For white hats, how has the cost of a thorough security review changed since, say, five years ago?