[snyff]

You can try bugcrowd, they won't qualify for "a reputable pentest organization" yet, but they will get stuff done and you can then argue that you had few hundreds hacker attacking your app.

Maybe you can talk to one of this "reputable pentest organization" and get them to drop the price if they can blog or use your startup as a show case for other potential clients. Pentest companies have a hard time advertising their services (it's "lemon market"), so everyone could win in that deal.