Start with the work actually performed
What does the service pay for, and what remains in-house? Describe current tasks: alert assessment, evidence research, coordination, reviews, action tracking and support planning. Alert counts and software budgets represent only part of this work’s cost.
Observe a representative period and record the time of the people involved. Separate recurring work from exceptional operations. Count every participant’s time without counting overlapping categories twice, such as assessment and review preparation. This provides a comparison baseline teams can verify.
Distinguish capacity, expenses, predictability and risk
Freed hours can be assigned to other work. Their value represents available capacity, not an automatic reduction in payroll or cash outflows. An avoided expense is different: an external intervention or purchase that genuinely no longer occurs. Keep evidence and avoid valuing the same work twice.
Predictable migrations and better decisions matter too. Assess them through advance notice, prepared decisions or retrievable evidence. These benefits do not necessarily have an immediate price. A hypothetical avoided penalty or attack is not a certain saving to add to the calculation.
Compare similar scopes and service levels
Include data provision, responses, decisions, coordination and retained interventions in post-service effort. Compare the same tasks and coverage. If the service adds previously absent monitoring, identify that addition separately: it may meet a need without reducing an existing workload.
Account for existing tools. Dependency-Track, for example, already offers component tracking; the quote should make the additional assessment and management work understandable. Separate setup from recurring costs without recounting work already included in the monthly fee.
Sources: Dependency-Track v4.14: portfolio tracking capabilities
An explicit calculation using your inputs
Let H0 be current monthly internal effort, H1 estimated retained effort, C fully loaded hourly cost, F the monthly service fee and I the setup cost. Hours available for other work equal H0 − H1. Their annual value is 12 × (H0 − H1) × C.
When F is known, the estimated annual difference is 12 × (H0 − H1) × C − 12 × F − I. If F is known and C is strictly positive, monthly break-even hours are (F + I / 12) / C. Before receiving a quote, estimate hours and their value; the full comparison awaits the price. This compares workloads and does not predict cash savings.
Worked example using fictional assumptions
With H0 = 35 hours, H1 = 15 hours and C = €65, 20 hours per month are available for other work. Their value is €1,300 per month or €15,600 per year before the service fee. Salaries may stay unchanged: the benefit is then the additional work teams can undertake.
Now add F = €1,400 per month and I = €600. The annual difference is 15,600 − 16,800 − 600 = −€1,800. Break-even is about 22.31 hours per month, exceeding the 20 hours freed. On these assumptions, time value alone does not cover the service. Replace all example amounts with your costs and actual quote.
Verify benefits during the engagement
Compare assessment and review-preparation time, reconstructed case files, actions without owners and delays, using comparable scopes. For relevant NIS2, CRA or DORA work, identify the tasks and evidence actually prepared. Lower alert counts should also explain grouping or coverage changes.
CyberLifeCycle defines with you the monitoring, assessment, prioritisation and reporting to handle from your inventories or SBOMs. The quote sets out scope, responsibilities and tracking metrics. The service page’s estimator helps explore assumptions before that conversation. Keep risk analysis separate: a CVSS base score measures severity, not financial loss, as FIRST explains.
Sources: FIRST: CVSS v4.0 user guide, base-score limitations for risk
Sources consulted
- Dependency-Track v4.14: portfolio tracking capabilitiesAccessed on 30 October 2026.
- FIRST: CVSS v4.0 user guide, base-score limitations for riskAccessed on 30 October 2026.