For enterprise B2B products, who should you validate with first: users, buyers, or security teams?

We’re building an enterprise product for medical-device companies, and one thing I’m learning is that validation doesn’t come from just one person.

End users can tell us whether the product fits their workflow, but they may not control the budget. Buyers look at whether the problem is worth paying to solve. Then InfoSec and compliance may raise a completely different set of concerns. In our space, sales cycles are long and security reviews can become a major part of the process.

My current view is to start with user pain, bring buyers in early, and not wait until the end to involve security. But for an early-stage team, it’s difficult to validate with everyone simultaneously.

For those building enterprise B2B products, what sequence has worked for you? Have you seen strong user interest still stall during the buying or security review?