Breach / Incident

The organisation gets hit. Confirmed compromise, lateral movement, data exposure, or active intruder. Real or imminent, not theoretical.

The buyer goes from 'evaluating options' to 'I need this functional by end of week'. Procurement gets bypassed. Existing tools that were tolerated suddenly aren't.

Managed outcome or replacement. The buyer is not buying a tool; they are buying out of a crisis. Vendors who arrive with a 30-day deployment plan win; vendors who arrive with a discovery deck lose.

Days to a few weeks. Pipeline that does not close inside the incident window almost never closes after — the urgency evaporates with the cleanup.