Port some FOSS they're already depending on a lot on OpenBSD on hardware you certified to work. Self-hosted machines and bare-metal servers from at least one th

Port some FOSS they're already depending on a lot on OpenBSD on hardware you certified to work. Self-hosted machines and bare-metal servers from at least one third party. Charge for licensing (say "license") the binaries with support included while putting the modified source in a repo somewhere for the masses to benefit. Use money you don't keep as profit to repeat the process for more software. Alternatively, after an OpenBSD port, rewrite the same software in Rust with all checking on (eg integer overflow) plus thorough equivalence and fuzz testing. I chose these two because they have excellent documentation along with helpful folks that would probably love to help out any team actually making something like that happen with real, production-worthy, open-source code. wepple is right about security requiring tons of knowledge and experience to do right in general. That said, even inexperienced programmers with no security knowledge can vastly reduce the number of hacks and downtime their customers deal with by following my recommendation to use safe languages with minimal or no runtimes on secure OS's. Obviously, there's stuff they'll miss that requires experienced folks to spot. So, bring in security consultants for reviews and/or do bounties early on when revenue is low or you're still on investment money. Then, as you grow enough to afford more people, hire at least one, security expert with lots of proven experience in avoiding and finding flaws in the type of software you're selling. They can also help with ports in between security reviews to get more ROI.