How do I get detailed cost forecasting before signing a 3-year deal?

Been there with them last quarter. That "ballpark" quote came in 40% under our first true-up. The big hit was data ingestion - they measure per gigabyte on a rolling 30-day average, not peak bursts. Our dev spikes pushed us into the next tier for the whole month. For 5000 assets, you have to model average daily log volume, not just endpoints.

We got them to cap the annual adjustment at 3% but it took a ton of pushing. Cloud Audit was quoted as a flat 15% uplift on the core sub for us, but Remediation was a separate per-endpoint add-on. They bundle it if you push back.

I'd ask for their data ingestion metering report from a similar customer. Ours showed we'd have been over 70% of the days in the first year.

Data ingestion is the killer. We had the same issue with bursty dev workloads. Our quote was based on "average" usage, but the contract tied billing to the 95th percentile over the month. That meant a few big spikes set the rate for everything.

We ended up getting a fixed-price contract for the first year, but only after providing our own log volume data from a pilot. The annual adjustment after that was capped at the lesser of 5% or CPI. Even then, the true-up for year two was steep because of added cloud instances.

For your 5000 assets, can you run a limited pilot first? That's the only way we got real numbers for Cloud Audit. It wasn't a simple percentage for us, more like a scaled tier based on cloud accounts.

The delta between the initial quote and the first true-up was a gut punch for us, too. Our "ballpark" was off by about 35%, almost entirely due to that 95th percentile data ingestion model they slipped in.

For Cloud Audit, we saw it priced as a flat 20% uplift, but only on the first 1000 endpoints. After that, it dropped to a lower tier. Remediation was its own line item and they would not bundle it, no matter how hard we pushed. The lesson? Get their tier definitions in writing before you even start modeling.

A fixed-price contract for year one is the only way to avoid a surprise. After that, cap the annual adjustment to a hard percentage, not CPI. Ours was "capped" at 5% or CPI, and guess which was higher last year?

The 95th percentile model is the real trap. It sounds fair until you realize a single dev's debugging session on day 30 can re-price your entire month. Getting tier definitions in writing is good, but you have to get the *metering methodology* in the contract appendix.

> cap the annual adjustment to a hard percentage, not CPI

Exactly. A "lesser of" clause always works in their favor when inflation is high. Negotiate for a hard cap, period. Even 5% compound over three years adds up.

Forget the percentages on Cloud Audit, they're meaningless. The real cost is in the cloud account mapping. If your 5000 assets are spread over multiple cloud tenants, each one becomes a separate line item. That's where the quote blew up for us.

You won't get a fixed price without a pilot, and they'll make you pay for it. The "free" PoC won't include the data ingestion metering. Run your own for a month, capture the 95th percentile from your own logs, and bring that data to the table.

Our first true-up was 50% over the "ballpark." The adjustment cap was the lesser of 5% or CPI. Guess which one they applied in year two? Negotiate a hard percentage, never a "lesser of" clause.

This is super helpful, thanks everyone. That 95th percentile trap for data ingestion is terrifying. I'm learning Docker logging right now and our devs can generate massive JSON blasts. So it's not just endpoint count, it's *log behavior* that drives cost?

Can someone explain the "tier definitions" I need to ask for? Like, are the price breaks based on 500-endpoint blocks, or 1000? Trying to figure out how to build the model.

Also, would it be dumb to ask for a clause that excludes weekends or non-peak hours from the ingestion calculation? Probably a non-starter, but thought I'd ask.

Oh wow, this is really helpful to see. I'm looking at a similar deal size and I'm terrified of the same blind spots.

The data ingestion part is my biggest fear now. I thought it was just endpoint count too. Did anyone actually get them to agree to a fixed price for the *entire* 3-year term, not just year one? Or is that impossible?

I'm also trying to build a model from scratch. Is the cloud account mapping a separate cost from Cloud Audit? I'm getting so confused on what's an add-on versus part of the core sub. 😅

I'm stuck on the same confusion with add-ons. From what I've gathered here, cloud account mapping seems to be a separate variable that can inflate the Cloud Audit cost, not part of the core subscription. But I don't know if it's a separate line item or just a multiplier.

On the fixed price for three years, I'm really curious about that too. Getting it for just year one seems hard enough. Has anyone actually gotten them to lock in the rate for the full term, or does the "annual adjustment" always leave a door open?

Yes, cloud account mapping is a separate line item multiplier, not a flat add-on. In our last renewal, Cloud Audit's base cost was tiered per endpoint, but then multiplied by a factor based on number of cloud accounts. A single-account environment had a factor of 1.0, but each additional account added a 0.2 multiplier to the total Cloud Audit cost. This is the detail they often omit from initial slides.

Regarding a fixed price for three years, I've never seen it. The "annual adjustment" clause is non-negotiable in their standard agreement. The best we achieved was locking the year-one price via a fixed-price pilot, then capping the year-two and three adjustments at a hard 3%. The "lesser of 5% or CPI" is a trap you must remove; inflation will always be higher when it matters to them. Get the multiplier table for cloud accounts in writing before you model anything.

That 15% flat uplift for Cloud Audit is a classic misdirection. It's only flat until they apply the cloud account multiplier. A single tenant? Sure, 15%. Got multiple accounts? That's a separate multiplier they usually don't show until the contract draft.

The "similar customer" report is a good ask. I'd also demand the raw metering logic from their own PoC environment. The rolling average they quote vs. the 95th percentile they bill is where the gap comes from. Getting the 3% hard cap is solid, but check if it applies to the multiplied cost or just the base.

I built that exact model for a 6500-endpoint deployment last year. The "ballpark" they gave me was 40% lower than the final contract because it excluded the cloud account multiplier on Cloud Audit and assumed a flat, not 95th percentile, data ingestion model.

For your specific questions: Cloud Audit was not a fixed percentage. It was a per-endpoint cost, then multiplied by 1.0 + (0.15 * number of distinct cloud accounts). For five accounts, that's a 1.75 multiplier on the Cloud Audit line, not a 15% uplift. Remediation was a separate per-endpoint line item, priced at about 60% of the core endpoint cost.

You will not get a fixed-price contract for three years. Their standard is an annual adjustment. You must strike the "lesser of 5% or CPI" clause and replace it with a hard cap. I got 3%. The delta on our first true-up was 28%, which was entirely the 95th percentile billing on a month where a misconfigured dev stack dumped logs for 48 hours straight. Your bursty workloads will absolutely trigger overages.

Bring your own log volume data from a pilot, demand the exact metering formula in the contract appendix, and never accept a quote without the cloud account multiplier explicitly stated.

That initial "ballpark per endpoint" is so far from the real cost it's almost funny. The add-ons are where the real budgeting happens.

For Cloud Audit, our rep initially called it a 15% uplift. It wasn't. It was a per-endpoint cost multiplied by our number of cloud accounts, which was a huge jump. It's not a fixed percentage at all.

I'm trying to model the same thing. Did you have any luck getting a sample breakdown before the official quote? I'm worried asking will just get me more vague slides.

The delta you asked about? Our first true-up was 48% over the initial quote. Not 5%.

Cloud Audit isn't a fixed percentage. It's a base per-endpoint cost multiplied by your number of cloud accounts. Five accounts isn't a 15% uplift. It's a 1.75 multiplier on that entire line item. Remediation is a separate per-endpoint cost, roughly half the core license.

You won't get a fixed price for three years. The annual adjustment clause is standard. Strike the "lesser of" language and demand a hard cap. Anything else is a blank check. Your bursty logging will hit the 95th percentile metering hard.

> But I don't know if it's a separate line item or just a multiplier.

It's both. The base cost for Cloud Audit is a separate line item per endpoint. Then they multiply *that entire line* by a factor based on your number of cloud accounts. That's the trap. It's not an uplift on the total quote, it's a multiplier on an already significant line item.

A fixed price for three years isn't happening. The annual adjustment is the deal. Focus on killing the "lesser of" clause and capping the multiplier, not the base. They'll move on the cap before they'll drop the adjustment.