What a cybersecurity audit really covers
An IT security audit shows where your information system can be attacked and in what order to fix things. The scope is defined with you. It most often covers:
- public exposure: websites, applications, services open to the Internet;
- external network, and internal network if the scope includes it;
- exposed accounts and passwords;
- server hosting and configuration.
The deliverable is a prioritized report: the risks, quick fixes, then a roadmap. This is the document you show your insurer, a client auditing their suppliers, or your board of directors.
Black box, gray box or white box: which mode to choose
The mode describes what the auditor knows at the start.
- Black box: no information, like an external attacker. Useful for measuring what is visible from the outside.
- Gray box: a user account and some context. The best compromise for a business application.
- White box: access to code, diagrams and configuration. The most complete, most cost-effective for a critical application.
For an SME discovering the exercise, gray box is often a good starting point. The final choice is made during scoping, depending on what you need to protect.
Pricing: White Hat offers as of 11/11/2026
Here's what is listed on the audit page at the reading date. Prices are in euros excluding tax and may change: the quote is binding.
- Pentest Starter: 1 website and its hosting, 3 to 5 days. €3,499 excl. tax at list price, €1,749.50 excl. tax with current offer.
- Pentest Premium: up to 3 websites or applications and network infrastructure, 7 to 10 days, with roadmap for 6 to 12 months. €7,999 excl. tax at list price, €4,799.40 excl. tax with current offer.
- Active Directory, cloud and Red Team: custom quote.
A re-audit after remediation is included in all offers. This is what proves the vulnerabilities are closed.
Paris or elsewhere: what really matters
Most of a cybersecurity audit is done remotely: we test your systems from the network, not from your conference room. So the provider's location matters less than the following points.
- The auditor's certifications: OSCP, CISSP or OSEP are verifiable benchmarks.
- A written scope and a signed mandate before any testing.
- An actionable report, not a raw list of automated scans.
- A re-audit to verify fixes.
Questions to ask before signing
Ask each provider these questions and compare written answers.
- What is the exact scope, and what is excluded?
- Who performs the tests, and with what certifications?
- What does the report contain, and within what timeframe?
- Is the re-audit included?
- What happens if a critical vulnerability is found during testing?
To understand what testing brings to a specific website, also read our guide to website pentesting for SME directors. And if you're preparing a fundraising round, see how to secure your data before a fundraising round.
A good cybersecurity audit comes down to three things: clear scope, a report your team can implement, and verification after remediation. Starting price is on the IT security audit page. The first conversation is without obligation.
Frequently asked questions
How much does a cybersecurity audit cost for an SME?
At White Hat, the Pentest Starter (1 website and its hosting) is listed at €3,499 excl. tax at list price, €1,749.50 excl. tax with the current offer as of 11/11/2026. Premium is €7,999 excl. tax at list price. The quote is binding.
How long does an audit take?
3 to 5 days for Starter, 7 to 10 days for Premium, not including reporting.
What's the difference between black box, gray box and white box?
Black: no initial information. Gray: an account and some context. White: access to code and configuration.
Do I need a provider based in Paris?
No, most testing is done remotely. Instead check certifications, written scope and re-audit.
Request an audit
Read more