trust transfer.

what it means

A buyer who has never worked with you has to trust you enough to put your product in front of the people who sign. I call the way that trust gets built trust transfer. It has two halves, and a deal needs both.

The first half is proof the buyer has seen for themselves. A POC in their environment against criteria they signed. A demo on their own data. A reference architecture their engineers can check line by line. Security evidence a reviewer can read without a call. What these share is that someone on the buyer's side watched the result happen. A claim in a deck asks to be believed. A result they observed is something they can defend to a colleague.

The second half is someone the buyer already trusts who vouches for you. A peer at another company who runs your product. The integrator that already looks after their network. A distributor whose name is on contracts they have signed before. That person lends you some of the trust they have built over years, and takes a small risk in doing it.

Each half fails on its own. Proof without a voucher stays inside the evaluation team: the engineers are convinced, and the people who sign have never heard of you and see no reason to take the risk. A voucher without proof wears out: a partner who recommends a product that then fails a test spends their own credibility, and does it once. Together they work in order. Proof gives the voucher something to point at. The voucher carries the proof into rooms you are never in, and that is how your name reaches the shortlist. The committee then decides on what the proof showed and on who stood behind it.

why security buying works this way

Four features of security buying make trust the scarce input.

Committees are large. Forrester's State of Business Buying 2026, a survey of nearly 18,000 business buyers, puts a typical B2B purchase at 13 internal stakeholders and nine external influencers, with more for complex purchases. In the same report, procurement acts as a decision-maker in 53% of buying cycles. You meet a few of these people. The rest decide on what reaches them second hand, and second hand is where a voucher does its work.

The buyer carries the risk. A security product asks for privileged access, agents on endpoints or a connection into identity systems. If it fails, the person who chose it owns the incident. Matthew Dixon and Ted McKenna, writing in Harvard Business Review in 2022 from about 2.5 million recorded sales conversations, report that 40% to 60% of B2B deals end with the customer doing nothing. When choosing wrong is expensive, waiting looks safe. Proof lowers the risk of choosing. A trusted voice lowers the risk of being blamed for the choice.

A second evaluation runs alongside the first. While engineers test the product, security, risk and legal assess the supplier. G2's 2026 Buyer Behavior Report, a vendor survey of 1,038 software decision-makers, found that 40% named evaluation as the longest stage of buying and 39% named IT security review as the biggest source of delay after shortlisting a vendor. Whistic's 2025 survey of more than 500 security and risk decision-makers, run by a company that sells third-party risk tools, found that 77% of the breaches respondents reported came through a vendor or another third party. Reviewers have reasons to be thorough with a new supplier, and evidence they can check moves them faster than reassurance does.

The channel stands between you and the customer. In much of Europe the integrator or reseller already holds the relationship, the procurement framework and often the shortlist. Crossbeam's network data from 2024 shows an average 11.7% lift in win rate when partners are involved in deals. Partners tend to join deals that already look promising, so read that as a direction.

what it replaces

The belief I argue against is that a security vendor can buy pipeline with volume. In its usual form the volume playbook sets MQL targets, runs cold outreach at scale and gates whitepapers behind forms, then judges each step by how many people pass through it.

That playbook was built for a large, uniform market, and there it has real strengths: repeatable motions, clean measurement and reach to buyers who would never find you on their own. Its working assumption is that enough touches will produce a buyer who trusts you. In security that assumption meets a committee whose members mostly never fill in a form, a reviewer who wants evidence they can check, and a partner who decides whether your name comes up at all.

Some markets add a legal limit. Poland's Electronic Communications Law has required prior consent for email and phone direct marketing, including to business users, since 10 November 2024. How to collect and document that consent is a question for local counsel, and this is not legal advice. The longer argument, market by market, is in why the US volume playbook breaks in Europe.

Trust transfer keeps what the playbook does well, a defined list of accounts and honest measurement, and changes what gets counted: who has seen proof, and who is vouching for you.

how it shows up in practice

Winning the deal. Most of the committee never sees a demo, so the work is getting the right proof to each member and giving your champion a story they can defend upwards. In practice that starts with a map of the buying committee before the demo: who decides, who can stop the deal, and who outside the company they will ask. The rest of the reading order is on winning the deal.

POCs. A POC is the clearest form of proof, and it transfers trust only when the people who sign agreed in advance what a pass means. That takes success criteria the buyer signs, a timebox, a readout that works as the decision meeting, and a supplier security review that starts on the same day as the test. The setup is in how to run a security POC that ends in a decision, and the other evaluation guides are under POCs.

Making partners sell. A partner who vouches is the second half in its most direct form, and a signed contract does not make anyone vouch. A partner is active when their seller brings you a deal, and in the first deals your engineer often supplies the proof while the partner supplies the name. The first 90 days after signature decide which way it goes; the full route from the first deals to the renewal is on making partners sell. Choosing and recruiting them is on choosing partners.

Getting the meeting. Much of a security shortlist comes from peers, partners, people the buyer has met and things they have read, and none of it shows up as a lead on the day it happens. A funnel built on trust transfer feeds those sources. Forrester's Partner Ecosystem Marketing Survey 2026 reports that vendors' partner marketing decision-makers rate nearly 70% of their partners at low to medium marketing maturity, so someone in the chain usually has to build the campaign: content your channel partners will actually send under their own name. More on getting the meeting.

how to tell if your pipeline runs on trust transfer

Answer yes or no for your open pipeline as it stands today.

• For each open deal, you can name who on the buyer's side has seen proof with their own eyes, and what they saw.
• For each open deal, you can name someone outside your company who has vouched for you to the buyer.
• Your POCs start with success criteria signed by someone who can approve the purchase.
• The supplier security review starts on the same day as the technical evaluation.
• Partners bring you deals you did not hand to them.
• Your pipeline report shows how many opportunities a partner or a peer introduced, next to how many came from forms.
• When a deal is lost, you can say which of the two halves was missing.

If most answers are no, start with the area where the gap is widest.

the next step

Security Revenue, the weekly newsletter, applies this thesis to one problem at a time: a deal, a POC, a partner or a funnel. If you would rather start from your own situation, where to start asks four questions and gives you a reading path through the guides.