How do bootstrapped B2B founders get their first enterprise customers before affording compliance?

I've been wondering how other founders navigate this.

When you're building enterprise software, potential customers may expect security audits, SOC 2 reports, penetration testing, and extensive documentation before they're comfortable using your product.

But for a bootstrapped founder, those things can require significant money before you've earned your first dollar.

It feels like a difficult cycle: you need customers to fund security and compliance, but you need security and compliance to get customers.

For founders who've been through this, how did you get your first enterprise users?

Did you start with limited pilots, find a design partner, raise funding, or take another approach?

I'd really like to hear how people handled this in practice.