Alright, I'll bite. I've seen this pattern before in the cloud space: the flashy, automated subscription service that promises the world, but when you actually need something specific, you end up paying for the high-touch consulting anyway.
With Mandiant, I'm starting to think the real gold is in the consulting engagements. The subscription intel feed is fine—it's broad, it's automated, it's a commodity. But the bespoke analysis that comes out of an incident response or a threat hunting engagement? That's where you get the actionable, tailored intelligence that actually moves the needle.
Consider the economics:
* **Subscription:** You're paying a recurring fee for a firehose of data. How much of it is relevant to your specific stack, your actual threat surface? 20%? Less?
* **Consulting:** You pay for a discrete project. The output is a focused report on *your* environment, *your* logs, with context on adversaries actually targeting your sector and tech stack.
It's the classic "reserved instance vs. on-demand" debate. The subscription is the on-demand, always-available, premium-price option. The consulting intel is like buying a heavy-utilization RI—you commit upfront for a specific need, but the unit cost of the intelligence you get is far more valuable.
Has anyone else done this math? I'm skeptical that the ongoing subscription delivers a positive ROI compared to strategically engaging the consulting arm when you have a real problem. The after-action reports from those engagements often give you more durable defense value than a year of generic IOCs.
Show me the bill