The product won the evaluation. The team liked you. Then a questionnaire arrived, the thread went quiet, and six weeks later you were told the timing was not right.
The deal did not die on the product. It died in the security review, and almost nobody treats that stage as something marketing owns.
The security review is a go-to-market stage
Every company past a certain size runs one. A vendor gets a questionnaire, a request for certifications, a data processing agreement and a list of questions about sub-processors. Someone in security or compliance reads the answers. That person has no interest in your roadmap and no incentive to approve you.
Most vendors meet this stage unprepared, because internally it belongs to nobody. Sales treats it as paperwork. Engineering treats it as an interruption. Marketing has never heard of it. So the answers get assembled in a panic by whoever is free, and the quality of that scramble decides the deal.
That is the first thing to accept: a stage that decides revenue is a go-to-market stage, whatever department the email lands in.
What actually arrives
The shape is predictable, which is the good news. A typical review asks for some combination of a completed security questionnaire, a SOC 2 report or ISO 27001 certificate, a penetration test summary, your sub-processor list, data residency and retention details, an incident response and breach notification commitment, and access control and encryption specifics.
None of that is exotic. The problem is that it is requested under a deadline, from a company that has never written it down, and the gap between having good practices and being able to evidence them in a week is where deals stall.
The new questions nobody has answers for
Something changed in the last two years. The questionnaires now ask about AI.
Which models do you use. Does our data train them. Which sub-processors see it. Who signed off on the system. What happens when it is wrong. How do you know it is not drifting. Under which regime does any of this fall.
These questions are being asked of companies that do not think of themselves as AI companies at all, because a support assistant, a summarisation feature or an enrichment step is enough to trigger them. Most vendors answer with a sentence about using a trusted provider, which reads to a reviewer as not having looked.
The companies that answer well are not the ones with the best governance. They are the ones who worked out what they were being asked before the question arrived.
Preparation is not certification
This is the distinction that saves the most time, so it is worth being blunt about it.
Certification is a formal process with an accredited body, a defined scope, an audit and a certificate at the end. Preparation is the work that happens before any of that: establishing which regimes your systems actually fall under, finding the gaps, writing down what is already true, and deciding what to fix and what to disclose.
Plenty of companies start the expensive process before they have done the cheap one, and discover halfway through that the scope was wrong. Plenty of others need no certificate at all for the deal in front of them, only clear and consistent answers. Knowing which position you are in is itself the first deliverable.
Publish the answers before they are requested
The highest leverage move is to stop treating this material as private.
A trust page that carries your certifications, sub-processor list, data handling summary, uptime record and security contact answers a third of the questionnaire before anybody sends it. It also reaches the reviewers you never meet, who are forming a view from whatever they can find. The committee deciding your deal is mostly made up of people you will never speak to.
Three things make this work in practice. Keep one maintained answer bank, so two salespeople cannot send a buyer two different answers. Publish what can be public and gate only what genuinely needs an NDA, because a document behind a form is a document that arrives three days late. State your limitations plainly, because a reviewer who finds one honest gap trusts the rest of the page, and one who finds none assumes you are hiding the list.
What this is worth
Companies that prepare report the same two things. The review takes weeks instead of months, and it stops being the stage where deals quietly disappear.
The second one matters more. A slow review is a cost. A review you cannot survive is a ceiling on which customers you are allowed to have, and most founders discover that ceiling long after they have built the pipeline that keeps hitting it.
If your buyers are security teams, this is not an operations problem you will get to later. It is part of how you go to market, and it belongs next to your positioning. That is what compliance readiness covers, and the wider approach is on cybersecurity marketing.
The short version
Your buyer's security review is a stage in your funnel. Treat it like one.
Work out which regimes apply to you before somebody else does it for you, write the answers down once, publish what you can, and say what you cannot do. The vendors who win this stage are not the most secure ones. They are the ones who were ready to prove it.
