Service Offering 3 · Modernization Discovery
A two-week paid wedge to size the migration before you sign the assessment.
Three deliverables in two weeks. A Capability Matrix shortlist scoped to your workload, a half-day reference-architecture workshop with your SOC and data-engineering leads, and a paper audit of your current Splunk billing and license. $20K fixed, 100% on signing. 100% credit toward the Migration Assessment if you sign within 90 days.
Who this fits
A paid step between "we should look at this" and "let's sign the Migration Assessment."
Some prospects know they want a paid first step before the full Migration Assessment. Maybe the assessment's $30K–$50K range is too large to greenlight on an intro call alone. Maybe procurement reality is that a $20K paid pilot opens the door that a free conversation cannot. Maybe the prospect simply wants to validate the working relationship and the analytical posture before committing the larger spend.
The Modernization Discovery wedge is built for that gap. Two weeks, $20K fixed, three concrete deliverables that feed directly into the Migration Assessment if and when you sign it. The 100% credit reflects that the work is real, not a discount.
This is not the right entry point if you'd rather reproduce the public benchmark methodology yourself; the methodology and code are open, and running them carries no cost to either side. It also is not the right entry point if an executive sponsor is committed to a specific vendor regardless of evidence. In both cases the wedge cost will not pay off.
What I deliver
Three artifacts in two weeks. Paper and workshop only; no production security data accessed.
Capability Matrix tailored shortlist.
I apply the public Capability Matrix methodology to your stated workload shape, scale, and constraints. The output is a 5–10-vendor shortlist with weighted scoring, criteria-by-criterion reasoning, and the vendor-claim-versus-shipped-reality deltas surfaced in the engagement-internal matrix. You see the working detail behind the scoring, not just the rank order.
Reference-architecture walkthrough and workload mapping.
A half-day workshop walking your SOC and data-engineering leads through the MOAR reference architecture: the layer model (ingest, storage, catalog, query, analytics), the foundational standards (Arrow, Iceberg, OCSF, Sigma), and the workload-mapping work that aligns your specific use cases to the right tool per layer. You leave the workshop with the architecture diagrams marked up against your environment, not with generic slides.
Splunk billing and license audit.
A paper-based review of your current Splunk tier, license terms, ingest pipeline, and contract structure. The output is a readiness brief naming the cost drivers, the contract clauses that affect migration timing, and the scoping doc that feeds the Migration Assessment if you choose to sign it. The audit runs on documents you provide. No production data egress, no agent on the indexers.
What it costs and how it converts
$20K fixed, 100% on signing. Two weeks. 100% credit toward the Migration Assessment within 90 days.
The prospect-side investment is small. Two to three hours of executive interview time. Workshop attendance from your SOC and data-engineering leads for the half-day session. Access to your current Splunk billing, license, and contract documents. No production security data accessed at any point; the wedge runs on paper and workshop only.
Pricing is $20K fixed, invoiced 100% on signing (Net 30). The wedge sits below the $25K matrix-bundle floor that applies to longer engagements, so the six-month matrix subscription and quarterly tool-eval reports do not attach here. The public methodology one-pager is the reading deliverable instead.
If you sign the Migration Assessment within 90 days of the wedge readout, the full $20K is credited against the Assessment. The credit reflects work already delivered. The shortlist scoring, the workload mapping, and the billing audit feed directly into the Assessment's TCO model and workload-classification deliverables. It isn't a discount; it's the same work, accounted once.
What this engagement is not
Three boundaries documented up front.
The Modernization Discovery wedge is not a benchmark on your data. The earlier "Benchmark on Your Data" proof-of-value offering was retired on 2026-05-18, because running benchmarks across a diversity of customers' production security data carries a regulatory-compliance burden that is operationally complicated to maintain. The public benchmark methodology is open and reproducible; you can run it against your own workload at no cost to either side. The wedge is paper plus workshop. If you want measured numbers on your data, that is what the Migration Assessment delivers, at $30K–$50K, with the engagement structure that makes the data handling defensible.
The Modernization Discovery wedge is not a production-ready architecture. The reference-architecture walkthrough teaches the layer model and maps your workloads at workshop fidelity; turning that into a deployment plan with named vendor selections, sequenced rollout, and risk register is the Migration Assessment or the Architecture Assessment, not the wedge.
The Modernization Discovery wedge is not a Migration Assessment in miniature. The Assessment exists because the work needed to greenlight a Splunk migration with a defensible TCO is genuinely two to three weeks of structured engagement, not a compressed-to-fit-the-budget exercise. The wedge sizes the work; the Assessment does it.
Two weeks. A shortlist, a workshop, a billing read. $20K, fully credited toward the assessment.
Start with a 30-minute intro call to confirm the wedge is the right fit for your situation.