Do I have product-market fit, or just polite design partners?

You are asking a question the general advice answers with a survey, and in security the survey lies. Buyers here are polite, deals slip rather than die, and design partners say yes because yes is free. What we have watched separate the companies that had fit from the ones that only had friends is a short list of things that cost the buyer something.

No losses is the warning sign.

You will hear "we have not lost a deal" in your own board meeting and report it as strength. It is the single most reliable warning sign in an early-stage security forecast. The dominant failure in enterprise security selling is not losing. It is slipping. Deals do not get declined. They go quiet, because a no costs the buyer a relationship and requires a justification they have no reason to write. A pipeline with no losses in it is a pipeline nobody has qualified, and the forecast is carrying every deal in it.

Force the no. End every stalled opportunity with a request that can be refused, a date, a name, a document, and record the refusals. A loss column with entries in it is the first sign you are selling to a market rather than to a mood.

Perfect retention is not fit.

You will be told that net revenue retention is the definitive measure of product-market fit in enterprise software. In security it can stay excellent inside a market too small to matter, for years. We have watched companies hold effectively no churn, expand steadily, and close almost nothing new for quarter after quarter, while the retention line let everyone in the room tell themselves the business was fine. The thing that would have told them the truth was new customers.

Report new customers separately from retention, and read that line first. Expansion inside existing accounts hides a broken new-customer engine for as long as the accounts last.

Watch what expands without being asked.

Expansion revenue gets counted all the same way, and it should not be. The accounts that grew repeatedly in our portfolio were the ones that had wired the product into a pipeline or a recurring workflow. Everything else was a static seat count that moved only when someone renegotiated it. If your expansion comes from renegotiation rather than from use, you have a tool rather than a dependency, and only a dependency survives when the buyer consolidates vendors.

Find the one product behavior that separates the accounts you keep from the accounts you lose, and make onboarding drive it. Where it was measured, the accounts that had encoded their own process into the product, through automation, extensions, or a wired-in pipeline, stayed at a dramatically higher rate than the accounts that never did. Logins and active users track effort, not value. The accounts that touch you least are often the healthiest.

The rename is the market's answer.

Iterating on positioning feels like diligence, and each new framing feels like progress. A company that cycles through category names, reopens pricing and packaging at every crisis, and rewrites its value proposition every few quarters is describing a market that is not pulling for it. Count the iterations. Past two or three, the thing being tested is not the message. The product you keep re-explaining is the product nobody asked for.

Fear is not fit.

The next breach gets planned around as if it were a growth channel. A headline incident can unstick deals already in motion and generate a wave of inbound interest, and it will not create a budget line. We have watched companies whose exact domain suffered repeated high-profile breaches get press cycles and inbound curiosity and no measurable change in revenue across years. Never build a plan whose demand assumption is the next incident.

Off-profile revenue is a loan.

Deals outside your ideal customer get taken to make the quarter, and early revenue is treated as good regardless of where it comes from. Book those deals separately. Accounts outside your profile churn at a much higher rate, and the most damaging losses arrive without warning, when a large customer cuts tools from a list rather than evaluating them one by one. Booked with the rest, they corrupt the retention numbers you will later use to judge whether the business works.

The six measures move together.

You are priced at every round against six measures moving together: revenue, growth, gross margin, an efficiency ratio, a churn ceiling, and a payback period, and the company is judged on its weakest one. There is a churn ceiling above which you do not have fit, whatever else is true. High churn is not a retention problem to fix later. It is evidence that the business is unproven. Payback tightens as you raise, and a persistently long one is a structure rather than a phase. Net churn after expansion is the number that describes the business, and which churn figure you lead with is a real choice.

The test on one page.

You have fit in security when you can point to buyers who paid, deployed in production, and expanded without being asked, who came from sources that did not already trust you, under a pitch that has held for two quarters, with a loss column that has entries in it. Polite design partners produce none of those. If you cannot point to that buyer, you have friends, and friends are not a market.