Cybersecurity purchases take seven months on average from the moment a need is identified to the choice of vendor, and 55% are decided in under six months, according to a survey of 500 cybersecurity decision makers in the US, UK, France and Germany fielded by Coleman Parkes for The Hoffman Agency in April 2026. The average deal in the same survey was £574,400. That is a large purchase made quickly, and it changes what a security vendor's website has to do.
This page collects the dated numbers on how security software is bought: how long the journey runs, when buyers contact vendors, which sources they trust, what makes them drop a vendor, and what 20 security vendor sites give a buyer who researches alone. The cross-industry data is in our B2B SaaS buyer journey statistics; this post stays on security.
Who the security numbers describe
Most buyer journey data covers all of B2B. Three surveys focus on security, and each has a caveat.
Hoffman Agency and Coleman Parkes. An online survey of 500 decision makers at organisations with 100 or more staff, all of whom had made a major technology purchase in the past 12 months, split evenly across financial services, technology and media, healthcare, retail and the public sector. The Hoffman Agency sells PR to cybersecurity vendors. Job titles skew away from the security team: IT managers 18%, heads of IT 15%, security managers 15%, heads of fraud 14%, heads of compliance 14%, and CISOs only 4%.
Ponemon Institute and NOLA Marketing. 320 decision makers at mid to large enterprises who are directly involved in security purchases and renewals, published 15 June 2026. NOLA Marketing is a cybersecurity marketing agency. Fieldwork dates are not stated in the summary we read.
ActualTech Media and Future B2B. The 2025 Cybersecurity Buyers Report, published November 2024 from a 2024 survey. Both firms sell lead generation to security vendors, and the report does not state its sample size.
Read them as the best available signals from firms with a commercial interest in the answer, not as neutral benchmarks.
Research time: shorter than B2B overall, and still months
| Measure | Figure | Source and sample |
|---|---|---|
| Need to vendor selection, security | 7 months average | Hoffman Agency, 500 security decision makers, April 2026 |
| Under 3 months; 3 to 6; 6 to 12 | 15%; 40%; 29% | Same |
| 13 to 18 months; over 18 months | 11%; 4% | Same |
| Budget planned 6 months or more ahead, security | 28.4% | ActualTech Media and Future B2B, 2024 survey |
| Budget planned 30 days or less ahead, security | 10% (4.1% the year before) | Same |
| Average buying cycle, all B2B | 10.1 months (11.3 the year before) | 6sense, nearly 4,000 buyers, 2025 |
| Longest stage, software buyers: evaluation | 40% | G2, 1,038 decision makers, June 2026 |
| Top delay after selection: IT security review | 39% (50% at enterprises) | G2, June 2026 |
Sources: Hoffman Agency, Fast decisions, high stakes, 2026; ActualTech Media and Future B2B, 2025 Cybersecurity Buyers Report; 6sense 2025 B2B Buyer Experience Report; G2 2026 Buyer Behavior Report
The security cycle is shorter than the 6sense B2B average, though the two measure different spans: Hoffman counts from need to vendor choice, 6sense the whole purchase. Hoffman's explanation is urgency. 49% of its respondents say an attack drives their buying choices, and 62% expect to work with new security suppliers in the next year.
The security review sits on the other side of the table too. G2 found IT security review is the most common delay after a software vendor is chosen, for 39% of buyers and 50% at enterprises. A security vendor is reviewed by people who do this for a living, so its own security page is read more closely than most.
Deployment adds months. ActualTech found only 50.4% of security projects go live within six months of contract signature; 42% take six to 12 months.
Self-serve preference: research alone, but contact early
Across B2B, the preference for doing the work alone is clear. Gartner's survey of 646 B2B buyers, fielded in August and September 2025, found 67% prefer a rep-free buying experience. 6sense found 94% of buyers rank their shortlist before speaking to a seller, the winner was on the day-one shortlist 95% of the time, and the first seller contact comes 61% of the way through the journey. TrustRadius, surveying 1,862 technology buyers in January 2026, found 83% shortlist three or fewer products.
Security buyers look different in one respect. Hoffman found 65% engage vendors before shortlisting: 25% at discovery, 40% at longlisting, 27% at shortlisting and 9% at purchase. Its question counts asking a vendor for information as engagement, which includes a content download or a pricing request, so it does not contradict the 6sense figure. It does say that security buyers reach out early, while the list is still long.
They want to buy direct. ActualTech found 64% of security buyers prefer to buy directly from the vendor rather than through a reseller or integrator, up from 49% a year earlier, and 70.9% at companies with fewer than 100 staff. Its authors add that a preference to buy direct does not mean buyers click "buy now".
Where security buyers look, from awareness to selection
| Source | Awareness | Final selection |
|---|---|---|
| Direct peers | 35% | 22% |
| Industry analysts | 32% | 23% |
| Industry events | 28% | 23% |
| Trade media | 26% | 18% |
| Management consultants | 23% | 22% |
| LLMs | 20% | 20% |
| Vendor's own material | 17% | 12% |
| Paid vendor campaigns on LinkedIn | 15% | 10% |
| Webinars | 12% | 8% |
Source: Hoffman Agency and Coleman Parkes, 500 security decision makers, April 2026
Buyers narrow their sources at selection rather than switch them. LLMs are the only source that holds steady, used by 20% at both stages; 8% of respondents use them all the time and 10% never. Ponemon and NOLA found 51% use chatbots for product research and 48% read AI overviews, and G2 found more than 80% of software buyers used AI chatbots to source recommendations in the past two years.
Analysts matter more in security. Hoffman found 55% of security buyers use industry analysts to help shortlist, 52% systems integrators, 44% management consultants and 34% sourcing consultants; fewer than 1% use no outside help. Across all technology buyers, TrustRadius found only 13% used analyst reports to make a purchase decision. The surveys differ, but the gap is wide enough to plan around.
Peers come first. Ponemon and NOLA found 55% rank peer recommendations as the top discovery source. The vendor's own material is one source among many, and it is the one the vendor controls.
What wins and loses a security deal
| Finding | Share | Source |
|---|---|---|
| Most valuable vendor content: technical information | 49% | Hoffman, 500 buyers |
| Most valuable: customer use cases | 43% | Hoffman |
| Biggest influence on selection: analyst report featuring the vendor | 39% | Hoffman |
| Biggest influence on selection: case studies | 29% | Hoffman |
| High or medium impact: evidence of delivering for similar businesses | 87% | Hoffman |
| High or medium impact: simple to integrate; value for money | 89%; 89% | Hoffman |
| Reject for lack of evidence of success for businesses like theirs | 44% | Hoffman |
| Reject for slow response | 37% | Hoffman |
| Reject for lack of relevant information after contact | 33% | Hoffman |
| Messaging lacks technical depth | 52% | Ponemon and NOLA, 320 buyers |
| Want more website content during evaluation | 45% | Ponemon and NOLA |
Sources: Hoffman Agency and Coleman Parkes, April 2026; Ponemon Institute and NOLA Marketing, June 2026
The two surveys agree: security buyers want technical detail and proof from organisations like theirs. Vendor blog posts were the least influential content type in Hoffman's list, at 13%.
Trust is the underlying problem. Sophos, which sells security products, reported in March 2026 that 79% of 5,000 organisations across 17 countries struggle to assess the trustworthiness of a new security provider, and 95% do not fully trust their current vendors. Respondents named a lack of accessible, detailed information as the main barrier. Gartner's 2022 survey of 418 organisations found 75% pursuing security vendor consolidation, up from 29% in 2020, so many new purchases are replacement decisions.
What 20 security sites give the buyer who researches alone
We read the public sites of the same 20 security vendors covered in our Cybersecurity Demo Request and Lead Form Statistics 2026 post on 28 October 2026. For each, we checked five touchpoints the surveys above point to: a published price, a trust or security page, a trial or free plan a visitor can start without a request form, pages comparing the vendor with named competitors, and a landing page for a Gartner or Forrester report. We fetched pages and sitemaps directly, created no accounts and submitted no forms.
| Segment | Published price | Trust or security page | Self-serve trial or free plan | Competitor comparison pages | Analyst report page |
|---|---|---|---|---|---|
| Endpoint, detection and MDR (6) | 4 | 6 | 2 | 5 | 5 |
| Cloud, data and application security (5) | 2 | 5 | 3 | 4 | 4 |
| Email and human risk (4) | 2 | 4 | 1 | 3 | 3 |
| Identity, network and compliance (5) | 2 | 5 | 3 | 4 | 5 |
| All 20 | 10 | 20 | 9 | 16 | 17 |
Source: Octo Agency read of 20 vendor sites, 28 October 2026. Vendors: CrowdStrike, SentinelOne, Huntress, Arctic Wolf, Darktrace, Rapid7; Wiz, Orca Security, Snyk, Semgrep, Cyera; Abnormal, Proofpoint, Material Security, KnowBe4; Okta, 1Password, Zscaler, Palo Alto Networks, Vanta.
Trust pages are universal. Every vendor had one, most as a separate trust centre. That matches the Sophos finding: it is now a hygiene check, and buyers judge it on detail, not existence.
Price splits the field. Ten publish at least one figure, from KnowBe4's security awareness training at $1.63 to $3.75 per seat a month to Rapid7's cloud security tier from $5,775 a month. Wiz, Zscaler, Vanta and Cyera have pricing pages that name plans or a model and ask for a quote. TrustRadius says transparent pricing has been buyers' top wish for four years running.
Trials often hide a sales step. Nine let a visitor start a trial or free plan by signing up or through a cloud marketplace. Four more mention a trial but route it through a form: Proofpoint's page promises an expert will reach out within 24 hours, and Darktrace's "Start free trial" button leads to its demo form.
Three sites had all five touchpoints: 1Password, CrowdStrike and Semgrep. Huntress, Material and Snyk lacked only an analyst report page; Okta lacked only comparison pages.
We dropped a sixth check, public technical documentation, because several documentation sites sit behind logins or bot checks and could not be judged consistently. Huntress's sitemap was blocked, so its analyst column rests on its homepage alone. The raw file is research/OB-0224-cyber-self-serve-touchpoints-2026-10-28.tsv.
What the data does not say
No dataset we found measures how many pages a security buyer views before contacting a vendor, how long a proof of concept takes, or how a CISO's research differs from an IT manager's. Two of the three security surveys come from agencies that sell to security vendors, and the largest has few CISOs in its sample. Our 20-site read is a snapshot of what is published, not of what converts.
What this means for a cybersecurity site: a five-page test order
Security buyers decide in months, contact vendors early, lean on analysts and peers, and reject vendors that cannot show proof. The pages to fix first carry that proof to a buyer who has not called yet.
1. Customer evidence by industry and size. Lack of evidence is the top rejection reason at 44%. Test case studies filtered by sector and company size against a generic logo wall.
2. Technical product pages. 49% value technical information most and 52% say messaging lacks depth. Test an architecture and integrations section high on the page.
3. Trust centre. Everyone has one. Test how quickly a reviewer finds certifications, the subprocessor list and a way to request the SOC 2 report.
4. Pricing. Half of the vendors we read publish a figure. Test a starting price or worked example against a quote form, measured on qualified pipeline.
5. Contact and demo page, last. Buyers reach it early, so the test is speed: a short form and a reply within hours. The form data is in our web form conversion statistics and demo request conversion rates.
We build marketing sites in Webflow on a four-week process, and this is the order we would start a security brief in. Our marketing websites service page explains how we scope one.
