Thanks. What I've seen is that organisations are focused on process compliance, not technical security. As long as people can tick the boxes in standard supplie

Thanks. What I've seen is that organisations are focused on process compliance, not technical security. As long as people can tick the boxes in standard supplier assessment forms (which you can do with plain TLS, not even mTLS), you can be successful. The question is, does the product do something that people desperately want? They will find a way to fill out the forms / justify the use of the product if it does. It can actually make the process more difficult if you are very different from your competitors in your security strategy, people have to expend effort to understand why you are different. For mTLS specifically, it would be great as an option / thing that customers can configure if they want to go above and beyond, but may cause difficulties for many customer(s) as a requirement. As you observe, comparable vendors are generally plain TLS with a license / token / secret.