The G2 2025 Buyer Behavior Report finds that "IT security review is the single biggest source of delay after a vendor is selected, cited by 39% of buyers, rising to 50% among enterprise buyers." It notes that security, legal, and procurement stakeholders often introduce additional review cycles that extend or stall deals, particularly in larger B2B software purchases.

When we asked who raises the biggest objections in a purchase, IT and Security were top of the list at 38%, while Finance and Procurement came in second at 30%. Budget approval (34%) was the top bottleneck for deals, while security concerns were third at 20%.

Analysis of 847 enterprise deal losses reveals that 34% cite security or compliance concerns as primary decision factors. Another 23% mention them as significant contributors. When 30–40% of enterprise losses cite compliance gaps, certification investment becomes urgent.

Once a buyer has a shortlist, IT security review is the single biggest source of delay (39%) between selecting a vendor and completing a purchase. Budget approval is next at 32%, followed by implementation planning at 25%. For enterprise buyers, the bottleneck is even sharper: 50% name IT security review as their top post-selection delay.

Sales teams lose an estimated 23–31% of otherwise winnable deals to non-product factors, according to research aggregated across enterprise software buyers. When we analyzed win-loss interviews from deals over $100K, procurement, security, and legal objections appeared in 67% of lost deals—yet these stakeholders represented only 12% of the people sales teams actually spoke with during the sales cycle. Win-loss analysis from enterprise software deals reveals that security objections cause 18–24% of late-stage deal losses, with the majority surfacing after initial technical evaluation completes.

In short, 34% of lost enterprise deals are killed by a stakeholder your sales team never met — surfacing late from finance, procurement, IT security, or the board. These invisible vetoes typically come from finance, procurement, IT security, or the board — not the buying committee.

|Segment|Avg objections|Top objections|Note| ... |Enterprise ($100K+)|3.9 obj|Security, legal, authority|Multi-threaded buyers. Objections surface across 4–8 calls.| ... Security, legal, and authority objections skew sharply toward enterprise. 71% of enterprise deals surface a security objection; only 8% of SMB deals do. Legal objections appear in 58% of enterprise vs 4% of SMB.

According to Gartner Digital Markets’ research, concerns about security and cyberattacks (47%) are a top trigger of software investments, second only to productivity improvements (52%). The increased focus on security is particularly pronounced among enterprise (60%) and midsize business (54%) software buyers. These data relate to security as a trigger for investment, not to the share of enterprise B2B deals where IT and Security raise the biggest objections, and no 38% figure is reported.

According to a report, built on analysis of thousands of actual buyer-vendor interactions, more than half of B2B buyers raise security in their very first meeting with a vendor. That figure was 28% in 2023. It has nearly doubled in two years. 94% of respondents said their customers would not buy from them if they did not adequately protect data. 98% said external privacy certifications are an important factor in their buying decisions. 52% of buyers now choose vendors based on certifications and data privacy posture. 57% replaced a SaaS provider specifically because of unresolved security issues. 61% of enterprise buyers require InfoSec sign-off before purchase, not after.

A reference guide for MSP and cybersecurity sales on LinkedIn lists "security" among the most common sources of late‑stage objections in B2B technology deals. The author describes observing multiple enterprise opportunities derailed when IT and security stakeholders raised concerns around risk, compliance, or missing certifications, often after commercial terms were largely agreed.

Enterprise readiness for startups is the term for the gap between “works for 50 SMB customers” and “passes Fortune 500 vendor assessment.” Most startups with functional products fail enterprise sales not because the software is bad, but because the infrastructure around it—security controls, compliance posture, support SLAs, organizational process—doesn’t meet institutional risk thresholds. Your biggest risk: Security & Compliance. Without SOC 2 and a prepared security questionnaire, your deals are dying at the CISO review — “not a good fit right now” is masking a compliance gap.

Looking specifically at the concerns SMBs have about security in 2023, we found that lack of time to manage security was the biggest security concern facing businesses (25%), followed by data loss or data theft (23%), ransomware attacks (12%), and DDoS attacks (10%). Finally, we looked at the biggest challenges SMBs and startups face in securing their business and found that lack of time to focus on security was the most cited challenge (53%), followed by keeping up with changing threats (48%), cost of security solutions (40%), and lack of security expertise (40%). Nineteen percent said that assessing vendor security was a challenge. The report covers SMB security challenges and does not address what proportion of enterprise B2B deals have IT and Security raising the biggest objections or any 38% figure.

Recent industry surveys suggest that over 70% of enterprise deals now include formal security reviews, up from just 40% five years ago. More tellingly, these reviews add an average of 18 days to sales cycles, with some complex deals seeing delays of 6–8 weeks.

Gangly’s guide on cybersecurity sales objections states that budget, complexity, and trust are recurring themes, but it emphasizes that security and compliance concerns are disproportionately represented in enterprise and regulated‑industry deals. It notes that security objections frequently escalate to solution engineering and legal teams and are often decisive in whether larger B2B cybersecurity contracts move forward or stall.

The headline number is stark: 54% of companies report losing deals because they could not complete security questionnaires on time. A security questionnaire is a standardized assessment that prospective buyers send to vendors before signing contracts. It evaluates the vendor's cybersecurity posture, data protection practices, compliance certifications, and risk management procedures.

Leveraging certifications (ISO 27001, SOC 2, HIPAA) in your sales pitch is non-negotiable for enterprise SaaS. When a prospect raises a security concern, you shouldn't just state you're secure; you should present your certifications as concrete evidence. Being prepared means having the right resources at your fingertips, including a security overview document and a dedicated 'Trust Center' page, to address common SaaS sales objections before they fully materialize.

In HR tech and enterprise software specifically, 74% of stalled deals stall at the business case demand state, driven by ROI model rejection from finance and security review delays from procurement. At the committee approval stage, a common stall point is "Security and DPA (data processing addendum) review."

63% of enterprise buyers now require a formal security questionnaire before selecting a vendor — and slow responses add 3–6 weeks to deal cycles. Zero-trust architecture and SOC 2 Type II certification are the two most commonly required security postures in enterprise procurement.

More than four out of ten survey respondents (42.8%) said that a lack of cybersecurity knowledge and expertise is their company’s biggest blocker to effective cybersecurity, while insufficient personnel and insufficient budget was noted as the biggest blocker to effective cybersecurity for 25% and 23% of respondents, respectively. This survey focuses on blockers to effective cybersecurity programs, not on objections in enterprise B2B deals, and it does not contain a claim that IT and Security raise the biggest objections in 38% of such deals.

Prospeo’s 2026 data‑backed guide on B2B sales objection handling, based on 300M+ analyzed cold calls, finds that nearly half (49.5%) of objections are dismissive brush‑offs such as "not interested" rather than substantive issues like security or IT. It reports that situational objections, which include budget, timing, and internal processes, comprise 42.6% of objections, with security usually categorized under risk or technical blockers rather than being the single largest category overall.

Enterprise deals with 7+ stakeholders often surface new concerns at every stage — discovery, demo, procurement, and legal review — so multi-threading is essential. Don't wait for the ask. Build a security packet – SOC 2 status, DPA template, data residency details – and offer it during the first technical call. "We know security review is part of your process. Here's everything your team will need."

Win-loss analysis from enterprise software deals reveals that security objections cause 18-24% of late-stage deal losses, with the majority surfacing after initial technical evaluation completes. The article emphasizes the role of procurement, security, and legal stakeholders in slowing or stopping deals but does not claim that in 38% of enterprise B2B deals IT and Security raise the biggest objections. No 38% figure tied to IT/Security objections is presented.

A sales discussion thread notes that common B2B objections cited by practitioners include price, timing, and perceived lack of urgency, with IT and security frequently mentioned as late‑stage blockers in technology deals. Several commenters describe scenarios where security review or IT requirements introduced new objections that prevented otherwise promising enterprise contracts from closing.

The expansion of stakeholders – in the decision making process, the number is now in double digits, and in most cases, you won’t meet half of them. Indecision – a newer phenomenon based around making the wrong decision and making a mistake as a result of budgets being tight and the spotlight on investments. 1. Understand All Decision-Makers and Their Motivations.

Several cybersecurity-related challenges can contribute to sales friction in B2B transactions: Lengthy vendor security assessments – Many enterprise buyers require vendors to complete detailed security questionnaires and audits before approving a contract. These assessments can take weeks or even months to complete if the vendor isn’t prepared. Lack of security certifications – Businesses without recognized security certifications (e.g., SOC 2, ISO 27001, PCI DSS) may face additional scrutiny and delays during procurement evaluations.

Objection 30 — "Our IT/security team has to approve everything." Pre-empt rather than react. "Totally — when's a good time to loop them in? I'd rather get the security review started early than have it become the long pole." Reps who proactively initiate security review shorten their sales cycle by weeks, not days.

Wherever your product could create some sort of legal, security, technical or compliance friction, there will be a Chief Objection Officer who wants to block this purchase. The best way to overcome objectors is to be proactive. Make your product objection-proof; arm your sales team with sales enablement strategies that reassure the main Chief Objection Officers you’ve identified; and improve communication, documentation and support to head off objections before they occur.