The underwriters love your product. The pilot has gone well. Then procurement starts asking questions your team cannot answer.
The hidden risks that kill enterprise deals can sit outside the product itself: unclear data controls, untested security processes or AI that nobody has properly accounted for. A successful pilot proves something valuable. It does not necessarily prove that a customer can confidently deploy your product at scale.
At our recent founders breakfast, co-hosted with Price Forbes, we explored how to close that gap. The discussion brought together Maariyaah Afzal, Founder & CEO of Silas Insurtech; Robbie Tyrie, Founder & CEO of Torridon Cyber; and Nick Rugg, Head of Fintech at Markel. Eloise Morgan, Managing Director of Ventures at Price Forbes, moderated.
Their advice was practical: build the evidence that customers, investors and insurers will need before their questions become a barrier to growth.
The hidden risks that kill enterprise deals
Maariyaah described how Silas secured early pilots with large insurers relatively smoothly, only to face a much more demanding process when moving towards enterprise contracts.
“We have buy-in from all the underwriters, it should be relatively straightforward,” she recalled thinking. “But then you go to the procurement teams, then the IT teams and it escalates very quickly.”
The shift matters. The people testing your product may be convinced of its value. Those assessing whether to buy it also need confidence in how you handle data, manage security and govern the business behind it.
For founders, the lesson is to ask about those requirements during the pilot. As Maariyaah put it: “Being really prepared for that shift is the best advice I can give.”
Build controls you can evidence
Robbie sees a recurring problem in growing software businesses: security becomes an additional responsibility for the technology lead, then receives serious attention only when the company is ready to sell.
By then, missing controls can become a commercial obstacle.
“That’s the important thing, being able to evidence it,” he said.
A written policy is a starting point. The useful question is whether the team follows it and can demonstrate that it works. Robbie’s recommendations included knowing which assets need protecting, implementing multifactor authentication, training staff and testing controls.
Maariyaah offered a concrete example: Silas limited access to the data it received, particularly during training, so that sensitive information was available only to those who needed it.
She also argued that startups can build customer confidence while working towards ISO 27001 or SOC 2. Be clear about the controls already operating, the work outstanding and the timeframe for completing it.
Know where AI is used
AI governance starts with a surprisingly basic question: do you know how people in your company are using it?
Robbie described reviewing a mortgage broker where staff were uploading client financial information into an AI chatbot, without an AI policy in place.
His advice was to establish what data you hold, how it is processed, who owns it and where AI is being used. Maintain a register and a policy that people actually use.
This applies to internal working practices as much as the product you sell. A carefully governed customer platform does not answer the separate question of what an employee might upload to another tool.
Maariyaah’s approach to product development was equally grounded in the customer. Silas took its cues from the market, focusing on applications that underwriters were comfortable using and that added immediate value. Some more ambitious ideas remained in development until customers were ready.
Keep people accountable for outputs
Nick warned about “cognitive surrender”: people trusting AI so readily that they stop checking its work.
For an insurer assessing a business, the relevant questions include how AI is used and whether human oversight is present before its output helps deliver a professional service. Nick explained that AI could increase the frequency or severity of claims across familiar exposures, including professional liability, directors’ and officers’ liability, crime and cyber.
The practical implication is to make oversight explicit. Be able to explain who checks outputs and how errors are identified before they reach the customer.
Maariyaah made the commercial consequence clear through a hypothetical example involving an underlying model provider:
“If something goes wrong, I can’t sit there and blame Anthropic.”
Her point was about customer confidence and personal reputation. The customer has chosen your business. A failure in a component supplied by someone else can still damage trust in you.
Test readiness and discuss cover
Controls need testing. Robbie recommended a baseline assessment of gaps, staff awareness training and exercises such as a simulated incident response or a penetration test.
Nick suggested applying an approach he associated with Charlie Munger: work backwards from failure. “What are the things that are going to bring this idea or this business down? Identifying those risks early can help founders decide which safeguards to prioritise.”
Eloise positioned insurance as support around the controls a business puts in place: “People make mistakes, things can go wrong that you haven’t foreseen. Cyber cover can provide access to specialist forensic and legal support when those incidents happen.”
She also recommended taking specific concerns about AI exposures to the broker and insurer so that the intended cover can be clarified. That is a more useful conversation than relying on a broad description of a policy while your product and its use of AI continue to evolve.
Prepare for investor scrutiny
The same questions follow founders into fundraising.
Maariyaah said governance featured in Silas’s early investor conversations, with the demand for evidence increasing as the business prepared for later rounds: “Don’t just tell me about it, show me how you’re doing it.”
Start with the next commercial milestone. Ask what evidence it requires, identify the gaps and assign responsibility for closing them. That work should begin while the product is being tested, so that a successful pilot has a credible route to an enterprise deal.
Need help?
For support with cyber risk, security assessments and resilience, connect with Robbie Tyrie and the team at Torridon Cyber.
To discuss insurance for your business, speak to Eloise Morgan and the team at Price Forbes.
If you are building an Insurtech startup, Insurtech Gateway combines early-stage investment with hands-on support across insurance, regulation and venture building.