work is explained in our methodology.

This article was created with the help of automated research and AI. David Kreutzer reviewed it and approved it on 1 November 2026.