Similar situation as you . . . StartUp ScaleUp . . . about 30 people we only had two devs (me and the CTO) when we went through our first security audit. The f

Similar situation as you . . . StartUp ScaleUp . . . about 30 people we only had two devs (me and the CTO) when we went through our first security audit. The firm doing the pen test and audit only had a few recommendations no issues were found. They said we did way better than most fortune 500 companies they test/audit. If you're using a popular framework and follow best practices you might do better than you think.