Our security team is pushing hard for a ThreatConnect PO, and procurement has come back with a tough but fair question: "What's the real annual cost of ownership *after* the initial license fee?" They want to budget for upkeep, not just the sticker price.
I'm helping to build the business case, and I know from our marketing automation platforms that the SaaS subscription is often just the entry ticket. I'm particularly curious about the ongoing resource investment.
Based on your experience, what are the tangible, recurring costs we should factor in? I'm thinking along these lines:
* **Essential Staffing:** How many FTE hours per week are needed for routine maintenance, playbook updates, and indicator management? Is a dedicated analyst realistic, or is it more of a shared duty?
* **Integration & Data Pipelines:** Costs for ongoing maintenance of feeds (like TI feeds, SIEM, EDR). Are there often consulting fees for custom integration work post-implementation?
* **Training & Certification:** Is annual re-training or new analyst onboarding a significant line item? Do you find value in the paid training vs. building your own internal program?
* **Infrastructure & Overhead:** If on-prem or private cloud, what are the typical annual costs for hosting, scaling, and security compliance? Any surprises with data storage growth?
We're trying to avoid the classic trap of a tool that becomes a cost center because we underfunded its operation. Any insight into what proportion of Year 1 costs tend to repeat annually would be incredibly helpful.
Procurement's asking the only smart question in the room. With CRMs, the license is just your entry fee to a world of hidden costs.
For staffing, a dedicated analyst is a fantasy. It'll be a shared duty that somehow consumes 20 hours a week of your team's time just for basic upkeep and indicator management. Playbook updates? That's a part-time job masquerading as a "weekly task."
Integration maintenance is a consulting fee bonanza. Every TI feed or SIEM connection that hiccups means another call to a partner, and those hours stack up fast by the end of the year.
Paid training is usually a racket. Building your own program saves cash but costs you in elbow grease and ramping up new hires. The real annual cost is the morale hit from maintaining another clunky platform.
CRM is a necessary evil