Last month a founder walked me through a demo. Forty minutes, competent product, a real problem solved. The buyer asked two questions in the first five minutes and then went quiet. Not hostile. Just finished.
The product was not the problem. The buyer had no way to check it. He could not install it, he was not going to run a proof of concept for six weeks on a hunch, and the two people he could have asked had both left the company that bought it.
So he did what everyone does when they cannot verify something. He looked for a reason to stop.
Used cars, 1970
George Akerlof wrote a paper about this in 1970, and it won him a Nobel prize thirty years later. The used car market, he said, has a problem: only the seller knows if the car is good. The buyer cannot tell a well-kept car from a resprayed wreck, so they will only pay the price of an average one. The price of an average car is below what a good car is worth, so the people selling good cars leave. What stays is the bad ones.
He called it the market for lemons. It is the best description of cybersecurity buying anyone has written, and it is fifty-six years old.
Why it bites harder in security
Three reasons, all structural.
You cannot test the product without deploying it. A buyer can try a project tool for a week. Nobody stands up a SIEM to see if they like it.
The seller knows vastly more than the buyer. Not because the buyer is slow. Because the seller wrote it and the buyer met it on Tuesday.
And getting it wrong is expensive in a way that arrives late. A tool that half works looks fine for a year and then shows up in a post incident review.
Put those together and you get the behaviour every cyber founder recognises. Buyers default to the brand they have heard of. Not because it is better. Because it is verifiable enough to defend in a meeting.
What the buyer is actually evaluating
Not your product. Whether they can trust the person who brought it.
That sounds soft. It is not. It is the only signal left when the product cannot be checked. And it comes off the things you send before the first call: whether the site says what the thing does in a sentence a buyer could repeat to their boss, whether the deck answers the question they actually have, whether anyone in the room is willing to say "we do not do that".
The last one carries more weight than it should. A vendor who names their limits is the only one who has given the buyer something to verify.
Making verification cheap
Good vendors do three things that bad ones avoid, and all three cost them something in the short term.
They name what the product does not do. Every buyer hears the gap anyway. Saying it first means the gap is your honesty rather than their discovery.
They let the awkward reference talk. The customer who had a hard implementation and stayed is worth more than the four who will read a quote off a slide. Buyers know the difference and they ask.
They give away the diagnostic. The 20 minutes where you tell someone what is wrong with their setup is not a loss leader. It is the only proof that you know what you are doing, delivered before they have to trust you.
The thing founders get wrong
They think clarity makes them look smaller. That specifying, admitting a gap, or saying "this is not for you" narrows the market and costs them deals.
It does the opposite. Vagueness is what makes you look like every other vendor in the pile, and the pile is where the lemons are. Precision is the only thing that separates a good product from a bad one when the buyer cannot open the box.
You cannot fix an information problem by talking more. You fix it by making it cheaper to check.