I am not sure a white hat is going to add value in most cases.<p>You have sensitive data and are worried about security. This is good (far too many people aren&#x27;t). Bang for buck though, you are going to do better with a very security minded developer. A good developer with OS knowledge can make sure your code base is safe from all the common vulns and follows best practices. In general, that would be a lot more useful to you than someone that would come in and maybe find a hole somewhere.<p>Now if you did something very nich like invented your own crypto algo, and you need a white hat crypto guy to go test it - sure - get an outside set of eyes. But for someone to check for root access being disabled over ssh and no SQL injections?  Seems overkill.  Fortune 500 companies will throw millions at white hats, and only find a few vulns. As a startup I don&#x27;t think you can do that (unless your funding rocks).