Service 1a · POV
Benchmark on your data.
One to two weeks, $15K fixed. The lightest entry point: take a representative slice of your actual workload, run the published benchmark methodology, deliver the headline TCO and performance numbers as a single readout. Designed as a no-regrets first step that converts cleanly into the full Migration Assessment if the numbers warrant it.
Why this shape
The published benchmark, on your data, with the math attached.
The published benchmark validates the cost-and-performance claim on a 10-million-event Zeek workload — 145× ClickHouse versus the dominant schema-on-read SIEM, 8.2× compression. Methodology and result are public; reference implementation under NDA. The question every prospect asks at this point is the right one: does this hold on our data? The POV is the engagement designed to answer that question with measured numbers rather than projections.
The shape is intentionally small. One or two log sources. One or two million events at the low end, ten million at the high end. One chosen MOAR engine versus the current Splunk baseline. No promises about what the deeper migration would look like — that's the Migration Assessment's job. The POV produces the load-bearing data point; the next engagement does the rest of the work.
What you get
Two deliverables. The readout, and the script that produced it.
POV readout — one page, CISO-ready.
Headline TCO and performance comparison: current Splunk spend on the workload sample versus the modeled cost on one chosen MOAR engine (typically ClickHouse for the speed-first case, occasionally Trino or StarRocks if the workload shape suggests otherwise). Side-by-side query latency on the actual production-shaped queries. Compression ratio measured on the actual data. Path-to-full-assessment estimate with the POV cost credited.
Benchmark replication script.
The same methodology, packaged as scripts your team can re-run with more data before committing capex. Docker Compose definitions for the engines tested, query suite parameterized against your schema, analysis output in JSON. The replication script is the credibility commitment — the POV is reproducible on your hardware, with your data, by your team. The vendor benchmarks the prospect is comparing against typically can't make that claim.
What it costs you
Minimal time. Anonymized data. No production access required.
The prospect-side cost stays small by design. One to two hours of executive interview time on the scoping call. One working session with the security-data-engineering lead to define the workload sample and the queries the benchmark should exercise. Anonymized sample data — 1–10M events from one or two representative log sources, with personally identifiable fields scrubbed at export. No production access required; no read-back of production data; the benchmark runs on the sample, not the live environment.
Pricing is $15K fixed. POV cost credits toward the full Migration Assessment if the engagement proceeds within 90 days of POV readout. The credit applies in full — the POV is the first phase of the deeper engagement, priced separately for prospects who want a smaller commitment up front.
Bundle terms
The matrix subscription begins on conversion to the full assessment.
Engagements above the $25K floor include a six-month matrix subscription plus two quarterly tool-eval reports. The POV is below that floor. POV clients receive the public methodology one-pager plus the POV readout; the matrix subscription begins when the engagement converts to the full Migration Assessment. The matrix is the standing IP, bundled into engagements where the relationship can support continued investment — not into a lighter-weight POV where the relationship is still being established.
The benchmark is the proof. The POV is the proof on your data.
Start with a 30-minute discovery call to confirm fit. The POV is the no-regrets first step.