What a ColdFusion security audit actually covers.
Three quotes that all say "comprehensive security review" are impossible to compare. This page is the scope: the four layers that get examined, what the written deliverable contains, what it costs, and what it deliberately does not do.
A scanner reads your version. It does not read your code.
An automated vulnerability scanner tells you which published CVEs affect the ColdFusion runtime you are on. That is genuinely useful and it is about a quarter of the problem. It cannot tell you that a single report page concatenates a URL parameter straight into a query, that the ColdFusion Administrator is reachable from the internet with an eight-year-old password, or that debug output is switched on in production and prints the datasource name to anyone who triggers an error.
ColdFusion's most expensive failures are usually in application code and configuration rather than in the engine version — which is why the audit reads both, and why it produces a ranked list you can act on in order rather than a scanner dump.
If your version is also out of support, that is a separate and compounding problem: no patches ship for new vulnerabilities at all. Several ColdFusion CVEs sit on CISA's Known Exploited Vulnerabilities catalog, which makes patching a mandate for federal agencies and an audit finding almost everywhere else.
Four layers, examined in this order.
The order matters: an unpatched engine makes everything below it moot, and a hardened application on an exposed administrator is not hardened.
Version and patch posture
- —Engine and version identified — Adobe ColdFusion, Lucee, or BoxLang
- —Java and JDK version identified
- —Applied security updates verified against Adobe's bulletins
- —Tomcat and JVM version and configuration reviewed
- —CISA KEV catalog status for your version
- —Unsupported versions flagged, with the support position stated plainly
ColdFusion Administrator and server configuration
- —Administrator reachability from the public internet
- —Authentication strength on the admin interface
- —RDS disabled unless explicitly required, and restricted where it is
- —Datasource permissions reviewed against least privilege
- —Debug output confirmed off in production
- —Secure profile and lockdown settings reviewed
- —Scheduled task exposure
The CFML itself
- —
cfqueryparamcoverage and the SQL injection surface - —File upload validation, storage location, and execution risk
- —Deserialization and dynamic evaluation
- —Authentication and session handling
- —Output encoding and cross-site scripting surface
- —Error handling that leaks stack traces or connection detail
- —Outbound calls and how API credentials are held
What is reachable, and what happens when something goes wrong
- —TLS configuration
- —WAF posture and rule strategy
- —Secrets in source control
- —Least-privilege IAM and operating-system permissions
- —Backups encrypted, and restores actually tested
- —Logging and alerting — whether you would know
A document your team can work from after I leave.
- A risk register. Every finding, ranked by exploitability against business impact — not by scanner severity, which does not know what your application is worth.
- Evidence notes. What was observed, and where. A finding you cannot reproduce is an opinion.
- A prioritized remediation plan. What to fix, in what order, and what each item involves.
- Quick wins, separated out — the items that are a configuration change rather than a project, so something improves this week.
- A longer-term roadmap for the findings that need budget, scheduling, or an upgrade first.
It is written to be forwarded. Most of the value of an audit is that somebody who is not in the room — a compliance reviewer, a CFO, an incoming developer — can read it and reach the same conclusion you did.
A redacted sample. I can walk you through the structure of a real deliverable, with client and system identifiers removed, on the assessment call. A published sample is not on this site yet, and I would rather say that than show you a mock-up of one.
Fixed scope, quoted before anything starts.
What it costs
A fixed-scope audit runs $3,500 – $12,000, depending on codebase size and how deep the code review goes. The range is quoted down to a single number before work begins, so there is no hourly meter.
How long it takes
Scoped on the assessment call, once the codebase size, the number of applications, and the environment are known. I don't publish a typical duration, because the honest range across a 40,000-line single application and a fifteen-application estate is too wide to mean anything.
What I need from you
To quote it: your CFML engine and version, roughly how large the codebase is, how many applications and environments are in scope, and whether there is a deadline driving this — an audit finding, a compliance questionnaire, a renewal.
To do it: read access to the source, the ColdFusion Administrator settings (an export is fine), and a conversation with whoever knows the deployment. Nothing more exotic than that.
What an audit does not do.
- It is not a penetration test. Nothing is exploited. Findings are established by reading code and configuration, not by breaking in. If you need an adversarial test, that is a different engagement and usually a different vendor.
- It does not remediate. The audit produces the plan. Fixing the findings is separate work, scoped and quoted from the plan — and often some of it is work your own team is better placed to do.
- It is point-in-time. It describes the system on the day it was examined. New CVEs ship, and code changes.
- It does not certify anything. No audit makes an application secure or compliant, and anyone selling you that is selling you something else.
Five questions to ask anyone, including me.
If you are comparing proposals, these separate an audit from a scan with a report template on it. Take them to the other conversations too.
- Do you read the application code, or only the runtime version? Ask which. Both are legitimate offers at very different prices.
- What does the deliverable physically look like? Ask for the section headings, or a redacted example.
- How are findings ranked? "Critical / high / medium" copied from a scanner is not a ranking against your business.
- Who does the work? On a fixed-price audit the difference between a principal and a junior with a checklist is most of the value.
- What is explicitly out of scope? A vendor who cannot answer this quickly has not scoped it.
Related: the full service list, the engine decision framework — an audit often surfaces one — and public-sector work, where CISA KEV status is usually the reason the audit is happening at all.
The scoping call is free.
Thirty minutes. I'll review your version, licensing position, and known-vulnerability exposure, and send a short written summary afterward — whether or not the audit is the right next step.
Book a free 30-min assessmentOr email sales@coldfusioncafe.com · reply within one business day.