Timeline depends on the size and complexity of the codebase. A focused audit of a single application or module might take one to two weeks. A comprehensive audit of a large enterprise system with multiple components, integrations, and compliance requirements could take four to six weeks or more.
The scope defined at the start – which systems, which regulatory frameworks, how deep to go – is the biggest factor in timeline. We work with you to scope the audit to fit your schedule and business priorities so you get the most value from the time and budget available.
Reference
OWASP Code Review Guide – OWASP Foundation – owasp.org