SaaS cybersecurity: What's the playbook?

It feels worth mentioning that there's lots of existing material on handling PII and implementing measures to comply with HIPAA and GDPR. Companies of every size should take handling of PII seriously and there's plenty that even a very early stage startup can do:

• HTTPS everywhere - certs are cheap/free these days. Assume that anything that you send over HTTP is being sniffed by an adversarial network.
• Make sure you're not using public S3 buckets to handle/store PII - use pre-signed S3 uploads/downloads with a private bucket.
• Delete PII that you don't need any more as soon as possible, don't store things that you don't need. Minimize your exposure.
• Secure your network resources, minimize infrastructure exposed directly to the public Internet - again, minimize your exposure.
• Use static analysis tools to scan your codebase for security issues (e.g. Bandit for Python)
• Keep your servers, software, and libraries up to date with the latest security patches
• Use modern HTTP security headers (e.g. https://www.globaldots.com/8-http-security-headers-best-practices/)

External third-party scans and vulnerability assessments can be useful, though, in my experience, unless you're paying for a full penetration test, they're likely just to prod your infra for open ports/services and make note of which HTTP security headers you're not using.

Definitely you need to secure the network database by building robust architecture, you can use third party services to plug loop holes . Let me know , if you want to try our service

In terms of cybersecurity, what do companies like us typically do?

A lot of assessments, code reviews, has their own SOC team or contract some.

But how do we know if we've been breached?

You need to implement some measures and then you need logs, logs everywhere. You need that your system/application warn you when some strange thing happens.

How often do we need to consult vulnerability assessments and code scans?

If you are a small company, try to implement a SDLC in your team that will be some thing huge for your security.

Do we need to hire a 3rd party internet security company to monitor our environment?

If you don't have some specialist then you need.

How much should we expect to pay per month and what should we expect in terms of services?

What country are your company from?