There is no sign of external validation. You have a single prospect saying, "We might use it if you add Z/Y/Z", and that's a typical soft rejection. If "get so

There is no sign of external validation. You have a single prospect saying, "We might use it if you add Z/Y/Z", and that's a typical soft rejection. If "get some compliance" means they asked for SOC2, that was a hard rejection. They felt that the problem being solved was not that important or urgent. Of course you think it's important because you are laser-focused on this one thing, but nothing is as important as you think when you are thinking about it. You have an idea and a perspective based on your experience, but you need evidence that enough people share this perspective. If your strategy/direction is correct, and the pain points you identified are valid, you should be excited to find ten other prospects/clients eager to use your solution today because their hair is on fire, and this vomit bucket could fix that. Your five years of experience could be illuminating your path, or it could be blinding you. Perhaps you believe your inexperienced cofounder is undervaluing your expertise by doubting your strategy, but that's your job - you should aim to prove your thesis wrong as quickly as possible.