Obviously you've spent more time considering this, but on the off chance it's helpful: 1. Take payment in some other form. Get creative. 2. Link the infosec

Obviously you've spent more time considering this, but on the off chance it's helpful: 1. Take payment in some other form. Get creative. 2. Link the infosec to the startup's revenue. In other words, make it something we can sell. Applicable within specific domains. For example, I'd buy a modern CRM solution I had infosec confidence in, but until then we're sticking with our self hosted install of RT. 3. Expand security code review to be a more generalized form of code review that also yields improvements in time to market, overall code quality and project risk. Sell as such. Various research concludes that expert code review early in a project dramatically helps overall productivity. It's easier to test, review, and fix the bugs and awkward sections of code now than maintain it and troubleshoot customers across the following months or years. Whenever I'm doing an internal review even if I'm specifically scanning for vulnerabilities, I can't help but notice any number of garden variety bugs, things needing to be refactored, obvious ways to fill gaps in test coverage, better variable and function names, helpful comments I could add, etc. Maybe this isn't a good use of a high end security researcher's time and could be better left to someone more general, but you could staff some code quality minded generalists. It's quicker to audit clean code so maybe it pays off.