How Many People Sit on a Cybersecurity Buying Committee — and Which One Kills the Deal

Published estimates run from 5 to 28 because different sources count different people. Gartner counts 6 to 10 decision-makers. Foundry counts 26 influencers on major enterprise purchases. Whichever number fits you, the deal stalls in the same two seats: procurement and legal.

Key takeaways

• The number depends on what you count. Gartner counts 6 to 10 decision-makers for a complex B2B purchase. Foundry counts 26 influencers on major enterprise technology purchases. Both figures are current.
• Cybersecurity-specific surveys land lower than enterprise IT averages. One buyer report found 68% of security purchases involved just 2 to 5 stakeholders.
• Forrester puts the average B2B purchase at 13 people, with 89% requiring input from more than one department.
• Deals stall on internal alignment, not on your product. Forrester found 91% of purchases stall at some point because internal teams cannot agree.
• Procurement and legal are the two seats almost no vendor publishes for, and the two documents that unblock them cost nothing to produce.

Who actually sits on a security buying committee?

Eight functions, in most organizations above about 200 people: the CISO or security lead, a security engineer or SOC analyst, IT or infrastructure, compliance or privacy, legal, procurement, finance, and an executive sponsor.

The reason published estimates disagree is that they count different things. It is worth knowing which number applies to you before you quote one at your own leadership.

• Influencers versus approvers. Foundry’s Role & Influence research counts everyone who influences the purchase and reports an average of 26. Gartner counts decision-makers and lands at 6 to 10. That definitional gap explains most of the spread.
• Company size. Foundry’s respondents work at large enterprises. Under 50 employees, the same purchase often collapses to one or two people.
• Whether the survey is security-specific. In one cybersecurity buyer report, 68% of purchases involved 2 to 5 stakeholders. A separate 2024 IT and cybersecurity buyer study found 86% reported at least three stakeholders and 43% reported six or more.

A workable planning assumption for mid-market security deals is eight people, expanding upward with deal value. Plan for eight, prepare material for all of them, and be unsurprised when a ninth appears late.

Which role most often blocks the purchase?

Procurement and legal. Not because they are obstructive, but because they enter late, and they enter with questions nobody on the committee prepared for.

The pattern is well documented. Forrester reports that 91% of purchases stall at some point because internal teams struggle to align. Its 2024 State of Business Buying research points to internal complexity rather than vendor performance as a leading reason deals stop moving.

The mechanism is mundane. A questionnaire arrives. Nobody owns it. It goes to whoever has capacity, comes back with gaps, and procurement asks follow-ups. Two weeks become six, and the quarter closes without the deal.

The questionnaires themselves are frequently a poor fit, which makes the delay worse. CISO Myke Lyons, describing vendor assessments in a Security Boulevard series, noted his team is still “asked more than ten questions about tape backups” as a modern cloud provider. A vendor who has already answered the generic version well is not just faster. They are conspicuous.

This is also why the champion cannot carry the deal alone. The champion sells your product. They cannot answer for your indemnity clause, your sub-processor list, or your data residency options. If you have not published those, your champion goes quiet at exactly the moment the deal needs them loudest.

What does each role need to read before they approve?

Different things, and the mismatch is usually total. Most security vendors publish almost exclusively for the first two rows of this table and nothing at all for the last four.

The two documents almost nobody publishes

A pre-completed standard security questionnaire, published openly rather than sent on request. CAIQ or SIG Lite both work. It removes three to six weeks from procurement’s calendar and it signals that you have done this before.

And a public legal pack: standard contract terms, a data processing addendum, a current sub-processor list, and stated data residency options. Legal’s questions are predictable. Answering them on a page you control is cheaper than answering them by email forty times a year.

The worst stall I have seen was not a legal review but a standard vendor-security questionnaire with a mandatory row for SSO and Active Directory integration. For an out-of-band incident-response tool the honest answer to that row is a deliberate no, since a tool wired into the identity infrastructure an attacker has just taken over is a tool you cannot log into mid-incident, and a bare “no” reads as a gap to a vendor-risk reviewer who was never given that context. What we published afterward was not a rebuttal but the criteria themselves, vendor-neutral and built into tabletop material buyers run without us, so that “no dependency on Active Directory, SSO or on-premise components” now reaches procurement as a line the security team scored for itself rather than an objection we raise six weeks too late.

How does committee size change with deal value?

It expands in steps, and each step adds a function rather than another person from the same function.

• Small deals in small organizations. One or two people. The security lead decides and IT implements.
• Mid-market, mid-value. Six to eight. Compliance and procurement join, and a formal vendor-risk review appears for the first time.
• Enterprise, or anything touching regulated data. Ten and upward in approvers, and considerably more in influencers. Legal, finance, and an executive sponsor all acquire a veto.

So a vendor moving upmarket does not just face a longer cycle. They face new people asking a different category of question, and the material that won the mid-market deal answers none of it.

What this changes on a content calendar

Three changes, ordered by how cheap they are to make.

Audit your content against the table above. Count the assets you have for each of the eight roles. Most security vendors find four or five of the eight rows completely empty, and they are usually the rows nearest the signature.

Publish the procurement and legal pack. It is a one-off effort, it needs no design, and it is the only content on this list that directly shortens a sales cycle rather than filling a funnel.

Write for the forwardable moment. Your champion is selling internally without you in the room. Every asset should survive being forwarded with no context and no covering note.

This is analysis of how the buying pattern behaves, not security or legal advice. Contract and compliance decisions belong with your counsel. The publishing decisions are ours.

Frequently asked questions

How many people are on a cybersecurity buying committee?

Between 5 and 15 approvers in most organizations, and up to 26 influencers on major enterprise purchases. Gartner counts 6 to 10 decision-makers; Foundry counts 26 influencers. The difference is definitional, not contradictory.

Who has final approval on a security purchase?

Usually the CISO or an executive sponsor holds the budget, but approval is rarely the constraint. Procurement and legal hold the ability to delay indefinitely, which functions as a veto in practice.

Why do security deals stall after a successful demo?

Because the demo persuades the people who attend it, and the people who stop the deal were not in the room. Forrester found 91% of purchases stall on internal alignment rather than on the product.

What is the fastest way to shorten a security sales cycle?

Publish a pre-completed security questionnaire and a public legal pack. Both remove weeks of back-and-forth from procurement and legal, and neither requires design, budget, or new research.

Does committee size differ between security and other B2B software?

Security purchases pull in compliance and vendor-risk review earlier than most categories, which adds functions rather than headcount. Some 2025 vertical breakdowns place cybersecurity at the top of the range for this reason.

Should content be written for the champion or the committee?

For the committee, delivered through the champion. The champion rarely needs more convincing; they need material they can forward to seven other people without having to explain or rewrite it.