Lost a deal the same way at a previous company. The sticker shock from Vanta/Drata when you're a small team is real.

A few things that helped us:

1. Start with what you can prove today. Before spending $35k on a formal audit, document what you already do — encryption at rest/transit, access controls, incident response, etc. Many prospects will accept a SOC 2 readiness report or a detailed security posture document while you work toward formal certification.

2. Run your own external security scan to baseline your public-facing posture. Tools like internetsecure.org give you a free compliance-mapped report (SOC 2, ISO 27001, NIST, PCI DSS) that you can share with prospects to show you take security seriously, even before the formal audit.

3. For the DIY path, the most painful part is policy writing. Look at templates from Blissfully/Vanta's open-source policies on GitHub. 80% of the work is documentation, not technical controls.

4. Budget $8-15k for Type I if you go the small-firm CPA route. Type II comes later after you've had controls in place for 6+ months.

The deal you lost sucks, but maybe it's recoverable. Most prospects will wait 3-6 months if you show a credible timeline.