> very few companies will pay for their source code to be audited, because it's expensive and time-consuming, and most only do it if they're required to.

And even when they do, in my experience, they usually end up buying an expensive automated report that provides little or no real insight.