Enterprise security reviews went from 20 questions to hundreds of rows, and vendors pay first

The workbook functions as a specification, and it arrives before the money does. Each row asking whether access follows the buyer's own identity provider, whether logs can be exported into their monitoring tools, where the data physically lives and whether any customer content trains an AI model ^[4] is a build item with a contract date attached to it, and the date falls before signature.

Not every row costs the same. Following Microsoft Entra groups, enforcing MFA and conditional access, and deprovisioning a departing administrator quickly ^[6] is integration work of a known shape. Making the permission model govern reports, admin views, exports and integrations exactly as it governs the main interface ^[7] is harder, because every surface that emits data has to agree with every other one. Unlu writes that he is repeatedly asked to show which roles can open compensation-related notes, then show what the export contains, on the logic that an export revealing more than the interface means a boundary has been moved ^[8]. That is a test a small team can fail quietly for years, because nobody opens the CSV during a demo.

Keys and geography are the expensive end. Encryption at rest and in transit is now the floor ^[16], and above it sit questions about where keys are stored, who can reach them, how they rotate and who manages them ^[16]. Customer-managed keys, dedicated environments and regional controls add cost and complexity, and Unlu reports they are entering procurement conversations for regulated industries and large global enterprises ^[9]. A shared multi-tenant deployment does not acquire per-customer residency through a settings change.

The arithmetic deserves stating plainly. Roughly 20 questions then ^[2], hundreds of rows across multiple tabs now ^[3], which is an increase of at least ten times in question count ^[14]. The older set could be closed by attaching documents the vendor already had ^[2]; the current set comes with evidence requests ^[3]. SOC 2, ISO 27001 and penetration tests attest to a prior period and act as the entry requirement ^[10], while the buyer's exposure is present-tense, which is why the ask is for access reviews, audit trails, incident history and exportable logs on a continuous basis ^[11].

A caveat about provenance. This is one vendor's account, published as a Forbes Tech Council contribution ^[15], and Unlu sells performance management software built for Microsoft 365 ^[1]. A vendor whose product is already wired into Entra benefits when buyers treat Entra alignment as the standard. The one figure not drawn from his own pipeline is Gartner's: sovereign-cloud spending reaching $80 billion in 2026, with a fifth of workloads moving from global providers to local ones ^[13].

For a small vendor selling into large enterprises, this is an ordering problem more than a budget one. The controls have to exist before the first enterprise deal, so that deal funds none of them and is priced against work already finished, in a category where the stored text includes manager assessments, promotion notes and compensation-related comments ^[5]. The vendors who lose these cycles will not lose them on price.