Capability Matrix · Decision path
Should you move, and by how much?
The component scores tell you which open stack to pick if you move. They do not tell you whether to move, or how far. That is the question a board votes on, so the matrix scores it: the incumbent and the partial moves are candidate paths, and the breakeven where each one pays back is computed from the same cost-to-serve cells the rest of the matrix is built on, not asserted.
This page is an illustrative worked example, a Zeek-heavy SOC profile grounded in the public lab's cost-to-serve envelope (Tier B, single host). The dollar cells are an archetype illustration, not a client's; the migration-cost row is the softest term (Tier C/D judgment until a client's sources are scoped). The per-client crossover, the reversibility kill-switch number, and the scored gates are the engagement work product (per MDR-0014).
MDR-0027 — the four scored paths
Stay competes on the same surface as replace.
Four paths, mutually exhaustive enough to frame the board decision (an engagement may add a client-specific variant). The incumbent is path P0, scored, not a prose baseline.
P0 · Stay
$120k/mo · migrate $0kStatus-quo SIEM (Splunk / OpenSearch schema-on-read). The baseline.
reversibility: n/a · detection-survivability: 100% by definition
P1 · Augment
$84k/mo · migrate $90kKeep the SIEM for hot/detection; offload cold/retention to Iceberg.
reversibility: high — the SIEM stays · detection-survivability: high — detections stay where they run
P2 · Hybrid-tiered
$66k/mo · migrate $220kClickHouse hot + Iceberg long + a SIEM/SH or open UI on top.
reversibility: medium · detection-survivability: Move #3 scores it (MDR-0029)
P3 · Full-replace
$48k/mo · migrate $480kOpen stack, SIEM retired.
reversibility: low · detection-survivability: the binding risk — Move #3 scores it
The breakeven — computed, not asserted
When each path pays back.
The crossover is a formula over cells, so a client who re-adds the columns gets the same month-count:
crossover_months(path) = migration_cost(path) / ( monthly_cost(Stay) − monthly_cost(path) )| Path | $/mo | migrate $ | saves/mo vs Stay | breakeven vs Stay |
|---|---|---|---|---|
| P0 · Stay | $120k | $0k | — | — |
| P1 · Augment | $84k | $90k | $36k | 2.5 mo |
| P2 · Hybrid-tiered | $66k | $220k | $54k | 4.1 mo |
| P3 · Full-replace | $48k | $480k | $72k | 6.7 mo |
Every path here pays its migration back against Stay inside a year, so the question is not whether to move but which path at the buyer's horizon. That is the frontier: the cheapest path changes as the retention/planning horizon lengthens, because a deeper move costs more up front and saves more after.
Cheapest path by horizon (cumulative cost, computed)
| horizon | 6 mo | 12 mo | 18 mo | 24 mo | 36 mo |
|---|---|---|---|---|---|
| cheapest | Augment | Hybrid-tiered | Full-replace | Full-replace | Full-replace |
The call flips along the frontier: Augment takes over from Stay at 2.5 mo; then Hybrid-tiered takes over from Augment at 7.2 mo; then Full-replace takes over from Hybrid-tiered at 14.4 mo.Those crossover months are computed from the cells above, so a board can see exactly where its own retention horizon lands and what would move it.
MDR-0028 — the board-defensibility read
One paragraph a CISO reads into a board minute.
Every recommendation ships the same four parts. For this illustrative Zeek-heavy SOC at a 18-month required-retention horizon:
- The call. P3 · Full-replace, which at this SOC's 18-month retention horizon and weights is the cheapest cumulative path past the 14.4-month crossover, with the detection-survivability and compliance gates (MDR-0029/0030) clear for this archetype.
- What being wrong costs. The reversibility cost of backing Full-replace out(retiring then re-standing a SIEM is why this path scores low) is the kill-switch number, drawn from the engagement's reversibility output (OFFERING Service 1), not re-derived here.
- The evidence tier. The query-cost advantage anchoring the savings is measured (Tier B, the Zeek-flagship re-run); the monthly cost-to-serve cells are modeled (Tier B-to-C); the migration-cost input is the softest term (Tier C/D judgment until the client's source inventory is scoped).
- The flip-sensitivity. A WORM mandate (17a-4 / DORA) would invoke the compliance gate (MDR-0030), disqualifying any path whose storage cannot enforce immutability and moving the call to a managed-catalog Hybrid regardless of cost; and if required retention drops below 14.4 months, the call flips from Full-replace back to Hybrid-tiered.
The risk gate (Move #3)
Cheapest does not win if it breaks detection or compliance.
The recommendation is the lowest risk-adjusted cost, not the lowest cost. A path that silently degrades a meaningful fraction of the client's detections (MDR-0029) or fails a mandatory compliance gate (MDR-0030) is ineligible to win on cost alone, because a full-replace that drops 30% of detections is not cheaper, it is broken. So the cost crossover on this page is the necessary half of the answer; the detection- survivability and compliance scores supply the eligibility filter that decides which paths the crossover gets to choose among.
In this illustration the gates are clear for a Zeek-heavy SOC, so the cost frontier decides. For a regulated buyer the gate often decides first: a WORM mandate can disqualify the cost-cheapest path before the crossover is even read, which is exactly the case the board read's flip-sensitivity names.
What this illustrative version holds back
The method is public; the client's numbers are the engagement.
- The dollar cells are an illustrative Zeek-heavy SOC archetype, grounded in the lab cost-to-serve envelope, not a client's. The per-client monthly cost-to-serve and migration cost are scored in the engagement.
- The migration-cost row is the softest term, a Tier C/D judgment until the client's source inventory is scoped, and the engagement shows the crossover's sensitivity to it rather than a hidden point estimate.
- The reversibility kill-switch number is drawn from the engagement's reversibility output (OFFERING Service 1), not invented here.
- The detection-survivability and compliance gate verdicts (Move #3, MDR-0029/0030) are scored per client against the client's actual detection corpus and regulatory regime.
Decisions: MDR-0027 (decision-path scoring) and MDR-0028 (board-defensibility read). The intake that classifies a client into the archetype and scored shortlist these paths are read against is the decision framework.