A promising contract can expose costs and approval steps missing from a startup’s sales forecast. Founders need to understand them before committing to delivery.
A corporate customer wants to buy your software. The product team has completed a successful demonstration, the commercial terms look acceptable, and the founders have included the account in their cash forecast. Then the customer’s procurement team asks for evidence of security testing, access controls and an incident-response process.
The work may be entirely reasonable. The financial problem arises when nobody has allowed enough money or time to complete it.
Cybersecurity is attracting substantial investment. In “Cybersecurity Investors Put $6.8B To Work In The Third Quarter, Mostly In Larger Rounds”, published on 15 October 2026, Crunchbase News reported $6.8 billion invested in cybersecurity and privacy startups during Q3. That figure describes investor activity; it does not establish what an individual enterprise buyer will require from a supplier.
A more direct illustration comes from ENISA’s “Procurement guidelines for the cybersecurity of hospitals and healthcare providers”, published on 22 July 2026. The guidance addresses how healthcare organisations can incorporate cybersecurity into purchasing decisions. Although sector-specific, it gives startup suppliers a concrete reason to investigate a buyer’s security requirements early.
For founders, the practical question is how much work stands between commercial interest and permission to deploy—and who will fund that work.
A €240,000 contract can still create a cash shortage
Consider a hypothetical software startup negotiating a €240,000 annual enterprise subscription. Its forecast assumes the service will start at the beginning of month three, with an annual invoice paid at the end of that month.
The startup has €300,000 in unrestricted cash and net cash outflow of €60,000 a month before receipts or delivery costs associated with this prospective customer.
During procurement, the buyer identifies requirements that the startup has not budgeted for. Management estimates €30,000 of additional external expenditure on security assessment, remediation support and contract-related work. Approval and service commencement move back by three months, so the expected payment shifts to the end of month six.
| Cash movement | Original forecast | Revised procurement timetable |
|---|---|---|
| Starting cash | €300,000 | €300,000 |
| Existing net cash outflow over six months | −€360,000 | −€360,000 |
| Additional procurement-related expenditure | €0 | −€30,000 |
| Customer payment at end of month three | +€240,000 | €0 |
| Customer payment at end of month six | €0 | +€240,000 |
| Cash immediately before the expected customer payment | €120,000 | −€90,000 |
These figures are illustrative, not market benchmarks. They assume expenditure occurs before the customer payment on the relevant date, exclude taxes and customer-specific delivery costs, and treat all amounts as cash movements rather than accounting revenue.
The negative balance means the revised plan cannot be funded from existing cash. The company needs at least €90,000 of additional financing or changes to receipts and expenditure before that payment arrives, plus whatever operating buffer management considers necessary.
This does not mean the contract is unattractive. It means its annual value is insufficient to establish whether the company can afford to secure and deliver it.
When reviewing a deal of this size, I would want the forecast to show the lowest cash balance before collection. The subscription value can dominate the discussion while the expenditure and approval dates determine whether the business can reach the first payment.
Find out what approval actually requires
A buyer’s security questionnaire is easier to manage when the startup already knows which requirements are essential for approval.
Some requests may be satisfied by documenting controls already in place. Others involve engineering changes, external testing or evidence that a process has operated over time. A customer may also accept an interim arrangement, such as a restricted pilot, although that needs explicit agreement.
The distinction affects both the budget and the delivery promise. Commissioning a test does not establish that the findings will be resolved by the proposed launch date. Similarly, producing a policy document does not demonstrate that employees follow it.
The sales conversation therefore needs access to people who can explain the approval process. Knowing who reviews security evidence, when they can review it and what remains outstanding gives management a more useful forecast than an expected signature date alone.
For AI products, additional questions may concern which external model providers receive customer information, what permissions an agent has and how its actions can be reviewed. The answers depend on the product’s architecture and the buyer’s intended use. Promising a deployment before those questions have been examined can create work that the original quotation never contemplated.
Which costs belong to the customer?
The €30,000 in the example deserves its own investment decision.
Some expenditure may improve the product for several future customers. Better access controls or reusable security documentation can support a broader enterprise sales strategy. Other work may be specific to one buyer’s systems, reporting format or contractual demands.
Charging the whole amount against the first contract could understate its longer-term benefit. Treating it all as general investment could conceal an account whose requirements make it expensive to serve. Management needs both views when assessing the deal.
There is also internal effort to consider. Engineers completing questionnaires or supporting assessments may already be on the payroll, so their involvement does not necessarily create an immediate additional cash payment. It can still delay product development or another customer implementation. Those consequences belong in the delivery plan even when they do not appear as a new supplier invoice.
A sensible enterprise budget distinguishes reusable capability from customer-specific commitments and identifies the recurring work after approval. Renewals, evidence updates and contractual reporting can continue throughout the relationship.
Before spending begins, founders can also discuss whether a paid pilot, implementation fee or different billing schedule is commercially possible. Any revised payment arrangement needs to be agreed with the buyer; it cannot be assumed to solve a funding gap.
The most useful time to investigate these issues is while the deal can still be shaped. Once a launch date has been promised and staff have been allocated, changing the economics becomes harder. A credible enterprise sales forecast needs to include the work required for approval, the cost of maintaining the relationship and the date cash is expected to arrive.