Regulatory Change
A new regulation passes or an existing one is amended — NIS2 transposition, DORA enforcement, NYDFS amendments, state-level privacy laws, SEC cyber disclosure rules. Affected organisations need to demonstrate compliance by a deadline.
Legal and compliance gain veto power over the architecture. 'Defensible to the regulator' becomes the spec. Existing tools that don't produce regulator-acceptable evidence get supplemented or replaced.
Augmentation or consolidation. The buyer rarely rips out — they layer evidence and reporting on top of existing controls. Vendors who can show 'maps to NIS2 Annex X / DORA Article Y / SEC Item 1.05 in your existing tooling' win.
Tied to the regulatory effective date or the first enforcement cycle. Often 6–18 months runway.
Selling the regulation as a category. The regulation creates demand for evidence and reporting; it does not create a new product category. Sell to the demand, not the regulation.