NEW DELHI, Oct. 6 -- Cybersecurity startups are finding that proving they can protect customers is becoming almost as important as selling them protection.

Enterprises that once relied largely on certifications such as ISO 27001, which assesses a company's information-security practices, are now demanding evidence of how a startup actually secures customer data, who can access it, how that access is controlled, how quickly vulnerabilities are fixed and what happens after a breach.

The shift is making security reviews more detailed and extending the time it takes for startups to win and deploy customers, according to industry experts.

"Onboarding is moving from a questionnaire-led exercise to an evidence-led, risk-tiered review. Earlier...