01 · Application security
OWASP Top 10, secure SDLC, code review.
OWASP Top 10 mitigation as default. Secure-coding practices in code review. SAST and DAST in CI pipelines, not as an afterthought.
Service · Security
Software security solutions.
Threat detection, vulnerability assessments, encryption, and compliance. Application security engineered into the build, not bolted on after launch. From OWASP Top 10 mitigations to compliance posture for HIPAA, SOC 2, PCI DSS.
Our expertise
Threats, vulnerabilities, encryption, compliance.
Software security as a continuous discipline, not an annual audit. Engineered into design, validated in CI, monitored in production, audited annually.
02 · Penetration testing
Annual third-party plus continuous internal.
Annual third-party penetration testing on production. Internal security reviews per release. Findings tracked through remediation, not just reported.
03 · Compliance frameworks
HIPAA, SOC 2 Type II, PCI DSS.
Compliance posture for the frameworks your business needs. Audit-ready documentation, control mapping, and operational practices that pass real audits.
04 · Vulnerability management
Dependency scanning, CVE tracking, patch cycles.
Continuous dependency scanning (Snyk, Dependabot, custom). CVE tracking with severity-based response SLAs. Documented patch cycles tuned to risk.
Capabilities
Identity, encryption, audit, response.
The security capabilities that production systems need. Identity done right. Encryption for the data that matters. Audit logging that satisfies compliance. Incident response that has been practiced.
Identity & access management
OAuth 2, OIDC, SSO, MFA, RBAC.
Authentication patterns that scale. Single sign-on with corporate identity providers. Multi-factor authentication enforcement. Role-based access control that maps to business permissions.
Encryption
At rest, in transit, key management.
TLS everywhere, including internal services. Encryption at rest with proper key management. Field-level encryption for high-sensitivity data. Key rotation as a continuous practice.
Audit logging & monitoring
Tamper-resistant logs, SIEM integration.
Audit logs that satisfy compliance auditors. Tamper-resistant log delivery. SIEM integration for the clients that have one. Anomaly detection on access patterns.
Incident response
Runbooks, escalation, post-mortems.
Documented runbooks for common incidents. Escalation paths in writing. Blameless post-mortems that fix systems. Annual tabletop exercises for the scenarios we have not seen.
How we work
Four phases. Same team across all four.
The phases that apply to every engagement, not just software security. The team that scopes does the building, and the operating.
-
Phase 01 · 2–4 weeks
Discovery and scope.
Stakeholder interviews, technical review of existing systems, risk register, written scope with milestones and exit criteria.
-
Phase 02 · 3–12 months
Build and iterate.
Two-week sprints with working demos. Senior leads on every sprint review. Code reviewed, accessibility checked.
-
Phase 03 · 2–6 weeks
Cutover and stabilization.
Parallel run with rollback path. On-call coverage during the launch window. Stabilization continues until incident rate trends to zero.
-
Phase 04 · ongoing
Operate and evolve.
Multi-year retainer with the same team that built the product. Monthly check-ins, quarterly business reviews.
Read the full engagement model on the How We Work page.
Industries we serve
Software Security across 15 verticals.
Six core verticals where OST has the deepest engagement experience. Plus nine adjacent industries served on selective engagements.
01
Education
K-12 charter networks, higher education, public sector portals.
02
Nonprofit & Civic
Donor-cycle nonprofits, advocacy organizations, civic platforms.
03
Healthcare & Wellness
HIPAA-aware platforms, medical directories, telemedicine adjacency.
04
Real Estate Technology
Multi-tenant SaaS, brokerage tools, self-storage operators.
05
E-commerce & Marketplaces
OpenCart specialists, custom commerce, $10B+ in transactions processed.
06
Manufacturing & B2B
Industrial platforms, B2B safety-tech, embedded engineering teams.
Also serves on selective engagements
Frequently asked questions
Common questions on software security engagements.
What compliance frameworks do you support?
HIPAA for healthcare clients. SOC 2 Type II for B2B SaaS. PCI DSS for commerce. State privacy laws (CCPA, CPRA, etc.). GDPR-compatible practices for EU exposure.
How do you handle penetration testing?
Annual third-party penetration testing on production for engagements that warrant it. Internal security review per release. Findings tracked through remediation in your issue tracker, not just dropped in a PDF.
What about vulnerability management?
Continuous dependency scanning in CI. Severity-based response SLAs (critical: 24h, high: 7 days, medium: monthly cycle, low: quarterly). Documented patch cycles, not panic-driven.
Can you do incident response?
Yes, on retainer. Documented escalation paths, 1-business-hour response on production incidents during business hours, weekend coverage on retainer. Runbooks for common scenarios.
Will you sign a BAA for HIPAA?
Yes for engagements where it applies. We sign BAAs as standard practice for healthcare clients and route their PHI through HIPAA-aware infrastructure.
Ready to build?
Pick a path forward.
Multiple ways to start: schedule a discovery call, run our cost calculator for a budget bracket, or use the contact form for a written response.