Most firms will not tell you
This is the most important point, and it affects everything else discussed here.
I checked the pricing pages of the firms a buyer would actually shortlist. Crosslake, the best-known mid-market technical due diligence firm, publishes no price at all: the page ends in a contact form. Trail of Bits, Bishop Fox, Quandary Peak and TechCXO are the same. One firm, Red Sentry, goes further and publishes a page explaining that it refuses to list prices on principle.
So when you search this question you mostly find articles written by agencies, quoting ranges with no source. The most repeated figure in this whole category, "$35,000 to $95,000 with a specialist firm," traces back to a single blog post that cites nothing. I am not going to repeat it.
Here are the prices firms actually list, taken from their websites as of September 26, 2026.
| Service | Published price |
|---|---|
| Automated scan | Free to a few hundred dollars |
| Focused manual review | $5,000 to $10,300 |
| Packaged five-day review | Around $15,000 |
| M&A due diligence | $25,000 to $75,000 |
| This practice, Diagnostic Week | $2,500 fixed |
Why the published numbers span two hundred to one
The lowest price I found was $399 and the highest was over $75,000, even though the work was described in similar terms. This is not a market with a standard rate; it is four different services with the same name.
- An automated scan costs nothing to a few hundred dollars. A tool checks your code and gives you a list. It is useful and inexpensive, but it is not a real assessment since no expert reviews the results.
- A focused manual review costs about $5,000 to $10,300. A specialist reviews one application or network and writes a report. Three firms independently publish prices in this range, making it the most reliable figure here.
- A packaged five-day review costs around $15,000. One senior expert spends a week and delivers a report by Friday. Note that the two firms offering this are actually run by the same company, so it is just one example.
- Merger and acquisition due diligence starts at $25,000. This involves a team, multiple systems, and is aimed at an investment committee, usually as part of a deal. AKF Partners lists $25,000 to $40,000 for the standard option and $40,000 to $75,000 for the expanded version.
If you get a quote for $8,000 and another for $40,000, they are almost certainly for different services. Ask which of the four types you are being offered.
What you should get for it
This part is more consistent than pricing, and it is what you should expect from any provider. Every firm that describes its deliverables lists the same three items.
- A written report with findings in priority order. Some firms commit to a length: one publishes "a concise 2 to 3 page PDF" at its lower tier and "10 to 15 pages" at its higher one; another commits to "typically 20 to 40 pages" for a five-day read.
- A prioritized remediation plan. This is almost always included and is what makes the report useful instead of just informative.
- A summary written for non-engineers. Depending on the buyer, it may be called an executive summary, an investment committee summary, or a non-technical stakeholder summary.
There are two things you should check for, as they are often sold separately. Presentations are often extra; for example, one firm charges $699 for an executive presentation and $499 for a remediation call, on top of the main test. Retesting after fixes may also be an extra charge, usually around $799. Both practices are fine, but you should know about them before you get the bill.
How long it takes
The one thing that is consistent in this market is timing. Five business days is a standard timeframe, and most projects take between one and four weeks.
If you are offered a one- or two-day turnaround, it is likely just a scan or a quick check, not a full review. If a project is quoted as taking several months, it is a larger program, not a standard assessment, so ask what will be delivered by the end of the second week.
What I charge, and why it is lower
The Diagnostic Week costs $2,500, fixed and agreed before starting. This is lower than any of the published ranges above, and the real reason is the scope, not generosity.
It is one person working for one week on one system. There is no team, no project management layer, and no investment committee involved. If a review needs to cover several systems, that is a different project and is priced separately. This is the same distinction as the four types mentioned earlier. I am not offering the same service that AKF sells to private equity firms, and it would be misleading to compare the prices without explaining this.
You get the same kind of deliverables as listed above: a written scope, a prioritized plan with explanations, a fixed quote for the build that you can use anywhere, and an honest summary of what still needs fixing, including things I am not offering to fix. If you do not think it was worth the money at the end of the week, you do not have to pay, and you keep the documents. If you hire me for the build, the $2,500 is deducted from the total.
When not to buy one at all
There are three situations, and the first is the most common.
If you already know what the problem is and just need the work done, an assessment will only tell you what you already know. If you can sum it up in a sentence, skip the assessment and get the work started.
If you are not going to act on the findings, do not buy an assessment. Without the budget, authority, or willingness to make changes, the report just becomes an expensive document that only offers temporary reassurance. Be honest with yourself about this before spending money.
Sometimes the question is simple enough to answer for free. Many assessments are booked for issues that could be solved in a fifteen-minute conversation. If you just want to know if one specific thing is a problem, ask someone. I offer this for free and often end up telling people they do not need to hire anyone.