In the past where the teams I worked with test-drove compliance systems which actually work (demonstrated through PoC's using de-identified data), when it came to the procurement stage its always fallen through due to the factors I mentioned earlier. If they are not 'large' enough and/or not on some vendor panel, IT/C-level execs/Procurement do not want to touch them.
It's a similar concept when picking external auditors, no tier 1 organisation will pick anything outside of the big 4 (kpmg/pwc/ey/deloitte). The big 4 are always seen as the safe choice and no one will question those selections. This is not a good thing, but is standard business practice, unfortunately...
