How ISO 27001 certification works for a small SaaS company, how long it takes, and what it costs: audit days set by the standard, platform list prices, the mandatory internal audit, and the three-year cycle nobody budgets. With sources.
A worked STRIDE threat modeling example on a real AWS stack: the filled-in matrix, 29 findings, and the two categories that came back completely empty.
Audit fees, compliance platforms, pentests, and the engineering time nobody budgets. A realistic first-year SOC 2 number for a single-product SaaS team under 50 people, with sources.
Turning on RDS encryption satisfies the compliance question and stops almost none of the attacks that actually leak data. Here is what each layer of encryption at rest really defends against, on Postgres and AWS, and how to build the one that protects the sensitive field.
Environment variables are where secrets go to leak. Here is how to get them out, what each store actually buys you (and costs), and how to wire it into a Spring app without calling an API on every request.
Which password hash actually protects you, what the OWASP Password Storage Cheat Sheet recommends for Argon2id, scrypt and bcrypt, and measured numbers for tuning each one to a verification time your login path can absorb.
