Australian buyer guide
Audit prices cannot be compared until the objective, framework, assets, evidence and deliverables match. This guide separates the common assessment types and gives you a scope checklist before you request quotes.
Published price cue
Envisage Technology, one Australian provider, publishes a starting price of A$2,500 plus GST for a small-to-medium-business audit.
This is one provider's published starting price, not a market average, guaranteed price or ScoutLab quote. Inclusions vary and a broader scope can cost materially more.
Assessment types
Tests the implementation and effectiveness of controls against ASD's Essential Eight maturity model. It is narrower than a complete organisation-wide audit.
Reviews evidence against a named standard, contract or regulatory requirement. The framework, assurance level and auditor independence materially affect scope.
Identifies important assets, threats, weaknesses, likelihood and business impact to support risk treatment decisions. It may use interviews and document review.
Human-led testing of an authorised technical scope. It is not interchangeable with a policy review, compliance audit or automated vulnerability scan.
Automated checks for covered weaknesses and exposure. Useful for repeatable technical visibility, but insufficient for policies, identity, cloud and organisation-wide assurance.
Cost drivers
Number of people, sites, endpoints, cloud services, applications and third parties in scope.
Whether the work covers policies, governance, identity, cloud, endpoints, networks or only one public website.
The named framework and required evidence: Essential Eight, ISO 27001, contractual controls or another baseline.
Interview, sampling, technical validation, penetration-testing and on-site requirements.
Report depth, executive briefing, remediation roadmap, evidence pack and retest arrangements.
Assessor experience, independence, travel, urgency and whether GST is included.
Scope checklist
Australian guidance
ASD's assessment process guide describes methods for assessing implementation and effectiveness of controls in the Essential Eight maturity model. ASD also notes that the Essential Eight is a minimum set and does not mitigate every cyber threat.
Decision table
| Need | Likely fit | Important limit |
|---|---|---|
| Formal organisation-wide assurance | Qualified audit or assessment provider | Confirm framework, independence and scope |
| Human-led technical testing | Manual penetration-testing guide | ScoutLab does not deliver manual pentests |
| Deeper one-off external website checks | Deep Scan — A$199 one-time | Automated external coverage only |
| Recurring external visibility | Monitoring — A$199/month | Not compliance or organisation-wide assurance |
Frequently asked questions
There is no dependable single price because 'cyber security audit' can describe very different scopes. One Australian provider publishes a starting price of A$2,500 plus GST for small-to-medium businesses. Treat that as one provider's published starting price, not a market average or a ScoutLab quote.
No. It assesses implementation against ASD's defined Essential Eight maturity model. Broader governance, privacy, supplier, application, physical, identity and compliance requirements may sit outside that scope.
Usually not. A scan can contribute technical evidence, but an organisation-wide audit can also require policies, interviews, configuration evidence, identity, cloud, governance and control-effectiveness testing.
ScoutLab does not provide organisation-wide cyber security audits. It provides narrower automated external website-security checks. Use an appropriately qualified assessor when you need formal, compliance or organisation-wide assurance.
Run the free passive scan for a first view of public website and domain signals. Use a qualified assessor when your decision requires wider evidence or formal assurance.
Run the Free Scan