These are not real security features, they are implementation features that only the largest customers will demand, so they really are differentiation: SSO (ent

These are not real security features, they are implementation features that only the largest customers will demand, so they really are differentiation: SSO (enterprise kind, not log in with Google), Role based access control (i.e. custom roles, not the usual admins, managers and users), Log auditing. MFA should be the default. Because one day, Bob in sales is gonna click that link and enter his password that 850 other sites use.