Infrastructure Security Audit Before Launch: What a DevOps Engineer Checks for Your SaaS in 2026
A pre-launch security audit finds the gaps before your users do. Here is the 10-point infrastructure security checklist a DevOps engineer runs for UK, European, and US SaaS companies before launch.
Taukir katava
As a DevOps Engineer at Acquaint Softtech, a software development partner. Every SaaS product I audit before launch has security gaps. Not because the engineering team is careless, but because security is not the primary focus during the build phase. IAM roles accumulate permissions that were added for development convenience and never tightened. S3 buckets created for staging are still publicly readable. Database security groups allow connections from development laptops. A pre-launch security audit finds and closes these gaps before the product is exposed to real users and real attackers. This guide covers the 10-point security checklist a DevOps engineer works through before a SaaS launch.
- SaaS founders preparing for a public launch and wanting a security review before the product goes live to real users
- Engineering leads in the UK, Europe, or US who have been building in development mode and need a formal security check before launch
- Teams who have passed a SOC 2 readiness assessment but want an infrastructure-specific security review to complement it
- CTOs whose product is going to an enterprise client for the first time and want to ensure the infrastructure meets the client's security expectations
A pre-launch security audit is different from an ongoing security programme. It is a point-in-time review that establishes the security baseline before the product is exposed to real traffic. The goal is not to achieve perfect security in every dimension but to eliminate the obvious, high-impact gaps that an attacker or security researcher would find within the first week of the product being live. These are the ten check that a DevOps engineer runs before a SaaS launch.
For the ongoing security programme that follows the pre-launch audit, the DevSecOps 2026 guide covers all 7 DevSecOps practices a DevOps engineer embeds into the pipeline as a continuous security layer post-launch.
The 10-Point Pre-Launch Security Checklist
A DevOps engineer works through these 10 checks in the week before a SaaS product goes live. Each check has a pass/fail output. Failures are prioritised by severity and remediated before launch or documented as accepted risk with a remediation timeline.
Check 1: IAM Least-Privilege Audit |
Audit every IAM user, role, and policy attached to the AWS account for the product. Identify: users with AdministratorAccess who are not the account owner, service roles with overly broad permissions (S3:* when only s3:GetObject and s3:PutObject are needed), old developer access keys that have not been used in 90 days. |
Pass criteria: no service role has permissions beyond what is needed for its documented function. No unused access keys are active. MFA is enabled on all IAM users with console access. |
Check 2: Network Exposure Assessment |
Map every resource with a public IP or public DNS endpoint: EC2 instances, RDS instances, Elasticache clusters, S3 buckets, ALBs, API Gateways. For each: confirm that public exposure is intentional and that security groups or bucket policies restrict access appropriately. |
Pass criteria: no RDS or Elasticache instance is publicly accessible. No S3 bucket is publicly readable unless it is specifically a public asset bucket (CDN origin). EC2 instances only have ports open that are required for their function. |
Check 3: Secrets and Credentials Scan |
Scan the entire codebase (including historical commits) for hardcoded credentials using TruffleHog or GitHub secret scanning. Check CI/CD environment variables for long-lived AWS access keys. Verify that application configuration reads secrets from AWS Secrets Manager or Parameter Store, not from environment variables or .env files. |
Pass criteria: no credentials found in source code or CI/CD environment variables. All application secrets loaded from a managed secrets service at runtime. |
Check 4: Encryption at Rest and in Transit |
Confirm that: all RDS databases have encryption at rest enabled, all S3 buckets have server-side encryption enabled, all EBS volumes are encrypted, all ALB listeners redirect HTTP to HTTPS, all application endpoints use TLS 1.2 or higher, and ACM certificates are not expired and have auto-renewal configured. |
Pass criteria: no data store is unencrypted. No HTTP endpoint accepts data without redirecting to HTTPS. |
Check 5: Logging and Monitoring |
Confirm that: AWS CloudTrail is enabled in all regions, CloudWatch Logs are configured for the application, VPC Flow Logs are enabled, ALB access logs are enabled, and there is at least one alert configured for suspicious activity (failed login rate, unusual API call patterns, unexpected egress traffic). |
Pass criteria: all API and infrastructure activity is logged. At least one alerting rule is configured and tested. |
Check 6: Edge Security (WAF and CloudFront) |
Confirm whether an AWS WAF WebACL is associated with the CloudFront distribution or ALB. If not, assess whether the application's threat model requires WAF before launch (SaaS products exposed to the internet with login endpoints should have at minimum the IP Reputation List and Core Rule Group enabled). |
Pass criteria for launch: WAF enabled with IP Reputation List and Core Rule Group. ALB is not directly accessible from the internet (CloudFront-only origin access configured). |
Check 7: Database Security |
Confirm: RDS instance is in a private subnet, security group restricts database port (5432, 3306, 27017) to the application security group only, automated backups are enabled with appropriate retention, point-in-time recovery is enabled, database credentials are managed in Secrets Manager with rotation configured. |
Pass criteria: no database is accessible from outside the application security group. Automated backups enabled and tested (restore procedure documented). |
Check 8: Dependency Vulnerability Scan |
Run a full SCA (Software Composition Analysis) scan across all application dependencies. Identify critical and high CVEs in the dependency tree. Prioritise remediation of critical CVEs in packages that handle user input or authentication. |
Pass criteria: no critical CVEs in dependencies that handle authentication, session management, or user input. High CVEs in non-critical paths have a documented remediation timeline. |
Check 9: Container and Kubernetes Security (if applicable) |
If the product runs on Kubernetes: confirm Pod Security Standards are enforced on production namespaces, network policies are in place, no containers run as root in production, RBAC is scoped to least privilege, and secrets are loaded from Vault or Secrets Manager rather than Kubernetes Secrets. |
Pass criteria: no container running as root in production. No wildcard RBAC bindings. Network policies separating namespaces. |
Check 10: Backup and Recovery Test |
Confirm that: automated backups are enabled for all stateful services, a restore procedure exists and is documented, and the restore has been tested within the last 30 days. A backup that has never been tested is not a backup. |
Pass criteria: automated backups enabled. Restore procedure documented. At least one successful restore test completed and documented. |
For Check 6 specifically, the AWS WAF and CloudFront security guide covers the full WAF configuration including which rule groups to enable and in what priority order.
The Audit Output: What a DevOps Engineer Delivers
The pre-launch security audit produce a structured output that gives the engineering team a clear remediation plan. Here is what the audit deliverable contains.
Pre-launch security audit deliverable
1. Findings report (delivered within 5 days of audit start)
Each of the 10 checks rated: Pass / Fail / Partial
Each failure rated: Critical (block launch) / High / Medium / Low
For each failure: root cause, remediation steps, estimated fix time
2. Critical findings summary (1-page)
List of findings that must be resolved before launch.
Typically 0-3 critical findings on well-managed infrastructure.
Typically 3-8 high findings requiring remediation within 30 days.
3. Remediation plan
Prioritised list of fixes with owner, timeline, and verification method.
Critical findings addressed first. High findings addressed within 30 days.
4. Infrastructure security baseline document
Current-state documentation of the security posture at launch.
Used as the baseline for future audits and SOC 2 evidence.
5. Remediation verification (if engaged for follow-up)
DevOps engineer verifies that critical and high findings are resolved.
Provides sign-off statement for the engineering team or compliance team.
For the Kubernetes security checks (Check 9) in depth, the Kubernetes container security guide covers the 8-layer security stack with specific pass/fail criteria for each layer.
What It Costs: Pre-Launch Audit Rates for UK, Europe, and US in 2026
.webp "What It Costs: Pre-Launch Audit Rates for UK, Europe, and US in 2026")
The pre-launch security audit cost depends on the size of the infrastructure and the number of service. Here are the honest 2026 rates at Acquaint Softtech compared to in-house and agency options.
Audit scope | Cost at $22/hour | What is delivered |
Small SaaS (1-5 services, single AWS account) | 3 to 5 days: $528 to $880 | Full 10-check audit, findings report, remediation plan, critical issue fix verification |
Medium SaaS (5-15 services, multi-environment) | 5 to 8 days: $880 to $1,408 | Full audit + remediation of critical findings + baseline security documentation |
Large SaaS / pre-SOC 2 audit (15+ services, Kubernetes) | 8 to 14 days: $1,408 to $2,464 | Comprehensive audit + Kubernetes checks + SOC 2 readiness mapping + all critical fixes |
Audit + full security hardening (WAF, K8s security, IaC) | 14 to 20 days: $2,464 to $3,520 | Audit findings + implementation of all critical and high remediations |
Monthly retainer (post-launch ongoing security) | $3,200/month | Continuous security: quarterly audits, vulnerability monitoring, incident response |
In-house equivalent for comparison
UK in-house senior DevOps (security focus): GBP 85,000-120,000/year fully loaded
Germany / DACH in-house: EUR 95,000-130,000/year fully loaded
Netherlands in-house: EUR 90,000-120,000/year fully loaded
US in-house: $130,000-195,000/year fully loaded
Acquaint Softtech pre-launch audit (one-time): $528 to $2,464 depending on scope
Acquaint Softtech monthly retainer: $3,200/month
Acquaint Softtech's hire DevOps developers service provides pre-vetted engineers with pre-launch security audit experience. Starting at $22/hour or $3,200/month.
For the full DevOps rate comparison across the UK, Europe, and US, the DevOps engineer cost guide covers what each price tier delivers.
For understanding the cost of not doing the audit, the production security incident guide covers what the 6 most common post-launch security incidents cost to respond to.
Individual DevOps engineer for the audit through our staff augmentation model. Starting at $22/hour or $3,200/month. Available in 48 hours.
Frequently Asked Questions
-
What should a pre-launch infrastructure security audit include?
A comprehensive pre-launch security audit covers 10 areas: IAM least-privilege, network exposure, secrets and credentials, encryption at rest and in transit, logging and monitoring, edge security (WAF and CloudFront), database security, dependency vulnerability scan, container and Kubernetes security (if applicable), and backup and recovery test.
-
How long does a pre-launch security audit take?
A small SaaS product (1 to 5 services, single AWS account) takes 3 to 5 days to audit and produces a findings report with remediation plan. A medium SaaS (5 to 15 services) takes 5 to 8 days. A large SaaS with Kubernetes and multiple environments takes 8 to 14 days for a comprehensive audit including SOC 2 readiness mapping.
-
How much does a pre-launch security audit cost?
At Acquaint Softtech ($22/hour), a small SaaS audit costs $528 to $880, a medium SaaS audit costs $880 to $1,408, and a large or Kubernetes-based audit costs $1,408 to $2,464. Compared to a UK in-house engineer at GBP 85,000 to 120,000 per year, or a US engineer at $130,000 to 195,000 per year, the audit cost is recovered from the first month of the annual comparison.
-
What is the difference between a security audit and a penetration test?
A security audit reviews infrastructure configuration against a checklist of known security best practices. A penetration test actively attempts to exploit vulnerabilities. For a pre-launch SaaS product, a security audit is the appropriate starting point: it identifies configuration gaps that should be closed before exposing the product to a penetration test. Running a penetration test on unaudited infrastructure wastes budget finding basic configuration issues.
-
What are the most common critical findings in a pre-launch security audit?
The three most common critical findings in pre-launch audits are: hardcoded credentials in source code or CI/CD environment variables, publicly accessible RDS or Elasticache instances without security group restrictions, and IAM roles with AdministratorAccess used by application services. All three are quick to find and quick to fix once identified.
-
Do I need a security audit before going live with my first enterprise client?
Yes. Enterprise clients in the UK, Europe, and US routinely require evidence of security controls before signing contracts. A completed pre-launch security audit produces the infrastructure security baseline documentation that answers the security questionnaire. Without it, the sales cycle either stalls or proceeds with unresolved security gaps that will need to be closed under time pressure.
-
How does Acquaint Softtech deliver the audit findings?
The audit deliverable includes: a 10-check findings report (each check rated Pass/Fail/Partial), a critical findings summary (1 page), a prioritised remediation plan with owner and timeline, an infrastructure security baseline document, and optional remediation verification (DevOps engineer confirms critical findings are resolved). Delivered within 5 days of audit start for small to medium SaaS products.
Taukir Katava is a DevOps Engineer at Acquaint Softtech with 4+ years of experience across AWS, Azure, and GCP. He specialises in Kubernetes cluster administration, CI/CD pipeline automation, and cloud infrastructure design for high-traffic platforms. Taukir writes about the practical side of production DevOps: what infrastructure decisions cost and what they actually deliver.
Table of Contents
Get Started with Acquaint Softtech
- 13+ Years Delivering Software Excellence
- 1300+ Projects Delivered With Precision
- Official Laravel & Laravel News Partner
- Official Statamic Partner
DevSecOps Engineer Cost in 2026: What Security-First DevOps Actually Costs to Hire
A DevSecOps engineer costs more than a standard DevOps engineer, but the premium is smaller than most teams expect. Here is the honest 2026 cost breakdown for UK, European, and US SaaS teams.
Ahmed Ginani
June 24, 2026
Cloud Infrastructure Cost Optimisation: What a DevOps Engineer Saves You in the First 90 Days
Cloud infrastructure waste accumulates silently across 8 categories. Here is what a DevOps engineer audits, what they fix first, and what savings look like across a 90-day engagement in 2026.
Taukir katava
May 19, 2026
CI/CD for Kubernetes on AWS EKS: What a DevOps Engineer Builds and What to Budget in 2026
CI/CD for Kubernetes on AWS EKS requires more than a standard pipeline. Here is what a DevOps engineer builds, which tools they choose, and what to budget in 2026.
Taukir katava
May 13, 2026India (Head Office)
203/204, Shapath-II, Near Silver Leaf Hotel, Opp. Rajpath Club, SG Highway, Ahmedabad-380054, Gujarat
USA
7838 Camino Cielo St, Highland, CA 92346
UK
The Powerhouse, 21 Woodthorpe Road, Ashford, England, TW15 2RP
New Zealand
42 Exler Place, Avondale, Auckland 0600, New Zealand
Canada
141 Skyview Bay NE , Calgary, Alberta, T3N 2K6