A service provider closed with us last week. He had seven clients ready to onboard.

He bought licenses for two.

That decision is the whole argument I want to make, so let me be clear about what it isn’t. It isn’t a budget problem. It isn’t hesitation, and it isn’t a man who needs to be talked into the bigger number. It’s someone who has implemented software before, knows that the first two accounts are where he’ll find out what actually breaks in his delivery process, and would rather discover that on two clients than on seven.

That is a competent operator managing his own risk. And there is a whole category of compliance tooling that structurally will not let him do it.

What a floor actually buys

Minimum commitments — ten-client floors, annual seat minimums, platform fees that only make sense at volume — are common in this market. It’s worth being fair about why.

A vendor with a floor has a cleaner forecast. Contract values cluster. Sales cycles shorten, because there’s no expansion conversation to have later. Implementation teams can be staffed against a known number. If you are running a company that needs predictable annual contract value, a floor is a rational thing to want.

None of that is a reason for you to want one.

Notice what the floor does to the buyer. It converts an evaluation into a migration. You can no longer test the platform on one account and decide; you have to commit the book and then find out. The risk of that decision being wrong moved off the vendor’s balance sheet and onto yours, and you paid for the privilege.

In twenty-five years of doing this work — DoD, then CSO at an insurance carrier, then building a vCISO firm, and now watching thousands of organizations run programs on our platform — I have never seen a minimum commitment make an implementation better. I have watched plenty of them make implementations bigger, faster, and worse.

The pattern is consistent. A practice commits to twenty clients because the contract required twenty. They onboard all twenty in a quarter because the contract is already being paid for. The delivery process that worked fine for three clients does not survive twenty, and nobody finds out until client eleven’s quarterly review goes badly. Now they’re fixing a process in production, across twenty relationships, while defending a renewal.

Nobody in that story made a bad decision. The structure made it for them.

The evaluation you should be allowed to run

Here’s the thing a floor takes away from you: the ability to find out cheaply.

One client, thirty days, five questions. This is what a real evaluation looks like, and any platform worth buying can survive it.

Run one client against two frameworks in a single project. Not two projects that happen to share a folder. If the same control question has to be answered twice, you will do that duplicate work on every client you onboard for as long as you own the platform. Find out in week one.

Generate the client-facing report and hand it to someone non-technical. A board member, an office manager, your own account lead. If you rewrite it before it goes out, the platform didn’t remove the reporting work — it relocated it to you and called it automation.

Let a piece of evidence expire on purpose. Then watch. Does anything tell you? Does it tell you before your client’s auditor does? Evidence has a shelf life, and a system that records that something was once uploaded and then stops thinking about it will show you a green control backed by a screenshot from March.

Ask what that client’s maturity was ninety days ago. This is the question most platforms cannot answer at all, because they only ever recorded pass or fail. If the system can only describe today, it can never show improvement — and improvement is the thing you’re actually selling to your client. A status is a report. A trajectory is a retainer.

Price the second client. Not the tenth, not the bundle. Find out exactly what it costs to add one more. The answer tells you whether the commercial model is built for a practice that grows, or for a practice that signs once.

Thirty days. One client. Five answers. If a platform can’t be judged that way, ask yourself what the floor is protecting.

Earn the second

We built RealCISO so a consultant can run one client and decide. Per-client licensing, no minimum, no ten-client floor. If the first engagement doesn’t work, you found out for the price of one engagement, and I’d rather lose that argument cheaply than win it expensively and lose the renewal.

That’s not generosity. It’s a bet that the product holds up on client one and that the second client is easier to sell than the first. Every vendor makes some version of this bet. Ours just puts the risk on us.

The provider with seven clients will bring the other five over when his process is ready, not when a contract says it has to be. That’s how it should work.

Start with one. Earn the second.