Enterprise buyers like the product but security says no. What do you have ready before the first pilot? I will not promote

I see a lot of early B2B startups treat security review like paperwork that happens after the sale. That seems backwards for enterprise deals. The buyer might like the product. The champion might want it. The demo might go well. Then security asks where customer data goes, who can access it, what gets logged, how tenant isolation works, whether there is SOC 2, and what happens if they want to leave. At that point the deal is not really about features anymore. It is about whether anyone on the buyer's side can safely say yes. The hard part is that early teams usually cannot do the full enterprise checklist yet. SOC 2 takes time. Proper docs take time. Some security architecture decisions are expensive to change later. But I also don't think the answer is to hand-wave it in sales and hope nobody notices. That just creates a worse problem after procurement or legal starts asking detailed questions. What is the practical middle ground here? For founders selling B2B before they have a mature security program, what did you actually have ready before the first few enterprise pilots: a clear data-flow diagram, basic access controls, vendor list, export/delete process, security FAQ, lightweight pen test, something else?