the security review is a second evaluation. start it with the POC

While the buyer’s engineers test your product, a different group tests your company. Security, risk, privacy, procurement and legal want to know whether you are safe to buy from. They rarely come to demos. They can stop a deal the technical team has already chosen, and when their review starts late, it moves the close date by weeks.

A security vendor gets the hardest version of this review. You are asking for privileged access, agents on endpoints or a connection into their identity systems. Expect the full treatment.

two evaluations, running at different speeds

The POC answers whether the product does the job. The security review answers whether the supplier is an acceptable risk. The two run on separate calendars.

Forrester’s State of Business Buying 2026, a survey of nearly 18,000 business buyers, counts 13 internal stakeholders and nine external influencers in a typical B2B purchase, and more for complex ones. The people who ran your POC are a few of those. The review team is several more.

The pressure behind the review is real. Whistic’s 2025 survey of more than 500 risk and security decision-makers, which is vendor-reported, found that 70% had suffered a breach in the previous three years and that 77% of those breaches came through a vendor or another third party. In Europe the law adds weight. NIS2 Article 21, through each country’s national law, requires in-scope companies to address supply chain security with their direct suppliers, including their suppliers’ secure development practices. DORA Article 30 lists what a bank’s or insurer’s contracts with ICT providers must contain, from data locations to audit and exit rights.

what the delay looks like

Public data on how reviews affect deals is thin and almost all of it comes from vendors who sell review software. Whistic cites a Conveyor survey putting the average enterprise security review at 3.1 weeks, with 52% of sales teams saying reviews had delayed deals. The sample is not published, so take the direction and leave the decimals.

From practice, reviews rarely kill a deal on their own. They delay it, usually because they started after the business decision, and the slowest part tends to be negotiating the data processing agreement and security terms, not filling in the questionnaire. A delay is dangerous anyway. Matt Dixon and Ted McKenna’s research puts 40% to 60% of B2B deals ending in no decision. A review that surfaces unresolved risk in the last month gives a nervous buyer a respectable reason to wait.

start it on the day the POC starts

Ask in discovery, before anyone installs anything: “Who will review us as a supplier, and what will they need from us?” Then open the review as a parallel workstream, with its own owner and date in the mutual plan.

The same review, started at two different moments

week 0week 12

Review starts after the readout

POC, weeks 0 to 6

Security review, weeks 6 to 10

Contract and data processing terms, weeks 9 to 12

Signature, week 12

Review starts with the POC

POC, weeks 0 to 6

Security review, weeks 1 to 5

Contract and data processing terms, weeks 5 to 7

Signature, week 7

Send the standard evidence first, before their questionnaire arrives:

1. Your current audit evidence. The SOC 2 report or ISO/IEC 27001 certificate, with its scope and period stated plainly.
2. A completed standard questionnaire. SIG or CAIQ, whichever your market uses. Shared Assessments lists SIG Lite 2025 at 128 questions, SIG Core at 627 and the full Detail at 1,936, so say which edition you completed.
3. A data flow diagram for this deployment. What data goes where, through which subprocessors, stored in which region.
4. Your data processing agreement and security terms. Pre-negotiated terms that most customers accept unchanged save more time than any questionnaire tool.
5. A named security contact. Someone who can join a 30-minute call with their analyst within days. One call resolves more follow-up questions than several rounds of written clarification.

Then ask whether this package covers their review tier. Many buyers triage suppliers by risk, and for some tiers the standard package is enough.

know what your evidence proves

Buyers’ analysts know the limits of each document. You should too, before they point them out.

• SOC 2 Type 1 versus Type 2. Type 1 assesses whether controls are designed properly at one point in time. Type 2 tests whether they operated over a period. Regulated buyers usually want Type 2.
• Scope. A SOC 2 report or ISO certificate covers what its system description or scope says. A newly acquired product, a separate region or an AI feature built on a third-party model may be outside it.
• ISO/IEC 27001. The certificate covers a management system within a scope. The Statement of Applicability says which controls apply. Know whether your company will share it under NDA.
• Penetration tests. The UK’s NCSC is clear that a test shows the absence of known issues within scope on the day of testing. It is not a clean bill of health.

None of these says your product is secure in the buyer’s configuration. That is what the POC and the architecture conversation are for.

the answer that costs most

The most expensive mistake in a review is answering “yes” to a control that is partial, planned or covered somewhere else. Describing the roadmap in the present tense. Saying “SOC 2 compliant” when only a Type 1 exists. Claiming “NIS2 compliant” for a product, when NIS2 obligations apply to organisations, not products. Questionnaire answers often end up in the contract, and an overclaim becomes a representation you can be held to.

Every vendor has gaps. Each one has an honest answer in one of four forms: the control exists and here is the evidence; it exists in a different form that meets the intent; it is planned, with a date the engineering owner has agreed; or it does not exist, and here is why the remaining risk is low for your use. Analysts are trained to spot hedged phrasing. A clear no with a reason earns more trust than a vague yes.

In a partner-led deal, the partner often receives the questionnaire. It cannot answer questions about your controls, and it should not paraphrase your answers. Give it the evidence pack and a direct line to your security contact.

the next POC

At the next kickoff, look at the plan and find the date when the security review starts. If there is no such date, or it falls after the readout, move it to week one. The guide on running a POC that ends in a decision covers the rest of the plan.