Scoping & budget
Every number on the page can be taken apart.
An analyst describes a prospective client’s estate: assets, headcount, compliance, budget. StackFit returns a security stack, costs it over three years, and shows the reasoning behind each figure before anyone is asked to believe it.
Straight to the scenarios the team has already scoped.
- Year one
- $1,244,085Licences, infrastructure, implementation, training and people.
- Each year after
- $1,020,985The same, without the one-off setup.
- Three-year total
- $3,286,054Everything above, plus the people to run it.
- People to run it
- 5.93FTEAdministering the tools. Monitoring is counted separately.
- Nine products across thirteen categories, covering 77.8% of the HIPAA controls a purchase can satisfy.
- 90-day default retention sizes 5.42 TB of storage against 120.3 GB/day of ingest.
- Licences rise a little each year with the subscription uplift; the cash-flow chart carries each year separately.
- This stack needs 5.93 FTE to administer and the client has 2. Either the gap is hired, or the engagement is managed.
A worked example, not a live quote. Indicative budgetary estimates based on published list pricing as of 2026-09-14. Not a quote. Actual pricing subject to vendor negotiation, channel discount, and bundling.
ScopingThe problem
A security stack is usually scoped in a spreadsheet.
Somebody sits with a prospective client for an hour, writes down roughly what they run, and goes away to build a number. The number comes back a week later and it is three things at once: a recommendation, a budget, and a claim about compliance. Nothing on the page says which parts were researched and which were recalled.
The price is remembered.
A per-endpoint rate from a deal last year, a figure from a vendor deck, a number somebody was told on a call. None of it carries a date or a link, so none of it can be checked and all of it ages silently.
The people are free.
A tool with no licence fee is entered as zero. The two-thirds of a person it takes to run it is entered nowhere, which is how the cheapest line on the sheet becomes the most expensive thing in the estate.
The answer cannot be defended.
Six weeks later the client asks why the SIEM was sized that way. The sheet holds the result and not the reasoning, so the honest answer is that nobody now remembers.
The same conversation, with the arithmetic written down, dated and sourced.
IntakeWhat you do
Six questions, asked in the order a call answers them.
Every step is optional and every step saves as it is typed, because a scoping call does not produce clean data and an analyst should not have to choose between listening and filling in a form. An estimate sits in the margin and re-runs while the client is still describing the estate.
- 1
OrganisationWho they are.
Sector, region, headcount, currency. Region pre-ticks the frameworks a client of that kind usually answers to, and suggests a labour rate. It is a hint, never a constraint.
- 2
EstateWhat they run.
Thirty asset classes, from Windows endpoints to PLCs. Firewalls dominate log ingest and domain controllers are the loudest thing in a Windows estate, so those are the counts worth getting right.
- 3
ComplianceWhat they answer to.
Eleven frameworks. Ticking one promotes a product category from optional to mandatory and can lengthen log retention, which is why two clients with identical estates and different obligations get different stacks.
- 4
BudgetWhat they can spend.
Two independent budgets: what they can spend every year, and what they can spend once on getting it in. A stack that fits one and breaks the other is reported as such rather than quietly trimmed.
- 5
PreferencesHow they buy.
On-premises, cloud, hybrid or air-gapped. What they already own and intend to keep. How many security staff they actually have, which is what decides whether a self-hosted tool is a saving or a liability.
- 6
ReviewWhat it produced.
Reports on the five above and captures nothing of its own. It is where an analyst checks what the tool thinks it heard before anyone sees a figure.
And what comes back
Three options
Essential is the minimum defensible posture plus everything compliance mandates. Recommended is what to buy this year inside the stated budget. Deferred is real, worth buying, and deliberately not this year. The deferred one is priced too, so putting it off is a decision on the record rather than a silence.
A coverage matrix
Control by control, per framework, for the stack actually selected. What is left open is graded by risk and comes with a costed plan for closing it.
A proposal
Built from one document model and rendered four ways, so the paper that leaves the building cannot disagree with the screen it came from.
VocabularyWhat the words mean
Six words this tool uses precisely.
Most of them are in general circulation and most of them are used loosely. They are not used loosely here, and a figure is only as trustworthy as the reader’s understanding of what it counts.
- Scenario
- One client, one estate, one set of answers. It is saved, re-openable, and can be cloned to ask a what-if without disturbing the original. It is the unit of work here, and the only one.
- Sizing
- The estate turned into physical quantities: events per second, gigabytes a day, retention in days, storage in terabytes. Thirty coefficients do the conversion and each one carries a written basis for where it came from.
- Ops burden
- The fraction of a person it takes to administer a product, in FTE. A mandatory field on every catalog entry, because this is the number that decides whether a free licence is actually cheap. Monitoring the alerts is counted separately.
- Fit
- How well a product suits this particular estate: whether it scales to it, whether it can be deployed the way the client deploys things, and what it costs them in effort to operate. Explicitly not licence price, which would rank every self-hosted tool first.
- Coverage
- The share of a framework’s controls that a selected product actually claims to support. It is a shortlisting aid and it is not compliance: the distinction is carried verbatim into every export, and the disclaimer at the foot of this page is the exact wording.
- TCO
- Three years of everything: licence, support, infrastructure, implementation, training, and the people. Money is held as an integer number of minor units throughout and formatted only at the last step, so nothing rounds twice.
CatalogWhat it knows
A researched catalog, not a vendor list.
Every price is sourced to a URL and a date, and every price declares how it gets re-checked — against Microsoft’s retail price feed where a machine can do it, and by a named human reading a named page where it cannot. A price nobody can re-check is a price that goes stale silently.
- products, at least five in every category
- 65
- categories, from SIEM to deception
- 13
- frameworks, each graded for source quality
- 11
- controls mapped to the categories that support them
- 240
- Asset discovery
- Backup
- Deception
- EDR
- Email security
- IAM
- MDR
- NDR
- Firewall / NGFW
- PAM
- SIEM
- SOAR
- Vulnerability management
EngineHow it answers
Five stages, each a pure function.
No database, no network, no clock, no randomness. The same input produces the same output every time, which is what lets an analyst re-open a scenario six weeks later and defend the number in front of a client.
- 01sizing
Turns an asset inventory into events per second, GB/day, retention and storage. Thirty coefficients, each carrying a written basis.
- 02cost
Eleven pricing models, priced in integer minor units. Currency conversion in BigInt, because rupees pass the safe-integer limit at around a hundred million.
- 03scoring
Ranks candidates on estate fit, deployment fit and the effort to operate them — not on licence price, which would make every self-hosted tool look free.
- 04portfolio
Fills two independent budgets — annual and implementation — and reports what it could not fund, rather than quietly recommending a stack that fails the obligation.
- 05coverage
Scores the chosen stack against the selected frameworks, control by control, and grades what is left open by risk.
LimitsWhat it won't do
The rules it will not break to look better.
A scoping tool is worth only the trust placed in its worst number. These are enforced by the schema and pinned by tests, not left to discipline.
It will not invent a price.
Anything unsourced must carry a placeholder sentinel and a TODO. The schema rejects a plausible-looking invented number wearing the placeholder flag.
Open source is not free.
Operational FTE and implementation effort are mandatory fields. A three-year total that omits them is treated as a bug, not a simplification.
No figure ships unexplained.
Every engine output carries its rationale as text. A number with nothing to say for itself does not reach the screen or the proposal.
It will not call coverage compliance.
A product supports a control; it does not satisfy one. The disclaimer at the foot of this page is verbatim on every surface that shows a percentage.
OutputWhat comes out
One document model, four renderings.
The proposal is built once as typed sections and blocks, with money left as money until the final step. Each format renders that same model, so a renderer can never quietly disagree with the other three about what the recommendation was.
Every export carries the pricing disclaimer verbatim, and each format has a test asserting it is there. An export is where a client stops seeing the dashboard’s confidence badges.
Scope it on the call, not the week after.
Six steps, every one optional, saving as the analyst types. The estimate updates while the client is still describing the estate, and the proposal is a button rather than a project.
Six steps, and the first one is who the client is.