Security review became the sales cycle

For mid-market vendors selling into regulated buyers, elapsed time is now dominated by security and procurement review rather than by evaluation of the product.

Vendors who pre-assemble evidence — certification, penetration test summary, subprocessor list, data flow diagram — close materially faster. It is unglamorous and it is the highest-leverage work available to them.