map the buying committee before the demo

Map the buying committee before the first demo, on one page: who decides, who evaluates, who can stop the deal, and who outside the company they will ask. Then make sure each of them gets the proof they need, in the form they need it. Many security deals that go quiet were not lost in a demo. They were lost in a room you weren’t in.

more people than you meet

Forrester’s State of Business Buying 2026, a survey of nearly 18,000 business buyers, puts a typical purchase at 13 internal stakeholders and nine external influencers, and more for complex or strategic ones. A security platform for a regulated company is both.

In a typical evaluation you meet three or four of them: the champion, a couple of engineers, maybe their manager. The others hear about you in a summary, a slide or a hallway conversation. Your job is to make sure that summary is accurate, and that each person on the list has what they need before the decision meeting.

The committee also tends to disagree. Gartner’s 2024 survey of B2B buyers found unhealthy conflict in 74% of buying teams, and teams that reached consensus were 2.5 times more likely to report a high-quality deal. A champion who likes you is the start. A committee that agrees is the deal.

who is usually in the room you aren’t in

The names change by company. The roles in a security purchase are fairly stable:

Role	Needs to see before saying yes	Proof that works	When they show up
Security lead (often the champion)	The problem solved in their environment, and a story they can defend upwards	POC results against criteria they signed	From the start
Engineers who evaluate	It works, integrates and doesn’t drown them in alerts	Hands-on time, documentation, honest limits	POC
IT or infrastructure	It won’t break production or add a system nobody can run	Architecture, deployment plan, who supports it	Late, unless you invite them
Procurement	A fair price and a clean process	Price logic, references, standard terms	After the technical win
Legal and privacy	Acceptable contract and data terms	Data processing agreement, data locations, security evidence	After the technical win, if you wait
Finance	Worth the money this year	A business case in their numbers	Budget cycle
Business or board sponsor	The risk is handled and someone owns it	One page they can read without you	The final step

Two shifts matter in Europe. NIS2 makes management bodies of in-scope companies responsible for approving cybersecurity risk measures (Article 20, through national law), so a board-level sponsor appears more often than it used to. And in channel-heavy markets an integrator or reseller sits in the external group for almost every deal.

the nine you’ll never meet

The external influencers are easy to forget, because they don’t come to meetings. In security they are usually:

• The integrator or reseller who will deploy or resell it, and whose opinion the buyer trusts.
• A consultant or auditor who wrote the finding that started the project.
• Peers. Another CISO who runs a similar product, asked over a coffee or a message.
• Analysts and reviews, read before your first meeting.

You can’t sit in those conversations. You can make sure a partner knows the product well enough to recommend it, and that a reference customer is ready to take the call. The guide on the day-one shortlist covers how buyers form their list before they call anyone.

map it in one discovery call

You don’t need a special meeting. Four questions in the first or second call cover most of it:

1. “Who else needs to be comfortable with this before anyone signs?” Write down names and roles, not departments.
2. “Who signed the last security purchase of a similar size, and how long did it take?” The answer shows the real approver and the real paper process.
3. “Who could stop this?” People answer this one more honestly than “who decides”.
4. “Who outside the company will you ask?” The partner, the consultant, the peer.

Then ask the champion one more: “What will each of them ask you about us?” The answers become your list of proof to prepare.

help the committee agree

A champion carries your case into meetings you don’t attend. Give them something they can carry:

• A one-page business case in the buyer’s language and numbers, readable without you in the room.
• Answers for the people who can stop the deal, sent early. Start the security review alongside the POC, not after it. The guide on running the security review in parallel explains why.
• A short list of options with your recommendation. More material rarely helps a group that already disagrees. A clear choice does.

Watch for the signal that the committee is not aligned: the champion says yes, the next step has no date, and new people appear with new questions late in the process. That is the pattern the guide on “no decision” describes, and the no-decision deal check helps you name what is going on.

the next first call

In the next discovery call, ask “who could stop this?” before you show anything. If the answer is “nobody, it’s my decision”, ask who signed the last purchase of a similar size. The two answers are rarely the same.