Deals usually stall for ordinary reasons: vague answers, stale or missing evidence, no named owner, gaps with no plan, and contract terms that promise more than the product does. Few deals die over one missing certificate. Most are lost to friction that preparation removes.
The eight causes
1. Vague answers. "We follow best practices" gives a reviewer nothing to approve. Fix: answer yes or no first, then one specific sentence, then evidence.
2. Evidence that is old or missing. A policy dated three years ago, or a report that expired, makes reviewers doubt everything else. Fix: put review dates on documents and refresh on a calendar. See how fresh must compliance evidence be.
3. No security owner. Questions bounce between sales, engineering and the founder. Fix: name one person who coordinates and can answer in a day. See who owns SaaS security in a small company.
4. A gap with no plan. Missing a control is often survivable. Missing it with no explanation is not. Fix: state the gap, the compensating control, and a dated plan. See how to answer not applicable and compensating control.
5. Answers that disagree with each other. The questionnaire says one region, the subprocessor list shows another. Fix: one source of truth for facts, used by every document.
6. No independent testing. Buyers want a view from outside your team. Fix: a scoped penetration test with a retest. See which pen test document to share at each deal stage.
7. Identity gaps. No SSO, no way to enforce multi-factor authentication, no audit log. Fix: build in the order buyers ask. See what do enterprise buyers mean by SSO and SCIM requirements.
8. Overclaiming. Saying certified when you are in an audit period, or promising a response time your process cannot meet. Fix: state exactly what you have and nothing more. This is the one that can end trust, not just slow a deal.
A table to triage your own pipeline
| Signal in a stuck deal | Likely cause | First action |
|---|---|---|
| Reviewer asks the same thing twice | Vague answer | Rewrite with evidence |
| Reviewer asks for "latest" document | Stale evidence | Send a dated, current copy |
| Questions go to wrong person | No owner | Assign a coordinator |
| Reviewer flags an unmet control | Gap | Offer plan and mitigation |
| Legal and security disagree | Mismatch with contract | Compare terms to actual practice |
Measure what blocks you
After each review, tag the cause of any delay. After ten reviews, patterns appear. If most delays are cause 2, a calendar fixes it. If most are cause 7, product work is needed. This is better evidence for roadmap decisions than anecdotes. See how to stop customer requests from derailing a security roadmap.
What is not usually the blocker
A common worry is company size. Large buyers do buy from small vendors when the vendor shows control and honesty. See do you need a security hire before your first enterprise deal. A report from a particular auditor, a long list of badges and a huge questionnaire rarely decide an outcome on their own either.
Fix the cheap ones first
Causes one to five cost little: writing time and a calendar. Do those before spending on tools or audits. They also make every later investment pay off faster, because evidence collected for one buyer serves the next.
Safeguard's SBOM and dependency scanning can answer component questions that otherwise cause delays, and the free scan at gold.safeguard.sh/scan shows what a reviewer would see.
Quick check
Does lacking a SOC 2 report always block a deal?
No. Many buyers accept a questionnaire with evidence, or a clear plan. Others require the report. Ask early which applies.
What is the quickest fix for a stuck deal?
Usually a precise answer with evidence attached, sent in one message, to the exact question the reviewer asked.
Last reviewed: 19 October 2026.
