Customer Proof Benchmarks: IT, Dev and Security Software (2026)

IT, dev and security software companies publish a written case study less often than any other B2B software category we measured. Of 221 companies selling compliance, identity, security and infrastructure tools, 48.4% have no written case study anywhere on their site, the worst of the seven groups in the StoryVoice Research Customer Proof Index. Inside a narrower core of eight clearly technical categories within that group (n = 163), it gets worse: 53.4% have nothing written at all.

How we measured this

This post extends the Customer Proof Index 2026, StoryVoice Research's crawl of 1,000 B2B software companies across 55 SaaSHub categories, measured on 2026-08-21. The 221-company "IT, dev & security" figure below is the group total already published on that report. For the deeper cuts in this post, we defined a narrower, unambiguous core rather than reusing the report's broader grouping: eight categories that are clearly developer infrastructure or security tooling and nothing else, CI/CD, error monitoring, log management, endpoint security, identity management, password managers, backup, and data integration. That core holds 163 companies. Every figure below states its own n, so you always know which of the two groups it describes.

The headline number: 48.4% have nothing written

Across all seven groups in the index, IT, dev and security software is the least likely to have any customer proof at all, written or video.

That gap is not small. A prospect evaluating a CI/CD tool or an identity platform is close to a coin flip on whether they will find any customer proof at all before they have to talk to sales, while a buyer shopping for HR software finds one nearly seven times in ten. Sales and CRM tools have the opposite problem: they are second-best at having something written, but worst at leaving the number out once they do (17.9%, tied for the weakest quality score in the index alongside the group above it).

Inside the group, security and infrastructure tools are the worst

The 221-company figure spans a wide range, from compliance software to identity platforms to backup tools. Restricted to the eight-category core we defined above, the pattern sharpens.

Backup, CI/CD and password managers sit well above even the 48.4% group average, each missing written proof more than two times in three. Identity management and data integration are the two bright spots, both closer to the HR software benchmark than to their own group's. That split is worth sitting with: these are not niche tools with nothing to say. Fivetran, Okta, Auth0, 1Password and CrowdStrike all sell into this exact set of categories and all publish real customer proof, which the next section covers. The 48 to 74% gap is a choice being made category by category, not a structural limit on whether infrastructure and security vendors can produce a case study.

When these companies do write one, it usually holds up

Of the 163 core companies, 76 (46.6%) have written proof and 43 have at least one story we could actually open and read. Among those 43, the story itself is usually solid.

So the story here is not thin writing. It is closer to the pattern our companion post on case study quality already found industry-wide: the parts of a case study that take the least verification effort (naming a customer, including a quote) are the parts companies get closest to right, while the part that requires the customer to disclose something specific (a number) is where 1 in 6 stories in this group falls short, worse than the 1 in 10 rate across all industries. For a category selling infrastructure and security tools, that is a plausible pattern rather than a surprising one. A customer will often agree to be named and to say something positive in a quote well before their security or platform team clears an internal metric for publication.

What the best in this category do

We did not hand-pick these from memory. Each example below cleared the same bar inside our own dataset: a named customer, a real quantified result, and a direct quote, all on the company's own site.

Bitrise, for Shopify. "Up to 50% faster CI/CD builds and 50% fewer tools," published 2026-08-14, with the Shopify engineering team quoted on why they moved off a homegrown setup. Bitrise runs five of these at once (Shopify, BuzzFeed, N26, Maven Clinic, Substack), each with its own number and its own dated publish stamp, the exact density this category is missing on average.

Fivetran, for Okta. The story states Fivetran freed Okta's FP&A team "nearly a thousand hours per year ($100,000)" by automating over 300 business-critical metrics, with a named team and a specific mechanism, not just a round percentage.

IDnow, for Gojob. "99.6% reduction in processing time" and a 90% profile completion rate, published 2026-06-15, about two months before our crawl. A staffing platform quoted on exactly what changed operationally, not a generic endorsement.

Zapier, for Just Eat Spain. The headline states a 60% cut in partner onboarding time, with the workflow described step by step: what a team used to do by hand, and what moved to automation instead. Specific enough that a reader in the same position could tell whether it would apply to them.

All four pair a real number with a named company and a quote that describes a mechanism, not just a feeling. That combination, not length or production value, is what put them in the 79% of this group's stories that get naming and quoting right.

The pattern across all three cuts

Put the three sections above side by side and a consistent shape appears. The categories that lag hardest at having anything written (backup, CI/CD, password managers) are also the ones where a mistake in the published number carries the most downside: a backup vendor overstating a recovery time, or an identity platform overstating a fraud-reduction figure, is a claim a technical buyer will try to break. That does not excuse the 48.4% gap. It does suggest the fix is not "write faster," it is "make it easier for the customer to say a true, specific thing out loud," which is the same gap a five-minute interview closes that a blank Google Doc does not.

Why this category lags, and why we are cautious about the reason

We measured what is published, not why. Two explanations fit the pattern and neither is something we can verify from a website crawl alone. Security and infrastructure metrics are often the kind a customer's own security or platform team has to clear before anything goes public, which is a slower and more internally political approval step than a marketing team signing off on a quote. And several of the weakest categories here (backup, endpoint security, identity) sell into buyers who are themselves cautious about disclosure, the same caution that makes their own product valuable. Both are plausible. Neither is something this dataset can confirm, so treat this section as informed interpretation, not a finding.

What to do about it

If you sell into this category and have zero written case studies, you are one of 107 companies in exactly this position, not an outlier. A five-minute customer interview produces more usable material than a blank document and an internal "could you write something up" request ever will, precisely because it does not require the customer to pre-clear a number before they start talking.

If you have case studies but no number in them, you are one of the 7 story-bearing companies here in the same spot, and a case study without a number is still worth publishing rather than left in a drawer waiting for legal sign-off on a metric.

If you want to see exactly where you stand, run your own case study library through the same checks we ran on these 1,000 companies.