There are some services out there that will scan you for vulnerabilities, but I have yet to find a really slick way to integrate security "for free" into your own servers/services.

This would mean at minimum:

1. apt-get install X. Automatically decent kernel/network/firewall configuration occurs, removes cleartext passwords from ssh and changes the port, etc etc. This is just a base starting line.

2. malicious user detector. Probably cooperating with an API within ruby/jvm/python/php/whatever is a mixpanel-like way I can define custom events and possible milestone-firewalls. E.g. this is a new user sign up, here are the relevant fields & ip. Or here's a comment on an image from user X with IP Y. Rather than having to figure out if we're likely being abused outsource that decision to the service & have it help you block the evil-doer.

3. APIs to help with usernames/passwords, setting up TLS & perfect forward secrecy, etc. That is to say, give me patterns I can use that every app has even with some level of customization.

4. Have built in DDOS protection, particularly for resource starvation attacks that might be more app-specific (request X took Y>Z time, and it's being repeated endlessly).

I understand that security is complicated, ideally should have full time staff, every app/service is different, ya yada. Except when you're starting out you don't have these kinds of resources and something like this could get one quite far, not to mention be able to see much of the internet and what's happening across clients (like gmail with spam) and thus have an advantage over you. It seems like a giant hole in the world of app development and most people are terrible at security when it comes down to doing anything more than firewall + ssh keys + bcrypt user passwords.