reference · checked 31 Oct 2026
numbers.
Every external figure the guides rely on, checked again at its source: who published it, what sample it rests on, what it measures and what it doesn't. Below them, the figures that circulate in the industry and did not hold up when I looked.
118 figures, by kind of source
- vendor survey29
- official statistics27
- vendor documentation20
- law or regulation19
- analyst survey14
- media report8
- industry body1
- 1a number with its sourcenamed in the sentence with the year, linked at the end of the guide, listed here.
- 2an observation from practicelabelled as mine in the guide, never shown here as a statistic.
- 3a hypotheticalmarked as illustrative, with inputs you replace with your own. Not listed here.
1st
place in the EF English Proficiency Index 2025 goes to the Netherlands, among 123 countries and regions
- measures
- A country ranking based on scores in EF's online English test.
- doesn't show
- Test-takers select themselves, so the ranking leans toward younger and more motivated adults.
72.9%
of adults aged 18 and over in Sweden could be reached with LinkedIn ads in late 2025
- measures
- LinkedIn's reported advertising reach as a share of the adult population.
- doesn't show
- LinkedIn counts registered members, so the figure overstates active use and works best as a comparison between countries.
71.2%
of adults aged 18 and over in France could be reached with LinkedIn ads in late 2025
- measures
- LinkedIn's reported advertising reach as a share of the adult population.
- doesn't show
- LinkedIn counts registered members, so the figure overstates active use and works best as a comparison between countries.
34.7%
of adults aged 18 and over in Romania could be reached with LinkedIn ads in late 2025
- measures
- LinkedIn's reported advertising reach as a share of the adult population.
- doesn't show
- LinkedIn counts registered members, so the figure overstates active use and works best as a comparison between countries.
34.3%
of adults aged 18 and over in Germany could be reached with LinkedIn ads in late 2025
- measures
- LinkedIn's reported advertising reach as a share of the adult population.
- doesn't show
- LinkedIn counts registered members, so the figure overstates active use and works best as a comparison between countries.
29.4%
of adults aged 18 and over in Poland could be reached with LinkedIn ads in late 2025
- measures
- LinkedIn's reported advertising reach as a share of the adult population.
- doesn't show
- LinkedIn counts registered members, so the figure overstates active use and works best as a comparison between countries.
25.2%
of adults aged 18 and over in Hungary could be reached with LinkedIn ads in late 2025
- measures
- LinkedIn's reported advertising reach as a share of the adult population.
- doesn't show
- LinkedIn counts registered members, so the figure overstates active use and works best as a comparison between countries.
about 303,000
enterprises with 50 or more employees operated in the EU business economy in 2023
- measures
- The number of enterprises in the 50 to 249 and 250+ employee size classes added together.
- doesn't show
- Public administration is excluded, and a group with several legal enterprises counts more than once.
source: Eurostat: enterprise statistics by size class (2023)
25% and 16%
of vendors and of partners respectively see distribution as a source of channel conflict, in a Channelnomics survey
- measures
- How many vendors and partners name distribution as a source of channel conflict.
- doesn't show
- The page gives no sample size or method, and it measures how people perceive conflict with no count of actual conflicts.
source: Channelnomics: the changing face of channel conflict (2024)
used in: one distributor per country or two: the arithmetic for a mid-sized European market
3,547
enterprises in Poland had 250 or more persons employed in 2023, against 1,759 in Czechia and 1,666 in Romania
- measures
- How many large enterprises each country has, a first proxy for the number of organisations an enterprise security product can sell to.
- doesn't show
- It counts enterprises of every sector and leaves out public administration, so cut it by sector and by the technology your product needs.
source: Eurostat: enterprises by size class, sbs_sc_ovw (2023)
used in: entering central and eastern Europe country by country: which market first, and through whom
14,976
enterprises in Germany had 250 or more persons employed in 2023, more than four times the Polish count
- measures
- The number of large enterprises in the largest EU market, as a scale against which central European markets are judged.
- doesn't show
- Market size alone does not decide entry order; partner availability and regulation timing matter as much.
source: Eurostat: enterprises by size class, sbs_sc_ovw (2023)
used in: entering central and eastern Europe country by country: which market first, and through whom
EUR 34.9
was the average hourly labour cost in the EU in 2025, against EUR 12.0 in Bulgaria, EUR 13.6 in Romania and EUR 15.2 in Hungary
- measures
- What an hour of work costs an employer, which is what buyers and partners compare a licence price with.
- doesn't show
- It is an average across sectors; IT and security salaries sit well above it in every country.
source: Eurostat Statistics Explained: hourly labour costs (2025)
used in: entering central and eastern Europe country by country: which market first, and through whom
EUR 19.1
was the average hourly labour cost in Poland in 2025, against EUR 19.8 in Czechia and EUR 45.0 in Germany
- measures
- The local cost of staff in the two largest central European markets, against which partners price their services.
- doesn't show
- It is an average across sectors; specialist security engineers cost more.
source: Eurostat: labour cost levels, lc_lci_lev (2025)
used in: entering central and eastern Europe country by country: which market first, and through whom
15th
is Poland's rank in the EF English Proficiency Index 2025, behind Slovakia (10th) and Romania (11th) and ahead of Hungary (22nd) and Czechia (23rd)
- measures
- How well a test-taking sample of adults reads and listens in English, country by country.
- doesn't show
- The sample is self-selected, so read it as a rough signal for whether local-language presales and content are needed.
source: EF English Proficiency Index 2025
used in: entering central and eastern Europe country by country: which market first, and through whom
49%
of chief sales officers say their sales organisation's definition of a qualified lead differs greatly from marketing's
- measures
- How often sales and marketing disagree on what counts as a qualified lead, as reported by sales leaders.
- doesn't show
- It is the sales side's view across industries, not a measure of how many leads are rejected in security.
under 1%
of leads convert to closed deals, according to Forrester's research as summarised on its blog
- measures
- The share of leads, counted the MQL way, that end as closed business.
- doesn't show
- The post gives no sample or method, so treat it as Forrester's summary view, not a benchmark to plan with.
source: Forrester: Saying goodbye to MQLs, sweet and no sorrow (Simon Daniels, 21 Nov 2023)
40% to 60%
of B2B deals end with the customer doing nothing
- measures
- The share of deals lost because the buyer made no purchase at all, across every deal in the dataset.
- doesn't show
- The base includes early and poorly qualified deals, so it does not give a late-stage loss rate.
used in: your biggest competitor in security deals is "no decision" · how to run a security POC that ends in a decision · the security review is a second evaluation. start it with the POC
56%
of no-decision losses come from buyer indecision, with the other 44% from a preference for the status quo
- measures
- How deals lost to no decision split between fear of choosing wrong and a preference for the current state.
- doesn't show
- It is a split of no-decision losses only, and the authors publish no method for it on the page.
source: The JOLT Effect: what it is
used in: your biggest competitor in security deals is "no decision"
87%
of customers showed moderate or high levels of indecision in recorded sales conversations
- measures
- The share of buyers whose conversations showed moderate or high indecision behaviours in the authors' dataset.
- doesn't show
- The interview does not define the behaviours or how they were scored, so use it as an indication of how common indecision is.
source: Matt Dixon interview on customer indecision, CustomerThink (2022)
used in: your biggest competitor in security deals is "no decision"
84%
probability that fear-based selling makes an indecisive customer more indecisive
- measures
- How often a fear-of-missing-out pitch increased indecision among buyers who were already indecisive.
- doesn't show
- The method behind the probability is not published, so treat it as a direction for buyers who already agree there is a problem.
source: Matt Dixon interview on customer indecision, CustomerThink (2022)
used in: your biggest competitor in security deals is "no decision"
over 50%
of no-decision losses carry a seller-recorded reason that differs from the reason buyers give
- measures
- How often the loss reason a seller logs in the CRM differs from the reason the buyer gives in win-loss feedback.
- doesn't show
- The vendor sells win-loss analysis and does not define on the page what counts as a different reason.
source: Corporate Visions: why B2B deals really stall (vendor-reported)
used in: your biggest competitor in security deals is "no decision"
13 and 9
are the typical numbers of internal stakeholders and external influencers in a business buying decision
- measures
- The average count of people inside and outside the buying organisation who influence a purchase decision.
- doesn't show
- These are averages across all business purchases, and the counts rise for complex or expensive ones.
source: Forrester: The State of Business Buying 2026 (press release, 21 January 2026)
used in: map the buying committee before the demo · how to run a security POC that ends in a decision · the security review is a second evaluation. start it with the POC · why the US volume playbook breaks in Europe · content your channel partners will actually send
53%
of business buying cycles have procurement as a decision-maker
- measures
- The share of buying cycles in which procurement professionals act as decision-makers from the start of the process.
- doesn't show
- It covers all business purchases, and the full report with Forrester's definition of decision-maker is for clients only.
source: Forrester: The State of Business Buying 2026 (press release, 21 January 2026)
used in: a security business case the CFO reads to the end · procurement is not the enemy. it is measured on something you can help with
21%
more speaker switches per minute in successful sales demos than in unsuccessful ones
- measures
- The difference in how often the speaker changes per minute between demos linked to won and lost deals.
- doesn't show
- It is a correlation from one vendor's customer recordings with no control for deal size or segment.
source: Gong: effective strategies for conducting successful sales demos
9.1 and 11.4 minutes
of slide presentation were the averages in intro meetings of won and lost deals respectively
- measures
- The average time spent sharing slides in first meetings, split by the final outcome of the deal.
- doesn't show
- It is a correlation from one vendor's platform, and the page gives no group sizes or method.
27%
lower close rates correlated with presenting ROI at any point in the sales process
- measures
- The difference in close rate between deals where ROI was presented and deals where it was not, in Gong's recorded calls.
- doesn't show
- Gong itself calls it a correlation, and ROI often appears late in deals that are already failing.
USD 4.99 million
is the global average cost of a data breach in the 2026 report
- measures
- The average total cost per breach across the organisations studied worldwide.
- doesn't show
- An average pulled up by a few very large events describes no single buyer's expected loss.
source: IBM and Ponemon Institute: Cost of a Data Breach Report 2026
21,442
business email compromise complaints reached the FBI's IC3 in 2024, with about USD 2.77 billion in reported losses
- measures
- The number of business email compromise complaints and the losses victims reported to the FBI in one year.
- doesn't show
- It counts complaints filed with a US agency, so it understates the real number of cases and says nothing about Europe.
source: FBI IC3: Internet Crime Report 2024
used in: procurement is not the enemy. it is measured on something you can help with
30 and 60 days
are the default payment period and the usual contractual maximum between businesses under the EU Late Payment Directive
- measures
- The period after the invoice when interest becomes due if the contract sets none, and the longest contractual period allowed unless expressly agreed and not grossly unfair to the creditor.
- doesn't show
- Member states transpose the directive into national law, and national rules can be stricter.
source: EUR-Lex: Directive 2011/7/EU on combating late payment
used in: procurement is not the enemy. it is measured on something you can help with
PLN 350.2 billion
was the value of contracts awarded under the Polish Public Procurement Law in 2025
- measures
- The total value of public contracts awarded under the Pzp act in one year.
- doesn't show
- It excludes contracts exempt from the act, which bring the whole public market to PLN 595.3 billion.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
PLN 595.3 billion
was the whole Polish public procurement market in 2025, including contracts exempt from the Pzp act
- measures
- The value of all public purchasing in Poland in one year, inside and outside the procurement law.
- doesn't show
- Exempt contracts are estimated, so this total is less precise than the Pzp figure.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
2.47
offers were submitted on average per Polish procedure at or above EU thresholds in 2025
- measures
- The average number of bids per above-threshold procedure, excluding negotiated procedures without notice and single-source awards.
- doesn't show
- It averages all sectors, and the report does not break it down for IT or security.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
53.6%
of Polish procedures at or above EU thresholds received a single offer in 2025
- measures
- The share of above-threshold procedures in which only one bid was submitted.
- doesn't show
- It covers all sectors, and the report does not isolate software or security tenders.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
56.7%
of Polish supply procedures at or above EU thresholds received a single offer in 2025
- measures
- The share of above-threshold supply procedures, the category that includes licences and hardware, with only one bid.
- doesn't show
- Supplies cover far more than IT, so the share for software alone is unknown.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
42.4%
of Polish service procedures at or above EU thresholds received a single offer in 2025
- measures
- The share of above-threshold service procedures with only one bid.
- doesn't show
- It covers every kind of service, so it does not describe IT services on their own.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
50%
of Polish supply contracts at or above EU thresholds used price as the only award criterion in 2025
- measures
- The share of above-threshold supply contracts awarded on price alone.
- doesn't show
- Where other criteria exist, price usually still carries most of the weight, so this share understates the role of price.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
46%
of Polish service contracts at or above EU thresholds used price as the only award criterion in 2025
- measures
- The share of above-threshold service contracts awarded on price alone.
- doesn't show
- It covers every kind of service, so it does not describe IT services on their own.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
5,986
appeals were lodged with the National Appeal Chamber (KIO) in 2025, a record, of which 730 concerned IT
- measures
- The number of appeals against procurement decisions filed in one year, with the IT category counted separately.
- doesn't show
- An appeal count shows how often bidders contest procedures and says nothing about who won them.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender
EUR 140,000 and EUR 216,000
are the EU thresholds for supplies and services in 2026 and 2027 for central and sub-central contracting authorities, equal to PLN 603,400 and PLN 930,960
- measures
- The contract values above which Polish authorities must use EU procedures, converted at PLN 4.31 per euro.
- doesn't show
- Different thresholds apply to works, sectoral contracts and defence, and they change every two years.
source: UZP: EU thresholds and PLN equivalents for 2026 and 2027
used in: why a vendor with the better product loses a Polish tender · entering central and eastern Europe country by country: which market first, and through whom
PLN 170,000
is the contract value from which Polish authorities must apply the Public Procurement Law since 1 January 2026
- measures
- The lower limit for national procurement procedures after the amendment of 25 July 2025.
- doesn't show
- Below it authorities follow their own internal rules, which vary.
source: UZP: report on the public procurement system in 2025 (Sprawozdanie Prezesa UZP, 2026)
used in: why a vendor with the better product loses a Polish tender · below the tender threshold: how Polish public buyers purchase under PLN 170,000, and when to bid at all
41.8%
of EU public procurement procedures had a single bidder in 2021, up from 23.5% in 2011
- measures
- The share of procedures across the single market in which only one company bid.
- doesn't show
- It is an EU-wide average that hides wide national differences.
source: European Court of Auditors: special report 28/2023 on public procurement in the EU
used in: why a vendor with the better product loses a Polish tender
over 50%
of procedures in Poland, Cyprus and Slovenia had a single bidder at the end of 2021
- measures
- The single-bidder share in the three member states with the highest rates.
- doesn't show
- It describes all sectors together and gives no IT breakdown.
source: European Court of Auditors: special report 28/2023 on public procurement in the EU
used in: why a vendor with the better product loses a Polish tender
over 40%
of respondents to the auditors' survey named restrictive criteria or requirements as a reason for single bidding
- measures
- The share of survey respondents who see overly restrictive selection criteria or technical requirements as a cause of single bids.
- doesn't show
- It is a perception, and only about one third of respondents thought the problem applied to their own country.
source: European Court of Auditors: special report 28/2023 on public procurement in the EU
used in: why a vendor with the better product loses a Polish tender
20%
single-bidder share is the level above which the Single Market Scoreboard rates a country's procurement as unsatisfactory
- measures
- The red flag threshold for the proportion of contracts awarded with a single bidder, excluding framework agreements.
- doesn't show
- It is a policy benchmark set by the Commission and carries no legal consequence.
source: European Commission: Single Market Scoreboard, public procurement
used in: why a vendor with the better product loses a Polish tender
18
sectors are covered by the NIS2 Directive
- measures
- The number of sectors whose essential and important entities fall under NIS2, across its two annexes.
- doesn't show
- Whether a given company is in scope depends on national law, its size and its activity.
source: European Commission: NIS2 Directive policy page
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
24 hours, 72 hours and one month
are the NIS2 deadlines for an early warning, an incident notification and a final report after a significant incident
- measures
- The time limits in Article 23(4) that member states must impose on essential and important entities.
- doesn't show
- The clocks bind the in-scope entity, and what a supplier owes its customer is set by contract.
source: Directive (EU) 2022/2555 (NIS2), EUR-Lex
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
EUR 10 million or 2%
of worldwide turnover, whichever is higher, is the floor that member states must set for the maximum NIS2 fine on essential entities
- measures
- The minimum ceiling for administrative fines in Article 34(4) for infringements of Articles 21 or 23.
- doesn't show
- National law sets the actual maximum, which can be higher.
source: Directive (EU) 2022/2555 (NIS2), EUR-Lex
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
EUR 7 million or 1.4%
of worldwide turnover, whichever is higher, is the floor that member states must set for the maximum NIS2 fine on important entities
- measures
- The minimum ceiling for administrative fines in Article 34(5) for infringements of Articles 21 or 23.
- doesn't show
- National law sets the actual maximum, which can be higher.
source: Directive (EU) 2022/2555 (NIS2), EUR-Lex
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
3 April 2026
is the date the amended Polish National Cybersecurity System Act (KSC) entered into force
- measures
- The entry into force of the act of 23 January 2026 that transposes NIS2 into Polish law.
- doesn't show
- Many obligations apply later, after the registration and adaptation periods.
source: Ustawa o zmianie ustawy o krajowym systemie cyberbezpieczeństwa, Dz.U. 2026 poz. 252
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
7 May to 3 October 2026
was the window for entities to self-register in the Polish register of key and important entities
- measures
- The period for entities not entered by the ministry to apply for entry in the register, which opened on 13 April 2026.
- doesn't show
- Whether an entity had to register is a legal question for that entity and its counsel.
source: Ministerstwo Cyfryzacji: nowelizacja ustawy o KSC, najważniejsze terminy (10 April 2026)
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
3 April 2027
is when the KSC adaptation period ends for entities that met the criteria when the amendment took effect
- measures
- The deadline by which those entities must implement their obligations and start using the S46 system.
- doesn't show
- Entities that come into scope later have their own deadlines.
source: Ministerstwo Cyfryzacji: nowelizacja ustawy o KSC, najważniejsze terminy (10 April 2026)
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
3 April 2028
is when KSC fines become possible, each decision preceded by a warning, and when first audits fall due for newly covered key entities
- measures
- The start of the penalty provisions two years after entry into force, and the first information security management system audit for key entities that were not operators of essential services before.
- doesn't show
- The ministry page is a summary, and the act itself sets the exact conditions.
source: Ministerstwo Cyfryzacji: nowelizacja ustawy o KSC, najważniejsze terminy (10 April 2026)
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
4
member states, Ireland, Spain, France and the Netherlands, were referred to the Court of Justice on 8 July 2026 for not notifying NIS2 transposition
- measures
- The number of member states the Commission took to court in its July 2026 infringement package for missing NIS2 transposition.
- doesn't show
- It reflects the state of notification on that date, and countries may have notified since.
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
70%
of surveyed organisations named regulatory compliance as the main driver of their cybersecurity investment over the past year
- measures
- The share of respondents whose main reason for security spending was meeting requirements such as NIS2, the CRA or DORA.
- doesn't show
- The sample leans heavily to large companies, so it says less about mid-sized buyers.
source: ENISA: NIS Investments 2025
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
17 January 2025
is the date from which DORA applies, including its Article 30 rules for contracts with ICT providers
- measures
- The application date of the Digital Operational Resilience Act for financial entities.
- doesn't show
- It applies to financial entities and their ICT providers, and not to other sectors.
source: Regulation (EU) 2022/2554 (DORA), EUR-Lex
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
11 September 2026
is the date from which the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents
- measures
- The application date of the reporting obligations in Article 14.
- doesn't show
- It applies to manufacturers of products with digital elements, and most other obligations start later.
source: European Commission: Cyber Resilience Act
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
11 December 2027
is the date from which the Cyber Resilience Act applies in full
- measures
- The general application date of the regulation's obligations for products with digital elements.
- doesn't show
- Some parts apply earlier, including reporting from 11 September 2026 and conformity body rules from 11 June 2026.
source: European Commission: Cyber Resilience Act
used in: NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
10 November 2024
is the date since which Poland's Electronic Communications Law requires prior consent for email and phone direct marketing, including to business users
- measures
- The entry into force of the act whose Article 398 bans using terminal equipment for direct marketing to a subscriber or end user without prior consent.
- doesn't show
- How consent must be given and documented is a question for Polish counsel.
source: Poland: Prawo komunikacji elektronicznej, Dz.U. 2024 poz. 1221
used in: cold email in Europe is a country-by-country question
19
member states received a reasoned opinion from the European Commission on 7 May 2025 for failing to notify full transposition of NIS2
- measures
- How many member states were late with NIS2 in national law, so how unevenly the obligations reach companies.
- doesn't show
- It is a status of May 2025; several countries have transposed since, so check each country in the month you plan.
source: European Commission: NIS2 transposition
used in: entering central and eastern Europe country by country: which market first, and through whom
3.01
offers on average were submitted in Polish procedures below EU thresholds in 2025
- measures
- How crowded a national tender is once a purchase steps up from internal rules to the act.
- doesn't show
- It covers the PLN 130,000 threshold of 2025; UZP will analyse the PLN 170,000 threshold in its report on 2026.
source: UZP: report on the public procurement system in 2025 (June 2026)
34.04%
of contracts in Polish procedures below EU thresholds received a single offer in 2025, and 43.03% of supply contracts
- measures
- How often a national tender has only one bidder.
- doesn't show
- It covers all sectors; IT supplies are not shown separately.
source: UZP: report on the public procurement system in 2025 (June 2026)
almost 92%
of Polish procedures below EU thresholds ran as the basic procedure (tryb podstawowy) in 2025
- measures
- Which procedure a vendor will meet when a purchase steps up to the act.
- doesn't show
- The basic procedure has variants with and without negotiation; the share does not split them.
source: UZP: report on the public procurement system in 2025 (June 2026)
24 hours, 72 hours, 14 days
are the Cyber Resilience Act deadlines for a manufacturer's early warning, notification and final report on an actively exploited vulnerability, from 11 September 2026
- measures
- How fast a software manufacturer selling in the EU must report an actively exploited vulnerability through the single reporting platform.
- doesn't show
- The 14 days run from the moment a corrective or mitigating measure is available, not from awareness.
source: European Commission: Cyber Resilience Act, reporting obligations
used in: the Cyber Resilience Act: what your European distributor will ask you
19
ICT third-party providers were named critical under DORA in the first list the European Supervisory Authorities published on 18 November 2025
- measures
- How many ICT providers fall under direct EU oversight under DORA.
- doesn't show
- The list is updated yearly; check for a newer one before quoting it.
source: EBA: ESAs designate critical ICT third-party providers under DORA (18 November 2025)
used in: DORA in a sales conversation: what a bank will ask an ICT supplier
30 days
is the standard length of a GitLab proof of value, with a midpoint check at about day 15 and one to three measurable goals
- measures
- The default timebox and structure GitLab's solutions architects use for customer evaluations.
- doesn't show
- It is one vendor's internal practice and carries no evidence that this length works best.
70%
of information security and risk decision-makers surveyed reported a security breach in the previous three years
- measures
- The share of respondents whose organisation reported a breach over a three-year period.
- doesn't show
- Whistic sells third-party risk software, and the page gives no breach definition or question wording.
source: Whistic: the state of TPRM in 2025 (vendor-reported)
used in: the security review is a second evaluation. start it with the POC
77%
of security breaches reported over the past three years originated with a vendor or other third party
- measures
- The share of reported breaches that respondents attributed to a supplier or other third party.
- doesn't show
- It is a share of breaches among respondents who had one, and a vendor selling third-party risk tools ran the survey.
source: Whistic: the state of TPRM in 2025 (vendor-reported)
used in: the security review is a second evaluation. start it with the POC
6.67%
was Ingram Micro's gross margin for fiscal year 2025
- measures
- Gross profit as a share of net sales for one of the largest listed broadline IT distributors.
- doesn't show
- It mixes hardware, software and cloud across all regions and says nothing about security distribution on its own.
source: Ingram Micro: fourth quarter and fiscal year 2025 results (SEC 8-K, Exhibit 99.1)
used in: the channel price waterfall: from list price to the CISO
1.97%
was Ingram Micro's adjusted income from operations margin for fiscal year 2025
- measures
- Non-GAAP operating income as a share of net sales for a large broadline distributor.
- doesn't show
- It is a non-GAAP measure that excludes items such as amortisation and restructuring, and it covers all product lines.
source: Ingram Micro: fourth quarter and fiscal year 2025 results (SEC 8-K, Exhibit 99.1)
used in: the channel price waterfall: from list price to the CISO
6.99%
was TD SYNNEX's gross margin for fiscal year 2025
- measures
- Gross profit as a share of revenue for one of the largest listed broadline IT distributors.
- doesn't show
- It mixes hardware, software, cloud and the Hyve business, and does not report security distribution separately.
source: TD SYNNEX: Form 10-K for fiscal year 2025 (SEC)
used in: the channel price waterfall: from list price to the CISO
2.86%
was TD SYNNEX's non-GAAP operating margin for fiscal year 2025
- measures
- Non-GAAP operating income as a share of revenue for a large broadline distributor.
- doesn't show
- It is a non-GAAP measure across all product lines and regions.
source: TD SYNNEX: Form 10-K for fiscal year 2025 (SEC)
used in: the channel price waterfall: from list price to the CISO
3%
is the AWS Marketplace listing fee for public SaaS offers and for private offers with a total contract value under USD 1 million
- measures
- The share of pre-tax total contract value that AWS deducts from the seller's disbursement.
- doesn't show
- Regional uplifts such as South Korea's extra 1% and the channel partner uplift come on top.
source: AWS Marketplace Seller Guide: listing fees
used in: the channel price waterfall: from list price to the CISO · when the customer wants to buy through AWS or Azure: marketplaces and your channel
2%
is the AWS Marketplace listing fee for private offers from USD 1 million to under USD 10 million in total contract value
- measures
- The listing fee tier for mid-sized private offers.
- doesn't show
- Renewals are charged at a separate rate whatever their size.
source: AWS Marketplace Seller Guide: listing fees
used in: the channel price waterfall: from list price to the CISO · when the customer wants to buy through AWS or Azure: marketplaces and your channel
1.5%
is the AWS Marketplace listing fee for private offers of USD 10 million or more in total contract value
- measures
- The lowest listing fee tier for new private offers.
- doesn't show
- Few security deals in mid-sized European markets reach this size.
source: AWS Marketplace Seller Guide: listing fees
used in: the channel price waterfall: from list price to the CISO · when the customer wants to buy through AWS or Azure: marketplaces and your channel
0.5 percentage points
are added to the AWS Marketplace listing fee for channel partner private offers, calculated on the price the vendor gives the partner
- measures
- The extra fee AWS charges when an authorised channel partner resells the vendor's product in a private offer.
- doesn't show
- The fee is deducted from the vendor's disbursement, and the partner's markup is outside the fee base.
source: AWS Marketplace Seller Guide: listing fees
used in: the channel price waterfall: from list price to the CISO · when the customer wants to buy through AWS or Azure: marketplaces and your channel
3%
is the standard store service fee Microsoft charges when customers buy a transactable offer in Microsoft Marketplace
- measures
- The share of software licence fees Microsoft keeps when it transacts as the publisher's agent.
- doesn't show
- The page does not describe how a multiparty private offer splits margin between vendor and channel partner.
source: Microsoft Learn: marketplace commercial transaction capabilities
used in: the channel price waterfall: from list price to the CISO · when the customer wants to buy through AWS or Azure: marketplaces and your channel
4.99
technology categories are sold by the average partner in Futurum's 2026 survey, down from 5.47
- measures
- The average number of technology categories in a partner's portfolio.
- doesn't show
- It counts categories and does not show how many vendors a partner carries within each one.
source: Futurum Group: partner growth polarization (2026)
used in: what a partner needs to hear before it adds your line
18%
of IT solution providers were very satisfied with their vendor relationships in 2026, down from 39% in 2025
- measures
- The share of IT solution providers rating vendor relationships as very satisfying.
- doesn't show
- GTIA attributes the drop to ecosystem realignment, and the release gives neither sample nor method.
source: GTIA: State of the Channel 2026
used in: what a partner needs to hear before it adds your line
20% to 40%
of resellers activate by Unifyr's rough guide, against 30% to 50% of referral partners and 40% to 60% of technology partners
- measures
- Rough activation ranges by partner type from a partner software vendor's glossary.
- doesn't show
- Unifyr calls the ranges a rough guide and gives no source, sample or method.
70 of 100 points
is the minimum partner capability score for a Microsoft Solutions Partner designation, with every metric above zero
- measures
- The qualifying threshold of Microsoft's composite score built from performance, skilling and customer success.
- doesn't show
- Each solution area sets its own metric thresholds, so the 70 points do not translate directly to another vendor's programme.
source: Microsoft Learn: partner capability score
used in: partner tiers that change what partners do · channel metrics that tell you something: sourced, influenced and the partner health score
21%
of companies rated their sales compensation plans very effective in Alexander Group's research
- measures
- How companies rate the effectiveness of their own sales pay plans.
- doesn't show
- It is a consultancy's own survey with no sample published, and companies rate themselves.
source: Alexander Group: 2025 sales compensation game changers (via NAW)
used in: paying your channel team without starting a war with direct sales
19 points
more core sellers achieve or exceed quota at companies with the most effective pay plans than at the rest
- measures
- The absolute percentage-point gap in core sellers at or above quota between leaders and the rest.
- doesn't show
- It compares self-rated leaders with the rest and does not show that the plan caused the difference.
source: Alexander Group: 2025 sales compensation game changers (via NAW)
used in: paying your channel team without starting a war with direct sales
3 months
of advance notice is what Alexander Group recommends for any change to pay or pay mix
- measures
- A consultancy's recommended notice period for compensation changes.
- doesn't show
- It is advice, and local employment law may require different notice.
source: Alexander Group: 2025 sales compensation game changers (via NAW)
used in: paying your channel team without starting a war with direct sales
53:47
is the median base to variable split for SaaS account executives in The Bridge Group's 2024 benchmark
- measures
- The pay mix at target for direct account executives.
- doesn't show
- It covers direct SaaS sellers and gives no figure for channel roles.
source: The Bridge Group: 2024 SaaS AE metrics and compensation benchmark
used in: paying your channel team without starting a war with direct sales
48%
of account executives were at quota in The Bridge Group's 2026 survey, down from 51% in 2024
- measures
- The share of account executives reaching quota.
- doesn't show
- Leaders report on their teams, and the page does not specify whether quota means annual quota.
source: The Bridge Group: AE models, motions and metrics 2026
used in: paying your channel team without starting a war with direct sales
6.2 months
is the ramp time to full productivity for account executives in The Bridge Group's 2026 survey
- measures
- Time for a new direct seller to reach full productivity.
- doesn't show
- It covers direct sellers and the page does not say whether it is a mean or a median.
source: The Bridge Group: AE models, motions and metrics 2026
used in: paying your channel team without starting a war with direct sales
6 months
is the length of each Microsoft co-op period: earning, then usage, then claiming; unused co-op earnings are forfeited
- measures
- How long a partner waits between earning co-op funds and being able to claim them under one large vendor's programme.
- doesn't show
- It describes one vendor's programme; other vendors pay rebates and market development funds on their own schedules.
source: Microsoft Learn: co-op and claims overview (updated 15 Sep 2025)
used in: why partners ask for more discount, and what to give them instead
12 months
is the rolling period over which Microsoft Commerce Incentives earnings can be restated
- measures
- How long an incentive payment can still change after it was earned, under one large vendor's programme.
- doesn't show
- One vendor's rule; it shows why back-end money is hard for a partner to plan with, not how every programme works.
source: Microsoft Learn: earnings troubleshooting FAQ
used in: why partners ask for more discount, and what to give them instead
nearly 70%
of partners operate at low to medium levels of marketing and demand maturity, according to vendors' partner marketing decision-makers
- measures
- How partner ecosystem marketing decision-makers rate the marketing maturity of their own partners.
- doesn't show
- It is a vendor-side assessment of partners, and the sample is not stated on the page.
source: Forrester: Partner Marketing Automation Platform Investment On The Rise (17 February 2026)
50%
is the discount a publisher can apply to its Microsoft Marketplace transaction fee for private offer customer renewals
- measures
- The reduction in the marketplace fee on qualifying private offer renewals.
- doesn't show
- Qualification rules sit on a separate Microsoft page that was not checked.
source: Microsoft Learn: commercial marketplace transaction capabilities
used in: when the customer wants to buy through AWS or Azure: marketplaces and your channel
100%
of the pretax purchase amount of an Azure benefit eligible Marketplace offer counts toward the customer's Microsoft Azure Consumption Commitment
- measures
- How much of an eligible marketplace purchase draws down a customer's committed Azure spend.
- doesn't show
- It applies only to purchases made through the Azure portal under the organisation's agreement and to licences used exclusively in Azure.
source: Microsoft Learn: Azure Consumption Commitment benefit
used in: when the customer wants to buy through AWS or Azure: marketplaces and your channel
52.74%
of EU enterprises with at least ten employees used paid cloud computing services in 2025
- measures
- The share of enterprises that paid for any cloud computing service.
- doesn't show
- It counts any paid cloud service and does not show how many buy software through a cloud marketplace.
source: Eurostat: cloud computing, statistics on the use by enterprises (2025 data)
used in: when the customer wants to buy through AWS or Azure: marketplaces and your channel
79.21%
of enterprises with at least ten employees in Finland used paid cloud computing services in 2025, the highest share in the EU
- measures
- The share of Finnish enterprises that paid for any cloud computing service.
- doesn't show
- It counts any paid cloud service and says nothing about marketplace purchasing of security software.
source: Eurostat: cloud computing, statistics on the use by enterprises (2025 data)
used in: when the customer wants to buy through AWS or Azure: marketplaces and your channel
17.83%
of enterprises with at least ten employees in Bulgaria used paid cloud computing services in 2025, the lowest share in the EU
- measures
- The share of Bulgarian enterprises that paid for any cloud computing service.
- doesn't show
- It counts any paid cloud service and says nothing about marketplace purchasing of security software.
source: Eurostat: cloud computing, statistics on the use by enterprises (2025 data)
used in: when the customer wants to buy through AWS or Azure: marketplaces and your channel
USD 610 billion
is the estimated size of the IT managed services market by the end of 2025, according to Canalys research published by N-able
- measures
- The estimated worldwide value of IT managed services in 2025.
- doesn't show
- It covers all IT managed services and does not isolate managed security.
source: Canalys research reported in N-able's MSP Horizons report (2025)
used in: when an MSSP wants to build a service on your product
98%
of IT managed services revenue is generated by channel partners, according to Canalys research published by N-able
- measures
- The share of managed services revenue delivered by channel partners.
- doesn't show
- It does not show which share of that revenue is security or how much flows through distributors.
source: Canalys research reported in N-able's MSP Horizons report (2025)
used in: when an MSSP wants to build a service on your product
90%
of surveyed channel partners expected their cybersecurity managed services sales to grow in 2025
- measures
- The share of respondents expecting growth in cybersecurity managed services sales.
- doesn't show
- It is a self-selected sample reached through an MSP software vendor and records expectations for the year ahead with no later check on outcomes.
source: Canalys research reported in N-able's MSP Horizons report (2025)
used in: when an MSSP wants to build a service on your product
under 10%
of their budget goes to managed security services at most demand-side organisations in ENISA's 2025 survey
- measures
- How much of their spending buyers in the survey allocate to managed security services.
- doesn't show
- The sample is small, self-selected and dominated by large organisations, and the report's body expresses the figure against total turnover.
source: ENISA: MSS Market Analysis (2025)
used in: when an MSSP wants to build a service on your product
up to USD 7
of services revenue can be generated by partners for every USD 1 customers spend on the CrowdStrike Falcon platform, in a Canalys study announced by CrowdStrike
- measures
- The upper bound of partner services revenue relative to platform spend.
- doesn't show
- It is a maximum for one large platform, announced by the vendor that benefits from it, with no method or distribution published.
source: CrowdStrike press release on a Canalys partner services study (2025)
used in: a signed partner is a logo, not pipeline: the first 90 days after signature · partners make money on the services around your product, so design for them
2 to 3 months
is how long HubSpot says its solutions partners take on average to be ready to implement HubSpot and deliver services
- measures
- HubSpot's own average for partner readiness to deliver its product.
- doesn't show
- It describes readiness on one non-security product and says nothing about time to a first closed deal.
source: HubSpot: Solutions Partner Program
used in: a signed partner is a logo, not pipeline: the first 90 days after signature
21 January 2025
was the last day to buy or renew Microsoft's legacy Gold and Silver benefits, after the competencies were retired on 30 September 2022
- measures
- How long Microsoft kept legacy partner benefits on sale after retiring the old competencies.
- doesn't show
- It documents the timeline and says nothing about how partners reacted to the change.
source: Microsoft Learn: Solutions Partner program FAQs
used in: how a partner channel fails, and the signals that show up two quarters earlier
15 months
passed between the announcement of the Cisco 360 Partner Program on 4 November 2024 and its start on 1 February 2026
- measures
- The notice period Cisco gave partners before a programme overhaul took effect.
- doesn't show
- It documents the timeline and says nothing about how partners reacted to the change.
source: Cisco Blogs: launching the Cisco 360 Partner Program (2024)
used in: how a partner channel fails, and the signals that show up two quarters earlier
13
stakeholders sit in the average buying group, according to Forrester
- measures
- The average number of people involved in a B2B buying group.
- doesn't show
- The blog post does not name the survey behind the number.
source: Forrester: proof is the product, how trials and POCs became a go-to-market motion (2026)
used in: co-selling with a partner: who owns what in the deal
40%
of B2B software buyers say evaluation is the longest stage of their buying process
- measures
- The share of buyers naming evaluation as their longest buying stage, up from 36% a year earlier.
- doesn't show
- It is a share of buyers and does not measure how much of the buying time evaluation takes.
source: G2: 2026 Buyer Behavior Report
used in: co-selling with a partner: who owns what in the deal
39%
of B2B software buyers name IT security review as the biggest source of delay after shortlisting a vendor
- measures
- The most common post-selection delay reported by buyers.
- doesn't show
- It ranks causes of delay and says nothing about how long the delay lasts.
source: G2: 2026 Buyer Behavior Report
used in: co-selling with a partner: who owns what in the deal
50%
of enterprise software buyers name IT security review as their top delay after selecting a vendor
- measures
- The most common post-selection delay among enterprise buyers.
- doesn't show
- The page does not give the size of the enterprise subsample.
source: G2: 2026 Buyer Behavior Report
used in: co-selling with a partner: who owns what in the deal
11.7%
is the average lift in win rate when partners are involved in deals, in Crossbeam's network data
- measures
- The difference in win rate between deals with partner involvement and deals without.
- doesn't show
- The page does not say whether the lift is relative or in percentage points, and partners tend to join deals that already look promising.
source: Crossbeam: involving partners in deals increases win rate (2024)
used in: a joint business plan a partner will follow · channel metrics that tell you something: sourced, influenced and the partner health score
81.1%
of organisations evaluate their partnership and channel teams on partner-sourced revenue
- measures
- How common sourced revenue is as a KPI for partner teams.
- doesn't show
- The sample leans to software companies and North America, with 25% of respondents in EMEA.
source: HubSpot, Canalys and Partnership Leaders: State of Partner Ops and Programs 2022
used in: channel metrics that tell you something: sourced, influenced and the partner health score
50%
of respondents in Forrester's 2026 partner ecosystem survey named lack of resources as a top challenge to ecosystem success
- measures
- How often a lack of resources is named among the top barriers to partner ecosystem success.
- doesn't show
- The blog gives no sample size or question wording.
source: Forrester: partner ecosystems earned their strategic seat at the table (2026)
91%
is the 2025 median gross revenue retention of private B2B SaaS companies in SaaS Capital's survey
- measures
- Median revenue kept from existing customers before expansion.
- doesn't show
- It covers SaaS companies in general, with no split for security or for channel-sold revenue, and the lender that runs it surveys its own market.
source: SaaS Capital: 2025 B2B SaaS retention benchmarks
used in: renewals through partners: who owns the customer in year two
101%
is the 2025 median net revenue retention of private B2B SaaS companies in SaaS Capital's survey
- measures
- Median revenue kept from existing customers including expansion.
- doesn't show
- It covers SaaS companies in general, with no split for security or for channel-sold revenue.
source: SaaS Capital: 2025 B2B SaaS retention benchmarks
used in: renewals through partners: who owns the customer in year two
3 percentage points
lower retention was found at SaaS companies selling mostly through channel partners than at those selling mostly direct
- measures
- The retention gap between channel-dominated and direct-dominated SaaS companies.
- doesn't show
- The data is from 2019 and the article gives no sample size for this comparison.
source: SaaS Capital: retention benchmarks and analysis for channel sales in SaaS (2019)
used in: renewals through partners: who owns the customer in year two
59%
of B2B event decision-makers planned more smaller hosted events over the next 12 months, in Forrester's Q1 2025 survey
- measures
- Where B2B marketers intended to move their event budgets: towards smaller events they host themselves.
- doesn't show
- It is an intention, not results, and it is not specific to security or to Europe.
source: Forrester blog: State of B2B Events, Q1 2025 (May 2025)
numbers I don't use.
These figures turn up in decks, posts and vendor reports. I looked for the original and either did not find it or found that it says something narrower. If you know a primary source for any of them, write to dawid@dawid.xyz and I will check it.
- not usedA 22-point indecision threshold attributed to The JOLT EffectThe 22-point threshold was looked for on The JOLT Effect's own page, the Dixon and McKenna HBR article and Dixon's CustomerThink interview, and none of them mentions it or any numeric indecision threshold.more in your biggest competitor in security deals is "no decision"
- not usedResponding fast to an inbound lead makes it 21 times more likely to qualifyThe 2011 HBR study the figure is usually attributed to reports factors of nearly seven and over 60, and the guide traces the 21 times figure to a separate earlier industry study that is quoted beyond what it measured.more in the first hour after a demo request
- not usedSecurity POCs convert to closed deals at 60% to 80% when done rightRework states the range without citing any study or data, and no independent benchmark of sales-assisted POC conversion was found.more in how to run a security POC that ends in a decision
- not usedPOC-anchored demos close at a median of 41% against 15% for scripted demosPreSales Pulse aggregates practitioner surveys and CRM data from 38 SaaS companies without giving deal counts per approach, and POCs run on deals that are already qualified, so the gap cannot be read as an effect of the POC.more in how to run a security POC that ends in a decision
- not used60% of market development funds go unused every quarterThe trade article cites a LinkedIn post and ZINFI cites its own unnamed survey, both without sample or method, and Technology Match traced the figure to a single vendor blog post from about a decade ago.more in content your channel partners will actually send
- not usedBillions of dollars in channel marketing funds go unclaimed each yearTechnology Match found that the USD 14 to 35 billion figures come from studies of US local retail co-op advertising, which is a different business from B2B technology MDF.more in content your channel partners will actually send
- not used80% of channel revenue comes from 20% of partners.Quoted by Channelnomics and The Channel Company as a rule of thumb, and neither page cites a dataset, sample or method behind it.more in a signed partner is a logo, not pipeline: the first 90 days after signature
- not usedPartner revenue is closer to 90/10 or even 95/5 than 80/20.Channelnomics (Larry Walsh, June 2025) states this as its finding, but the public part of the article gives no dataset or method to check it against.more in a signed partner is a logo, not pipeline: the first 90 days after signature
- not used90% of indirect revenue comes from 10% of partners, or from fewer than 5%.The 2018 CRN UK article quoting analysts returned 403, and the guide itself notes that none of the analysts quoted published a dataset.more in an ideal partner profile fits on one page
- not usedFour out of five new partners leave a programme without selling anything.The Channel Company's 2024 blog states it as an average but names no study, sample or period, and its title's '80% underperforming' does not appear in the text.more in a signed partner is a logo, not pipeline: the first 90 days after signature
- not usedOnly 11% of partners reach the goals that pay out meaningful incentives.The same Channel Company blog gives the number without any source, survey or definition of a meaningful incentive.more in a signed partner is a logo, not pipeline: the first 90 days after signature
- not usedPOCs run through partners convert at a known benchmark rate.No independent public benchmark for POC conversion through partners was found, and the figures in circulation come from vendors describing their own POCs.more in co-selling with a partner: who owns what in the deal
- not usedPlatform consolidation figures: 75% of organisations pursuing vendor consolidation, 81% rationalising security tools.The Gartner page behind the 75% returned an error and the 81% from Omdia appeared only in trade press, so neither could be read at the source.more in competing with the bundle the customer already owns
- not usedEvent benchmarks for attendance, no-show and conversion rates of webinars, seminars and CISO dinners.The figures in circulation come from event platform vendors and agencies describing their own customers, with no method published.more in a partner roadshow that ends in registered deals
Terms used with these numbers are defined in the glossary. How I handle sources and corrections is on the about page.
Security Revenue · every Tuesday
How security vendors build pipeline.