Three hundred rows. Three questions.
A bank’s security questionnaire looks like three hundred unrelated demands. Underneath, the buyer is trying to answer three questions about you. Once you can see them, the spreadsheet starts to read like a specification.
Capability
Is it worth it?
Your product-market fit and your killer features: benefit minus total cost. Total cost includes what it costs the bank to buy from you at all: assessing you, monitoring you, planning an exit from you. That work lands on their budget.
Cyber
How safe are you today?
The most standard part of the spreadsheet, and where most of the written questions live: your controls, your access model, how the system and the company actually run, right now.
Trust
Will it last?
Will you still be here in three years, on the same terms, at the same quality? Years in business, reference clients, balance sheet. Trust is what the buyer has to believe, because they can’t check it, which makes it the most expensive of the three to earn.
Floors first. Then a trade.
Each of the three has a floor. Score below it on any one and nothing else matters: a brilliant product doesn’t offset missing basic security hygiene, and thirty years of track record don’t rescue a product that can’t do the job.
Above the floors, trust and capability trade off. A product that is ten times better gets in on floor-level trust. A floor-level product gets in only on decades of track record. Most startups have neither, which leaves four places to get stuck.
- Nice demo zone
- Floors met, but not enough trust or capability to reach the shortlist. Good enough to get the demo and the occasional spreadsheet; never a real contender. The most frustrating place to be.
- AI slop zone
- Capable, not trusted. As AI makes capability cheaper, more products land here.
- Legacy zone
- Trusted, no longer capable enough.
- MVP zone
- Below both floors. The demo is for an investor, not a customer.
The short way out of the nice demo zone.
There are two obvious exits: build a much better product, or wait years for a track record. There is a third. Security work that the buyer can see, and that is built into the product, spills over. It adds some trust, it adds some capability, and it lowers how much trust the buyer needs in the first place, because they can check instead of believe.
That only works if the security work is chosen for it. Hygiene nobody can see protects you and earns you nothing. Track record takes years. Security evidence takes months.
Try it: what would make you enterprise ready?
The dot is a vendor. The purple area is where a bank can defend buying from it. Move the three sliders and watch what it takes to get there.
- Drop Cyber to 30, the buyer’s floor. The dot falls back into the nice demo zone.
- Now try to get out using only Trust or only Capability, and watch what it costs under “Buyer settings, budget and assumptions”.
- Put Cyber back up. The red arrow is what visible security adds; the faint dashed line is where the bar used to be.
Buyer settings, budget and assumptions
Model assumptions
How this model works
Purpose and thesis
What makes a software vendor enterprise ready, meaning procurable by a large enterprise such as a bank? Three dimensions matter: Cyber (cybersecurity), Trust (credible trust) and Capability (value for the use case). They are separate but overlap. Some cyber work overflows into trust and capability, the overflow dividend. The dividend is not automatic: it depends on choosing security work that buyers can see and that is built into the product. With the right choices, cyber is the cheapest route to enterprise readiness. With the wrong ones, it does not pay back.
Design rules
- Buyer settings move the line, vendor settings move the dot. Floors change the enterprise-ready line and the zones, never the vendor's position. The one deliberate, toggleable exception is Lowers the bar.
- Floors are gates. Nothing compensates for being below a floor. Above the floors, trust and capability trade off.
- The hygiene layer belongs to the vendor. Cyber below it never overflows, and it does not move with the buyer's cyber floor. Cyber below the buyer's cyber floor never overflows either.
- Cyber can't fully replace trust and capability. A set share of each floor must come from track record and features.
- View toggles never change calculations. Zones, floor lines, labels, the 10× and 30 yrs markers, the arrow and the vendor dot only change what is drawn.
How to read the chart
- Horizontal axis: capability. Vertical axis: trust. Both 0 to 100.
- Purple area above the line: enterprise ready. Grey dashed lines: the trust and capability floors. The 10× marker is where the line meets the trust floor: exceptional capability sells on floor-level trust. The 30 yrs marker is where the line starts at the capability floor: a floor-level product sells only on near-perfect trust, which takes decades of track record.
- Dot: the vendor, grey until it becomes enterprise ready, then purple. With Arrow on, the hollow ring shows where the vendor would be without cyber overflow, and the red arrow shows the shift. A faint dashed line shows the enterprise-ready line before it was lowered.
- Columns and bar: grey is below the floor, red is value from cyber, green is trust from track record, amber is capability from features. Faded red in the cyber column is cyber that protects the vendor but does not overflow. Ribbons widen when each point of cyber returns more than one point.
- Zones: Nice demo zone (floors met, below the line), AI slop zone (capable, not trusted), Legacy zone (trusted, not capable), MVP zone (below both floors).
Calculations
All values run from 0 to 100 on screen and from 0 to 1 in the code. c, t and v are the three vendor sliders. Fc, Ft and Fv are the floors, H0 is the hygiene layer, R is the dividend rate.
Overflow. Cyber above both the hygiene layer and the buyer's cyber floor produces overflow, split 60/40 and capped.
O = R × max(0, c − max(H0, Fc)) R: Off 0, Low 0.4, Medium 1.0, High 1.5 cT = min(0.6 × O, 0.15) trust from cyber cV = min(0.4 × O, 0.10) capability from cyber T = cT + t × (1 − cT) total trust, the dot's height V = cV + v × (1 − cV) total capability, the dot's position
Enterprise-ready line. Starts at the top at the capability floor and meets the trust floor at the 10× point, with diminishing returns in between.
V10 = Fv + 0.933 × (1 − Fv) A = (1 − Ft) / (1/0.1 − 1/(V10 − Fv + 0.1)), C = A / (V10 − Fv + 0.1) Required trust = Ft + (A/(V − Fv + 0.1) − C) × (1 − drop × taper(V)), limited to Ft…1
Lowers the bar. Verifiable security mostly lowers how much trust a buyer needs, rather than adding trust. When on, drop = min(0.5, 1.2 × O): the line's height above the trust floor shrinks by up to half. The taper fades the effect in over the first 25 points above the capability floor, so the line's start and the 10× point never move.
Status. Blocked if cyber is below its floor, trust or capability is below its floor, or less than the set share of a floor comes from track record or features. Enterprise ready if not blocked and trust is on or above the line.
Cost. Price per point × points, summed: cyber 1, trust 1.5, capability 1 by default. With Enforce limit on, a slider stops where the budget runs out.
Best possible plan. Every combination of cyber and capability is tried, each with the least trust that works. The cheapest one is shown. Saved by the overflow compares it with the same search when cyber has no overflow. A 0% saving is real: it means extra cyber costs more than it returns, so the best plan keeps cyber at the floor.
Cyber above the floor pays back. What the overflow is worth (extra trust and capability at their prices, plus trust no longer needed because the bar was lowered) divided by what the cyber above the floor cost. Above 1× it pays for itself. It falls as cyber rises because the overflow caps fill up.
Live calculation trace
The model's internal values right now. They update as you change anything.
Limitations
The numbers are illustrative calibrations, not measured data. The shape and the rules are the claim. The model shows one buyer and one use case; critical functions, such as DORA "critical or important" ones, would sit on a higher line. Time is not modelled, although it favours the thesis: track record takes years, security evidence takes months.
Checking the model after changes
At default settings the best possible plan should cost 139 with the dividend Off or Low, 134 on Medium and 126 on High.
The numbers are illustrative calibrations, not measured data. The shape and the rules are the claim.
Where an engagement fits.
An engagement finds where you sit on that chart for the bank in front of you, which floor its reviewer will test first, and the smallest real controls that move the dot, implemented, with evidence the reviewer can consume.
The spreadsheet isn’t an obstacle. It’s a specification, written by someone with a budget.
Prefer email? hello@keliuotis.io