Any startup-friendly security assessment service out there?

So motives usually are things like 3rd parties requiring some form of assessment before purchase, compliance related requirements, things like that. Sounds like you are looking to just get a general gauge of your security maturity.

The biggest problem the security industry has is consistency of work and adhering to a standard methodology. Most firms will have completely different in-house checklists and you won't be able to get consistent testing across firms/engineers.

If you engage a firm, they will likely advise 2 separate assessments, one would be a cloud review, which are pretty streamline by now and a bit of automation has been developed for security engineers to conduct these pretty quickly, so they shouldn't be too high on the price quote. Tools like NCC Group's Scout2 exist which help a lot. I'd draft a list of all the cloud services you use and make sure they check most of the boxes in their methodology.

For the application assessment, the sky could be the limit on how far you go and how much you spend, really depends on the complexity of the application. Make sure here you ask for their methodology on how they conduct testing. Application assessments are usually a bit more sensitive on the testing guidelines, due to the inherent complexity of them. If they say they have a custom methodology around "OWASP Top 10" and "SANS 25", I'd avoid them. Those kind of lists are the most popular vulnerabilities in the industry, but that does not mean they provide a wholistic view into your security maturity.

Try to find a company/contractor that will test against the "OWASP Application Security Verification Standard", as it is a bit more wholesome when it comes to coverage. Some parts might not be applicable, but it covers all the major areas through a kind of checklist approach and has levels dependent on what kind of data you deal with in your application. It's kind of like NIST CSF, but for applications. Most firms will also be able to provide you with an external facing letter of attestation, which you can post on your website or send to your customers to show you are taking security seriously. ASVS is a known standard, with set guidelines, so it looks better than "Firm X tested against a custom methodology" which doesn't really mean anything. Ensure that if you want a real application assessment, you get a tester who has real development experience. There are far too many hacker script kiddies in the industry that run automated stuff and can find XSS, but they will not be able to understand advanced business logic in your application. So look for firms/testers that have public repos on Github that you can see some form of code quality and complexity.

Just a note, black-box pentests are about as valuable as automated scanners. They can provide you some high level issues, but you shouldn't use them to gauge yourself, cause they tend not to be very accurate. If you are looking for a real view, go with a white-box test. You will definitely get some recommendations out of it and they will be able to provide more specific feedback. The going rate when I was doing it at a firm was 10k USD a week. Each engagement was 1 week minimum. You'll likely be able to get it for 1/4 to 1/2 of that if you go with a contractor, no firm. Your cloud infra review shouldn't be more than a week, likely closer to 3 days if you have a small or standard infra. Application assessment will probably be a week minimum, and if you go with ASVS, make sure you have a developer on hand to do ad-hoc interviews about code segments and logic flow with the tester.

All of this really comes down to budget though. If you are not willing to shell out for that, I'd look at checking off some boxes in-house following what I described above and wait until you have the budget to go for a quality resource. Have one of your devs run some of the already existing cloud infra audit tools, go through the ASVS checklist and see if you can cover all the boxes. If you do have the budget however, I can recommend some firms.

Edit: An alternative approach would be to look for a firm that does more security design/architecture reviews than pentesting. If you are using modern frameworks these days and code linters, most of the low hanging fruit has been had and the real security issues tend to be at the architecture level.

Yes, I occassionally use them to audit the webapp: https://twitter.com/lakebed_io/status/1216447108393259008

It's quick, it's easy setup, and it's automated. The paid version will automatically run tests every month and you can supply a login so it can test the user auth.