The Cost of Selling Cybersecurity Software

What cybersecurity companies pay reps, partners, and marketplaces to close a deal, and where self-serve fits in.

This post takes a closer look at the cybersecurity findings in The Cost of Selling Software, our 2026 benchmark survey of 608 software sellers and 551 buyers. The full report is free to read, no form required.

Nearly every cybersecurity company agrees that routine transactions (i.e., low-complexity, standard terms) are headed to self-serve. In our research, 96% of sellers say renewals, add-ons, and smaller purchases will increasingly move to digital channels. Only 21%, however, have a self-serve path in place at scale.

That means the majority of vendors are still closing many of those deals by hand. A renewal or seat addition that runs through a rep or partner carries a commission or margin, plus hours of internal work, even when the transaction required little of either. That’s the cost of selling cybersecurity software today, and our research measures it end to end, from channel payouts to the objections slowing the move to self-serve.

How is cybersecurity software sold today?

Through several channels at once. A security team might renew one tool through a cloud marketplace, buy another through a reseller, and add seats to a third inside the product. More than half of cybersecurity sellers earn revenue through each of those routes, plus direct sales, with cloud marketplaces the most common at 69%.

Renewals carry much of that revenue; 44% of cybersecurity sellers say renewals bring in more revenue than any other transaction type. Yet most still handle them by hand: among sellers that offer renewals, 70% route them through a rep or partner at least some of the time.

How much does it cost to sell cybersecurity software?

Each channel takes its cut. On average, cybersecurity sellers report that partners and resellers keep about 24% of deal value through margin, discounts, or commission. Sales reps earn about 12% of first-year contract value in variable pay. Cloud marketplaces have an average take rate of about 9%.

Those rates are in line with the broader software market, so cybersecurity isn't paying more per channel. The difference is how much it stings on routine work. When routine renewals and add-ons run through a high-touch motion, the downside cybersecurity sellers name most often is margin lost to commissions: 25%, about double the broader market's 13%.

Then there's the internal work. Nearly half of cybersecurity sellers (49%) say processing a single routine transaction costs $1,000 or more in staff time across sales, customer success, finance, and deal desk. For high-touch deals, that figure is 56%. A standard renewal, in other words, costs almost as much to process as a complex one.

Why hasn't self-serve worked in cybersecurity before?

Because early attempts often asked the checkout to do too much. That’s a common theme in our conversations with cybersecurity leaders: as companies looked to ride the product-led growth (PLG) wave, self-serve efforts focused on new customers, and many security products need configuration before they deliver value. When buying and deployment were treated as one step, customers who bought without talking to anyone often got stuck.

New purchases can still run through self-serve. For products that deploy quickly, or customers with the in-house skills to set them up, the whole path can be digital. For more complex products, a hybrid model works: the customer buys online, and a partner or services team handles implementation.

Renewals and expansions are simpler still, because the product is already deployed and running. Those transactions are where the easiest wins are today, even though they weren’t the focus of earlier attempts.

Good candidates for self-serve:

• Routine renewals on standard terms
• Seat additions and usage expansions
• Standard upgrades and plan changes
• Smaller new purchases

Keep reps and partners involved for:

• Large multi-year agreements
• Security and compliance reviews
• Complex deployments and configurations
• Custom pricing, discounting, and special terms

Buyers draw a similar line. According to the research, 55% want a human available for large multi-year agreements, and the same share want one for security and compliance reviews. That scrutiny carries extra weight for security vendors, whose enterprise customers often run detailed assessments before they buy.

Are more cybersecurity companies moving to self-serve now?

Yes, and faster than the rest of the software market. Twenty-one percent of cybersecurity sellers already have a meaningful self-serve path in place at scale for routine transactions, compared with 17% of all sellers.

Another 44% expect to get there within 12 months (41% of all sellers). Altogether, 65% already have a self-serve path or expect one within a year. Across all sellers, that figure is 58%.

Most see a hybrid model ahead: 91% say they're likely to explore keeping reps on complex deals while moving low-touch transactions to a digital path.

What do cybersecurity companies gain from self-serve?

The most direct gain is margin. Routine renewals and add-ons completed through self-serve can avoid most of the commission and processing cost described above.

Software buyers are also willing to complete larger purchases on their own. In the buyer research, 53% would complete a routine self-serve purchase of $25,000 or more, and 17% would go to $100,000 or more, assuming standard terms and the option to bring in a person.

Self-serve can also help keep customers. When routine renewals wait on a rep, they can lapse: 21% of cybersecurity sellers say higher churn is the biggest downside of keeping renewals high-touch, compared with 12% across the market. Buyers, meanwhile, are already comfortable with the alternative; 67% renewed a software purchase through self-serve in the past 12 months.

Companies that already have self-serve at scale also handle routine transactions differently. Across the full research sample, 61% of them have a dedicated owner who consistently drives routine renewals and expansions in their direct motion, compared with 35% of sellers without self-serve at scale. They're also far more likely to call their partners very effective for routine work (66% vs. 38%), a sign that a digital path can sharpen the channel rather than replace it.

What's holding cybersecurity companies back, and how do they get past it?

Most cybersecurity companies want a self-serve path. The objections come up when it's time to build one. Security and fraud concerns lead, cited by 38%, slightly below the broader market's 42%. Where cybersecurity sellers stand apart is on churn, compliance and tax, and sales pushback, which each run 7 to 10 points higher than the field.

Here are five notable objections, what each one involves, and how to address them.

1. Security and fraud: still the top concern

For a security vendor, this one hardly needs explaining. Cybersecurity companies sell trust, and a checkout that invites fraud or mishandles payment data would undercut the product itself. It’s no surprise this objection still ranks first.

How to address it:

• Fraud screening on every transaction, with clear ownership of chargebacks and disputes
• Payment data handled to PCI DSS standards by whoever runs the checkout
• A defined review path for transactions that look suspicious

This is the widest gap in the data: 35% of cybersecurity sellers worry about losing customers when routine transactions move to self-serve, compared with 25% of all sellers. For a subscription business, a renewal that lapses during a process change is revenue that may not come back. It also shapes the proof leaders want: 35% of cybersecurity sellers say improved renewal rates would convince them to back self-serve, versus 27% across the market.

How to address it:

• Start with renewals on standard terms, since buyers rarely need a rep for them
• Keep a rep or partner on call for accounts that show risk signals before renewal
• Compare digital and rep-led renewal rates from day one
• Run renewal reminders, payment retries, and win-back outreach automatically, so fewer renewals lapse by accident

Cybersecurity vendors can also tighten subscription management to keep renewals steady.

3. Internal sales pushback

Thirty-six percent of cybersecurity sellers name pushback from their own sales team as an objection, versus 29% of all sellers. The ownership data shows the tension. Among cybersecurity sellers with a direct sales motion, 44% say a dedicated owner exists for routine renewals but often deprioritizes them for bigger deals. Across the market, that figure is 35%.

In other words, reps often aren't prioritizing routine renewals, yet sales teams may still resist handing them to a digital path. What can win them over is proof. When asked what evidence a decision-maker would need before backing a move to self-serve, cybersecurity sellers most often point to better forecasting accuracy (42%) and customer adoption data (38%).

How to address it:

• Agree on crediting rules before launch, so digital renewals don't quietly come out of a rep's number
• Share pilot adoption data with sales leadership early, not after rollout
• Point the freed-up capacity at expansions and net-new deals

Sales-led companies can also add a digital path without sidelining reps.

4. Compliance and tax

Thirty-five percent of cybersecurity sellers cite compliance or tax concerns, versus 27% across the market. Selling self-serve across borders means getting sales tax, VAT, and invoicing right in every market, without a rep or finance team checking each order.

Compliance blocks buyers too. In the buyer research, a security or compliance review was the most common reason buyers couldn't use self-serve, cited by 38%.

How to address it:

• Tax calculated, collected, and remitted correctly in every market you sell into
• Invoice and purchase order options for buyers whose procurement requires them
• Security and compliance documentation buyers can find without booking a call
• A clear route to a person when a buyer's review needs one
  

Fewer cybersecurity sellers cite channel conflict than the market does (19% vs. 23%), but the stakes are real. More than half sell through partners, who keep about a quarter of each deal, and 29% name attribution and crediting rules as an objection.

How to address it:

• Decide up front which transactions stay with partners and which move to self-serve
• Credit partners on digital renewals of the accounts they sourced
• Point partner effort at complex deals and new logos, where their margin buys the most

Partner-led companies face their own version of this, and there are ways to add digital buying without channel conflict.

Bottom line

Cybersecurity companies sell through several channels at once, and every one of them takes a share. On complex deals, that share pays for real work. On routine renewals and add-ons, it often doesn't.

The self-serve attempts that stalled years ago were aimed at new customers who needed help deploying. Renewals and expansions don't carry that problem, buyers are ready to complete them on their own, and most cybersecurity sellers expect to have a path in place within two years. The first step is the same for most: start with routine revenue and settle the objections (from fraud to partner credit) before launch.

FAQs

What counts as a routine software transaction?

In The Cost of Selling Software, a routine transaction is defined as being low-complexity, using standard terms, needing minimal negotiation, and requiring no special approvals. Typical examples are renewals, add-ons and seat additions, and smaller new purchases. Complex (i.e., high-touch) transactions are larger new purchases, plus renewals and expansions that need non-standard terms, significant discounting, or special approvals.

How was the research conducted?

Cleverbridge and Ascend2 Research surveyed 608 B2B software sellers and 551 B2B software buyers, all manager-level or above. Sellers work at software and SaaS companies with $1 million or more in revenue. Respondents came from the US, Canada, the UK, Germany, India, and Australia. Cybersecurity was the primary software category for 77 sellers, or 13% of the seller sample.

How are the channel cost averages calculated? 

Sellers chose from ranges for each channel's payout, and the averages use the midpoint of each range, excluding "varies" and "not sure" responses. Only sellers using a channel answered for it: among cybersecurity sellers, 43 reported rep commission, 42 reported partner margin, and 53 reported marketplace take rates.

Do cloud marketplaces count as self-serve? 

No. The research treats them as separate channels. Self-serve means purchases made through a seller's own website or inside its product, while cloud marketplaces are third-party storefronts such as AWS Marketplace.

Is self-serve the same as product-led growth?

No. Product-led growth is a go-to-market strategy where the product itself drives acquisition, often through free trials or freemium tiers. Self-serve purchasing is a buying path: a way for customers to buy, renew, or expand without a rep. A sales-led cybersecurity company can offer self-serve renewals without becoming product-led.

Cybersecurity findings are based on 77 sellers. Treat subgroup comparisons as directional.