What Should an AWS Security Review Actually Cost? Here's What the Market Looks Like

The pricing question comes up on almost every discovery call, and the honest answer is that the market is a mess. Day-rate consulting shops quote anywhere from $15,000 to $50,000-plus for a “security review” with a scope still being worked out during the sales call. AWS's own Well-Architected Tool is free, but self-serve — you run it, you read the output, you decide what it means. Everything in between is priced inconsistently, because the thing being priced is rarely defined the same way twice.

Why the range is this wide

Most quotes are built on estimated hours, not a fixed deliverable, so the price reflects how long someone thinks the engagement will take to sell and staff — not the size of your AWS account. Two companies with near-identical single-account footprints can get quotes $30,000 apart, and neither number says much about what's actually being checked.

What a review should actually include

• A scoped assessment across the Well-Architected Security Pillar's core areas — identity and access, detection, data protection, and incident readiness — not a partial check dressed up as a full review.
• A written, prioritized list of findings ranked by real risk, not a generic checklist with your company name pasted on top.
• A walkthrough call where someone talks you through the findings live, not a PDF that lands with no context.
• A fixed timeline agreed before the engagement starts, not “we'll scope it once we're in.”

What it should cost at startup size

For a single-account or small multi-account setup — most pre-seed through Series B companies — a properly scoped review shouldn't need weeks of discovery just to produce a price. The footprint is knowable within an hour of read access, which is the real argument for a flat fee over a day-rate estimate: the scope doesn't change client to client at this size, only the findings do. Our own AWS Security & Architecture Review runs a flat A$999, delivered in one to two weeks, for exactly that reason.

The bigger cost is usually what comes after

The review itself is often the smaller number. What it costs to fix what it finds is harder to predict — some findings are a five-minute IAM edit, others mean building logging and alerting that didn't exist before. That gap is why some teams skip the one-off review and go straight to ongoing monitoring: a fixed monthly cost that keeps GuardDuty, Security Hub, CloudTrail, and WAF configured and watched, rather than paying once for a snapshot that's out of date the moment the environment changes.

If a quote can't tell you the scope before it tells you the price, that's usually a sign the reviewer doesn't know exactly what they're going to check either.