Enterprises are moving beyond security certifications to scrutinize how cybersecurity startups protect data, control access and respond to breaches, lengthening sales and onboarding cycles.