How long does a Magento security audit take?

A standard audit (~20 hours) typically runs over 3-4 business days: scope on day one, scanning and manual OWASP testing over days one to three, and the written report on day four. Audit + hardening (~40 hours) adds roughly four to five more days for applying patches, admin hardening and the verification re-scan. Emergency engagements for suspected compromises can start same-day on the Managed Security retainer.