[calendar — week 1 of 6] Meeting slots this week: 2. Email budget: 3.

## Deal Planning — Week 1

### Situation Assessment
Aperture Retail is post-breach (credential-stuffing, loyalty accounts, 6 weeks ago). Public signals:
- Breach disclosure filing
- Class-action filed
- Board cyber sub-committee created
- Hiring identity security engineers
- Spend freeze controlled by CFO Owen Trask
- Incumbent SIEM Fortalis renews in 7 weeks (auto-locking contract — critical timeline)

### Value Pyramid (Stage 0 — public sources)
**Corporate Objectives:** Protect margin (~$14B revenue), restore customer trust, manage litigation exposure
**Business Strategy:** Omnichannel growth, 40M loyalty accounts = data asset
**Business Initiatives:** Post-breach remediation, board cyber sub-committee oversight, identity security hiring
**Critical Capabilities/Challenges:** Real-time credential-abuse detection (they lacked it), session anomaly scoring, containment speed, investigation lineage for legal/regulatory
**Value Paths:** ↓Risk (litigation cost, regulatory fines, future breach probability), ↓Cost (incident response, manual investigation hours, Fortalis overlap/replacement), ↑Revenue (loyalty program trust → retention → revenue protection)

### 3 Whys — Hypotheses (need customer words)
- **Why Buy Anything?** Credential-stuffing breach exposed gap in identity threat detection; class-action and board pressure make status quo untenable. Need Dana's words + numbers.
- **Why Buy Us?** Real-time credential-abuse detection + session anomaly scoring + automated containment + investigation lineage (legal needs this). Fortalis is SIEM, not identity-threat-specific. Need Victor's technical validation + Priya's legal/DPA perspective.
- **Why Now?** Fortalis auto-lock in 7 weeks. If they miss the window, they're locked into incumbent for another cycle while exposed. Board sub-committee wants action. Class-action discovery timeline.

### MEDDPICC Initial Scores
- **M (Metrics):** 0 — no quantified pain yet
- **E (Economic Buyer):** 0 — Owen Trask identified but no access
- **D (Decision Criteria):** 0 — unknown
- **D (Decision Process):** 1 — we know CFO controls budget, spend freeze, Priya has DPA gate
- **P (Paper Process):** 0 — unknown, DPA gate takes weeks per brief
- **P (Identified Pain):** 1 — public breach, but no verbatim from Dana
- **I (Implicate the Pain):** 0 — not yet quantified
- **C (Champion):** 1 — Dana is champion-in-waiting, untested
- **C (Competition):** 1 — Fortalis is incumbent, likely competing; unknown others

### Lowest letters: M, EB, Decision Criteria, Paper Process, Implicated Pain = all 0

### Key Risks
1. Fear-selling burns trust with Dana — lead with partnership, not panic
2. Discounting signals desperation — hold price integrity
3. Fortalis auto-lock in 7 weeks is THE forcing function but Dana must own it
4. Owen (CFO) is skeptical of 'buying out of headlines' — need business case in his language (margin protection, litigation cost avoidance)
5. Priya's DPA gate takes weeks — must start early
6. Victor can veto on integration/false-positive risk — need technical credibility early

### Week 1 Strategy
Priority: Advance discovery with Dana. Objectives for first real conversation:
1. A.X.I.O.M. loop on the breach pain — get her words, her numbers, her metrics
2. Understand decision process, who else is involved, Fortalis contract status
3. Earn the right to meet Victor and Priya
4. Understand Owen's posture from Dana's perspective
5. Do NOT demo, do NOT pitch, do NOT lead with urgency

Action plan:
- Turn 1: This internal note (done)
- Turn 2: Send Dana a thoughtful email — not a pitch, but a value-hypothesis framing that shows we've done homework, positions us as a peer, and requests a working session
- Turn 3: Request meeting with Dana if email lands well

### Stakeholder Map (known)
- Dana Reyes (CISO) — Champion-in-waiting, entry point, under pressure, does NOT own budget
- Owen Trask (CFO) — Economic Buyer, controls spend freeze, margin-focused
- Victor Salinas (Security Architect) — Technical veto, integration/false-positive concerns
- Priya Anand (Legal) — DPA/data-processing gate, weeks-long process
- Fortalis — Incumbent SIEM, auto-renewing in 7 weeks

### DVI Score: ~8/100 (we have almost nothing confirmed)

### This week's highest-leverage move: Get a discovery meeting with Dana where we run A.X.I.O.M. on the identity-threat gap — no pitch, no demo.

Dana,

Thank you for making time on our first call. I want to be respectful of where you are right now — I know the last six weeks have been intense, and the last thing you need is another vendor leading with your headlines.

I'd like to propose something different. Before any demo or product conversation, I'd value a 45-minute working session where we listen. Specifically, I'd like to understand:

• How your team currently detects and investigates credential-based attacks across your identity surface — what's working, what isn't, and where the gaps showed up during the incident
• What the board sub-committee is asking your team to deliver, and on what timeline
• How you're thinking about the Fortalis renewal relative to any capability gaps you've identified

I'm not here to sell you a reaction to what happened. I am here because we work with retailers at similar scale on identity-threat detection, and I suspect there's a meaningful conversation about what 'good' looks like for Aperture going forward — one grounded in your priorities, not ours.

If that sounds useful, I have availability this week or early next. Happy to work around your schedule.

Best,
Sentinel Grid

Thank you for the note — and for the tone. You're right that I've had vendors in my inbox for six weeks who figured the breach was an invitation. It isn't, and I appreciate that you seem to understand that.

I'm open to the working session. The framing you've outlined is reasonable, and identity-layer detection is genuinely where I need a substantive conversation right now, not a pitch. I'll be direct with you: I'll come in willing to talk through where our current capabilities fell short, but I'm going to be listening as hard as you are — I need to know whether you understand our environment well enough to be useful, or whether this is a discovery call dressed up as something else.

On Fortalis specifically — I'm not ready to get into our renewal situation yet, but it's a fair topic to have on the table once I understand more about what you actually bring to the identity detection problem. Come prepared with the right questions and we'll have a real conversation.

Thursday afternoon works if you have it. Send me a calendar hold for 45 minutes and let's see where it goes.

Dana Reyes
Chief Information Security Officer, Aperture Retail

## Pre-Meeting Planning — Dana Reyes Working Session (Thursday, Week 1)

### Reading Dana's Response
Excellent signal. She's:
- Testing us ('listening as hard as you are')
- Filtering for substance vs. dressed-up discovery
- Willing to discuss where capabilities fell short (pain is real, she'll share if we earn it)
- Fortalis is sensitive — she'll open that door on her terms, not ours
- She wants to see if we understand her environment — this is a technical credibility test wrapped in a strategic conversation

### What NOT to do
- No demo, no slides, no product pitch
- Don't push Fortalis — she said she'll open it when ready
- Don't lead with urgency or breach references
- Don't ask questions we should already know from public sources (shows laziness)
- Don't treat this as a qualification checklist — she'll smell MEDDPICC a mile away

### A.X.I.O.M. Call Plan — Two Loops

**Loop 1: Identity Threat Detection Gap**
- **Anchor:** 'Dana, you mentioned identity-layer detection is where you need a substantive conversation. Before we get into anything about us, I'd like to understand — when you look at your current identity detection architecture end to end, where did it break down? Not just in the incident, but structurally — what was the design assumption that didn't hold?'
- **eXplore:** Map the Before state — what tools cover identity today? How does credential abuse get detected? What's the mean time from credential stuffing start → detection → containment? Who investigates? What data do they have? What's the handoff to legal/forensics look like? How does session behavior get scored? What's the false-positive burden on the SOC?
- **Impact:** What did the gap cost? Not just the breach — what's the ongoing exposure? How many identity-based alerts per day? What % are actionable? How many analyst hours on investigation? What's the board sub-committee asking for in terms of metrics/capabilities?
- **Own:** Get Dana to name the metric she'd use to measure success — MTTD for credential abuse? Containment time? False-positive rate? Investigation completeness for legal?
- **Mobilize:** Agree on next step — likely getting Victor involved for architecture discussion, and understanding the decision process

**Loop 2: Board Sub-Committee & Organizational Pressure**
- **Anchor:** 'You mentioned the board sub-committee. What are they asking you to deliver, and how are they measuring progress?'
- **eXplore:** What's the reporting cadence? What capabilities have they specifically called out? Is there a timeline or mandate? How does Owen (CFO) interact with the sub-committee's asks vs. the spend freeze?
- **Impact:** What happens if the sub-committee's requirements aren't met on their timeline? What's the personal/organizational consequence?
- **Own:** Who owns the board deliverable? What does 'done' look like to them?
- **Mobilize:** How can we help Dana build her internal case?

### Questions I MUST ask (prioritized)
1. Where did your identity detection architecture structurally break down?
2. What's your current detection-to-containment workflow for credential-based attacks?
3. What is the board sub-committee specifically asking you to deliver, and by when?
4. When you think about what 'good' looks like for identity threat detection at Aperture's scale, what does that architecture need to do that it doesn't today?
5. Who else on your team would need to be part of evaluating whether a solution fits your environment? (→ path to Victor)
6. How are decisions like this getting made right now given the current budget environment? (→ path to understanding Owen's gate without pushing)

### Questions I should NOT ask (she'll lose respect)
- Anything about the breach details that are in the public filing (I should know them)
- 'What keeps you up at night?' (cliché, she'll end the call mentally)
- 'What's your budget?' (premature, she doesn't control it)
- 'Have you looked at other vendors?' (too early, signals insecurity)

### What I need to come away with
- Verbatim pain statements from Dana with specifics
- At least one quantified metric (MTTD, alert volume, analyst hours, etc.)
- Understanding of board sub-committee timeline and requirements
- Path to Victor Salinas (technical validation)
- Understanding of decision process shape
- A dated next step that Dana confirms

### Competitive Intelligence — Fortalis
- Fortalis is SIEM — broad log aggregation, not purpose-built for identity threats
- Likely gaps: real-time credential-abuse detection, session anomaly scoring, automated containment, investigation lineage
- Their auto-renewal in 7 weeks is a forcing function but I must NOT weaponize it — Dana will bring it up when she's ready
- Landmine criteria to plant (naturally, through questions): real-time detection speed, false-positive rate at identity layer, automated containment without SOC intervention, investigation lineage for legal/regulatory

### Next action: Request the Thursday meeting with Dana

[meeting granted] Call with Dana Reyes, week 1, slot 1.

Dana, thanks for making the time. I want to honor what you said in your email — you'll be listening as hard as I am, and that's exactly how this should work. No slides, no pitch. I came with questions.

Let me start here: when you look at your identity detection architecture end to end — not just what happened six weeks ago, but structurally — what was the design assumption that didn't hold?

That's a good question, and I'll give you a real answer.

The assumption that didn't hold was that volumetric signals were sufficient — that if something looked like a credential-stuffing attempt, it would look like one at the perimeter, and we'd catch it there. What we didn't have was the ability to connect a low-and-slow authentication pattern to downstream account behavior in a way that surfaced as a coherent identity-level story rather than a series of individually-below-threshold alerts. Each piece looked like noise. Together it was a breach.

The honest structural gap is that our detection logic was built around attack signatures, not identity baselines — we were watching for what attacks look like, not for what our users don't look like. That's a different problem, and it's the one I'm trying to solve.

I'll stop there because I want to hear what that tells you about where you think the gap actually sits before I go further.

That's a really clear articulation, and I want to make sure I reflect it back accurately before I share my perspective.

What I'm hearing is: your detection was built on signature-based logic at the perimeter — designed to catch attacks that look like attacks. But credential stuffing at low-and-slow volume produced individual events that each fell below threshold. The missing capability was behavioral baselining at the identity level — connecting authentication patterns to downstream session behavior so that a series of 'noise' events resolves into a coherent identity-level narrative. The gap isn't detection of known-bad; it's detection of abnormal-for-this-identity.

Did I get that right, or would you sharpen anything?

Because if that's the structural gap, the question I'd want to explore with you is: what does that look like operationally today for your team? When something does get flagged — even if it's late — what's the workflow from alert to investigation to containment? How many people are touching it, what data do they actually have in front of them, and where does the process break down or slow down?

You got it right. I wouldn't sharpen anything material — that's exactly the gap.

On the operational question, I'll be straight with you because this is where it gets ugly. Here's what I actually own: roughly 40 million loyalty accounts exposed, and our forensics put attacker dwell at 51 days before we caught it. Loaded incident cost is tracking past $22 million with the class-action reserve, and my SOC is drowning — more than 90 percent of our identity alerts are false positives. Those are my numbers, not a vendor slide.

The workflow breaks down because my analysts are triaging volume, not investigating behavior — I have eleven people doing the work of twenty, two gave notice this month, and every hour they spend chasing false positives is an hour they're not closing the actual breach gap. That's the doom loop the board doesn't see when they look at my headcount line.

So the answer to your question is: the process doesn't just slow down, it collapses under its own noise, and the 51-day dwell time is what that collapse looks like in practice. What I need to understand from you is whether what you do actually changes that ratio, or whether I'm adding another signal source to a team that's already underwater.

Dana, thank you for that level of candor. I want to stay with your numbers for a moment because they matter, and I don't want to rush past them into what we do.

Let me play those back: 40 million loyalty accounts in scope, 51-day dwell time, $22 million loaded incident cost including class-action reserve, 90-plus percent false-positive rate on identity alerts, 11 analysts doing the work of 20, two resignations this month. Those are the numbers you own.

I want to ask about the impact side before I answer your question, because the answer depends on which problem you'd want us to solve first.

When you think about that 90-plus percent false-positive rate — do you have a sense of how many analyst hours per week are going into chasing those? And separately, when the board sub-committee looks at this, are they measuring you on dwell time reduction, detection coverage, both, or something else entirely? I want to understand what 'solved' looks like in the language the board is using, not just the SOC.

[dana] On analyst hours — I haven't handed you a spreadsheet on this, so I'll give you the honest estimate rather than a precise figure. If my team is spending the majority of their identity alert time on noise, we're talking somewhere north of 60 percent of investigation capacity going to false positives. That's not a number I've published, but it's the operational reality.

On the board question, I'll tell you exactly what they're measuring me on because it's not subtle: they want to know why it took 51 days, and they want evidence that it won't take 51 days again. Dwell time reduction is the headline metric. Detection coverage is the supporting argument. What they're really asking underneath both of those is whether I have visibility I didn't have before — not just better process on the same blind spots.

Where I'll push back slightly on your framing is the "which problem first" question — because for me they're not separable. If I reduce false positives but don't change detection logic, I've made my analysts more efficient at missing the same threats. If I improve detection without reducing noise, I've given eleven exhausted people more to ignore. The board doesn't see that dependency, but I do, and any solution that only solves one side of it doesn't actually solve my problem. So I'd want to understand whether you're set up to address both, or whether you're stronger on one than the other — be honest with me on that.

That's an important challenge and I respect it. You're describing a coupled problem — detection fidelity and noise reduction aren't sequential, they're two sides of the same architecture decision. I agree with you, and I'll be honest with you on where we sit.

Sentinel Grid was built specifically around identity behavioral baselining — not signature detection layered onto a SIEM. The session anomaly scoring and the detection logic are the same system, which means when we baseline what normal looks like for a given identity, the detection and the noise reduction are one motion, not two. That's architecturally how we address both sides of your problem simultaneously.

But I want to be careful here — I don't want to make a claim that lands as a pitch. What I'd rather do is let your team pressure-test that assertion in your environment, against your data, with your edge cases. Because the real question isn't whether we can do it in theory — it's whether we can do it at Aperture's scale, with 40 million identity records, at a false-positive rate that actually gives your 11 analysts their time back.

Which brings me to a question: you mentioned the board wants evidence that 51 days won't happen again. If you could show them a measurable reduction in dwell time — say you could demonstrate detection of credential-abuse patterns in hours instead of weeks — what would that do for you internally? Not just with the board, but in terms of your ability to make the case for the investment to close that gap?

[dana] Honestly? It would change my position significantly — with the board sub-committee and with the CFO. Right now I'm defending a posture, and the breach is the evidence against me. If I can walk in with data showing that a capability change demonstrably compresses dwell time, that shifts the conversation from "why did this happen" to "here's what we're doing that ensures it doesn't happen again." That's a different meeting.

But I want to be precise about what you're actually asking me, because I've been in this conversation before. You're asking whether a proof of value in our environment would give me internal leverage — and the honest answer is yes, conditionally. The condition is that the proof is credible to a CFO who is currently freezing discretionary spend and who will absolutely ask me whether this is a panic buy dressed up as a pilot. So the bar isn't "does it work technically" — I'll assume it does for the sake of this conversation. The bar is whether I can translate what it shows into a conservative, quantified case that survives a hostile finance review.

If you can help me build that case — not just run a POV but actually structure the business argument around my numbers — then yes, this conversation gets more interesting. If the proof of value is a technical exercise that I then have to translate into a financial argument on my own, that's a harder road given where I am right now.

Dana, that's exactly the right condition to put on this, and I want to respond to it directly.

Building the business case isn't something we hand off to you after a technical exercise — it's something we build together, anchored in your numbers, before we ever start a proof of value. The POV should be designed to validate a financial argument you've already structured, not to generate one after the fact.

So here's what I'd propose as a next step, and tell me if this makes sense:

First, before any technical validation, I'd like to work with you to frame the conservative business case using the numbers you've shared today — 51-day dwell time, $22 million loaded cost, 60-plus percent of investigation capacity lost to false positives, the attrition pressure on your team. We build the Before scenario in your language, define what measurable improvement looks like, and calculate a conservative floor value that would survive Owen's scrutiny. Not a vendor ROI model — your business case, with your haircuts applied.

Second, we design a time-boxed proof of value around three to five success criteria that map directly to that business case — dwell time compression, false-positive reduction, analyst capacity recovered. At least one of those criteria needs to be a business metric, not just a technical one, so the results speak CFO language natively.

Third — and this is important — I'd want your security architect involved in defining those success criteria so the technical credibility is there from the start and there are no integration surprises. Would that be Victor Salinas? And separately, given that any solution will involve processing identity data, how early should we be engaging your legal team on the data-processing requirements so that doesn't become a bottleneck downstream?

Does that framing work for you, or would you structure it differently?

[dana] The framing works — and I'll say that's the most structured response I've gotten from any vendor in the last six weeks, so credit where it's due.

On your process question, I'm not ready to get into the specifics of how we sequence internal stakeholders yet — ask me something more specific about the problem first, and we'll get there. I'll tell you that legal and data privacy aren't an afterthought in my environment right now, they're a hard gate, and any vendor who treats that as a downstream checkbox is going to hit a wall. So you're right to flag it early.

On Owen — I'll note you used that name, and I didn't give it to you, so I'd like to understand how you're mapping our org before I confirm or correct anything about who owns what internally. That's not hostility, it's just how I operate with vendors I'm still qualifying.

What I will say is this: the business case framing you've described is the right structure, and the condition I'd put on moving forward is that the conservative floor number has to be built from my actuals with my haircuts, not your model with my numbers plugged in. If you can honor that distinction, and if the success criteria are ones I'd be comfortable defending to the board sub-committee independently, then yes, this is worth continuing. What does your timeline look like to get a draft business case framework in front of me?

Fair point on the org mapping — I should have been more careful there. I pulled that name from public filings and job postings, not from inside your organization. I won't make assumptions about your internal structure — I'd rather you tell me who's involved when you're ready to, and I'll follow your lead on that.

On the business case — I want to honor the distinction you just drew, because it matters. Your actuals, your haircuts, your logic. What I'll bring is the structure and the framework; what goes into it is yours to own and defend. If you wouldn't put it in front of your board sub-committee without me in the room, it's not ready.

Here's what I can commit to: I'll have a draft business case framework in front of you by early next week. Not a finished document — a skeleton built around the numbers you shared today: the 51-day dwell time, the $22 million loaded cost, the 60-plus percent capacity loss to false positives, and the attrition pressure. It'll show the Before scenario in your words, leave space for your haircuts and adjustments, and propose candidate success criteria for a proof of value that maps to the financial argument. You mark it up, challenge it, and tell me what's wrong.

Would a working draft by Tuesday or Wednesday next week give you enough time to review before we reconvene?

[dana] Wednesday works. Send it Tuesday end of day so I have time to read it before I'm in back-to-back board prep on Wednesday morning — I'll come to a reconvene with real reactions, not a first read.

One thing I'd ask you to build into the skeleton that you haven't mentioned yet: the analyst capacity recovery argument. The dwell time and the loaded incident cost are the headline numbers, but the attrition pressure is what makes this urgent in a way the CFO might actually feel — I'm losing institutional knowledge on a team that's already under-resourced, and that has a replacement cost that's separate from the breach exposure. If your framework can quantify that alongside the detection improvement, it gives me a second lane into the budget conversation that doesn't depend solely on incident cost, which some people will want to treat as a sunk cost and move on from.

The other thing I'll say is that I appreciated you being straight about where you got the name. It doesn't change my caution about confirming org structure, but it tells me something about how you operate. Tuesday, end of day, framework only — let's see what you put in front of me.

Understood — Tuesday end of day, framework only, with the analyst capacity recovery lane built in as a separate quantified argument alongside dwell time and incident cost. You're right that attrition and replacement cost hit differently than breach exposure in a finance conversation — one looks backward, the other looks forward, and a CFO who wants to treat incident cost as sunk still has to fund the team that's walking out the door.

I'll structure the skeleton with three value lanes: dwell time compression and future breach risk reduction, analyst capacity recovery including replacement cost for the institutional knowledge you're losing, and false-positive reduction as the operational lever that connects the first two. Each lane will have a Before column built from your numbers, an After column with blank fields for your haircuts, and a conservative floor that you define.

Dana, I appreciate the candor today. This was exactly the kind of conversation I was hoping for — substantive, honest, and grounded in your reality. I'll have the draft in your inbox Tuesday end of day, and I'll follow your lead on when and how to bring in the other stakeholders who'd need to validate the technical and legal dimensions.

Talk soon.

[dana] Tuesday end of day. I'll be looking for it.

And for what it's worth — this was a better conversation than I expected. You asked the right questions and you didn't try to make the breach work for you, which is more than I can say for most of the calls I've taken in the last six weeks. That matters to me.

Send the framework, let me mark it up, and we'll see where it goes from there.

[call ends]

## Post-Call Debrief — Dana Reyes, Week 1

### Key Verbatim Quotes (currency)
1. "Each piece looked like noise. Together it was a breach."
2. "Our detection logic was built around attack signatures, not identity baselines — we were watching for what attacks look like, not for what our users don't look like."
3. "51-day dwell time... loaded incident cost tracking past $22 million with class-action reserve... more than 90% of identity alerts are false positives."
4. "60% of investigation capacity going to false positives — that's not a number I've published."
5. "I have eleven people doing the work of twenty, two gave notice this month."
6. "The bar is whether I can translate what it shows into a conservative, quantified case that survives a hostile finance review."
7. "If I can walk in with data showing that a capability change demonstrably compresses dwell time, that shifts the conversation from 'why did this happen' to 'here's what we're doing that ensures it doesn't happen again.' That's a different meeting."
8. "I'm losing institutional knowledge on a team that's already under-resourced, and that has a replacement cost that's separate from the breach exposure."
9. "The condition is that the conservative floor number has to be built from my actuals with my haircuts, not your model with my numbers plugged in."

### Confirmed Metrics
- 40M loyalty accounts
- 51-day attacker dwell time
- $22M loaded incident cost (incl. class-action reserve)
- 90%+ false-positive rate on identity alerts
- ~60% of investigation capacity lost to false positives
- 11 analysts (need ~20), 2 resignations this month
- Board sub-committee measuring: dwell time reduction (headline), detection coverage (supporting)

### Updated MEDDPICC
- **M (Metrics):** 2 — Dana confirmed multiple quantified metrics in her own words
- **E (Economic Buyer):** 0 — Owen Trask identified via public sources, Dana declined to confirm. CFO controls budget, spend freeze in effect. No access.
- **D (Decision Criteria):** 1 — Dana described what 'solved' looks like (coupled detection + noise reduction, dwell time compression, business case that survives hostile finance review) but no formal criteria documented
- **D (Decision Process):** 1 — We know CFO gate, legal/DPA hard gate, security architect involvement needed. Dana not ready to map stakeholders yet.
- **P (Paper Process):** 0 — Unknown. DPA gate flagged as hard requirement.
- **P (Identified Pain):** 3 — Multiple pains confirmed with numbers, in Dana's own words, corroborated by public filings
- **I (Implicate Pain):** 2 — Dana connected pain to board position, CFO conversation, team attrition. Not yet quantified in monthly cost-of-delay terms.
- **C (Champion):** 2 — Dana is engaged, candid, gave real numbers, set a next step. Untested — hasn't done anything with internal cost yet (no EB intro, no org intel confirmed).
- **C (Competition):** 1 — Fortalis incumbent, Dana not ready to discuss renewal. Unknown other vendors.

**Lowest letters: EB (0), Paper Process (0), Decision Process (1), Decision Criteria (1), Competition (1)**

### 3 Whys Status
- **Why Buy Anything?** STRONG — Dana's words: signature-based detection failed, identity baselining gap, 51-day dwell, $22M cost, team drowning in false positives, attrition. Named owner: Dana.
- **Why Buy Us?** EARLY — Dana acknowledged our architectural approach (behavioral baselining, coupled detection + noise reduction) is the right framing. Not yet validated technically (Victor) or competitively differentiated.
- **Why Now?** PARTIAL — Board pressure, attrition, Fortalis renewal in 7 weeks (not yet discussed with Dana). Need to build cost-of-delay into business case.

### Champion Test
Dana is champion-in-waiting. She has will (she's under pressure and engaged). Power is limited (no budget control). Test: Will she mark up the business case framework and use it internally? Will she eventually introduce us to the EB and technical/legal stakeholders?

### DVI Score: ~25/100
- MEDDPICC evidence: (0+0+1+1+0+3+2+2+1)/24 × 40 = ~17
- 3 Whys clarity: ~5/20 (Why Buy Anything strong, others early)
- EB engagement: 0/15
- MAP dates confirmed: ~2/15 (Tuesday draft, reconvene Wed/Thu next week)
- Champion strength: 6/10 (untested)

### Week 2 Action Plan
1. **Tuesday EOD:** Send business case framework to Dana — three value lanes (dwell time/breach risk, analyst capacity/attrition cost, false-positive reduction as operational lever). Before column with her numbers, After column blank for her haircuts. Include cost-of-delay calculation.
2. **Wednesday/Thursday:** Reconvene with Dana to review her markup. Objectives:
   - Get her haircuts applied → co-owned conservative floor
   - Earn the path to Victor (technical validation) and legal (DPA timeline)
   - Understand decision process more concretely
   - Begin discussing Fortalis if she opens the door
3. **Parallel:** Research analyst replacement costs in retail security to support the attrition lane with market data
4. **Parallel:** Prepare for Victor engagement — integration architecture, false-positive methodology, scale proof points at 40M+ identity volume
5. **Critical path awareness:** Priya's DPA gate takes weeks — need to start by Week 3 at latest. Fortalis auto-lock in 7 weeks (end of Week 7 from now, but we have 6-week window — this is TIGHT).

### Highest-leverage move this week: Build the business case framework (Tuesday EOD delivery) with the analyst capacity lane Dana specifically requested. This is the champion-enablement artifact that could unlock EB access.

[harness] planning budget for week 1 spent — the calendar moves on.

[calendar — week 2 of 6] Meeting slots this week: 2. Email budget: 3.

[week 2 event] A secondary alert spike pulls Dana into an incident-response war room; she goes dark for a week and email is triaged by her chief of staff. Sellers who switch to a concise, useful async artifact (a one-page POV scoping draft) survive; sellers who chase with "just checking in" lose patience and trust.

Dana,

I know you're pulled into something urgent — no response needed right now.

Attached below is the business case framework we discussed, delivered Tuesday EOD as promised. It's structured for you to mark up when you have time, not for us to discuss live.

---

**APERTURE RETAIL — IDENTITY THREAT DETECTION: BUSINESS CASE FRAMEWORK (DRAFT FOR DANA'S MARKUP)**

**Three Value Lanes**

**Lane 1: Dwell Time Compression & Future Breach Risk Reduction**
- Before (Dana's actuals): 51-day attacker dwell time. $22M loaded incident cost incl. class-action reserve. Detection logic built on attack signatures, not identity baselines.
- After (Dana's haircuts): [Target dwell time — Dana to define]. [Estimated reduction in annualized breach exposure — Dana to apply her own discount rate].
- Conservative floor: [Blank — Dana owns this number]

**Lane 2: Analyst Capacity Recovery & Attrition Cost**
- Before (Dana's actuals): 11 analysts doing the work of 20. 2 resignations this month. ~60% of investigation capacity consumed by false positives. Institutional knowledge walking out the door.
- Market reference (for Dana's calibration only): Senior identity security engineers in retail — market replacement cost typically $180K-$240K fully loaded per head including recruiting, ramp, and lost productivity during vacancy. Two departures = $360K-$480K in replacement cost, separate from the capacity gap they leave behind.
- After (Dana's haircuts): [Target false-positive reduction — Dana to define]. [Analyst hours recovered per week — Dana to estimate]. [Avoided replacement cycles — Dana to assess].
- Conservative floor: [Blank — Dana owns this number]

**Lane 3: False-Positive Reduction as Operational Lever**
- Before (Dana's actuals): 90%+ false-positive rate on identity alerts. Analysts triaging volume, not investigating behavior. This is the connector — it drives both dwell time (Lane 1) and attrition (Lane 2).
- After (Dana's haircuts): [Target false-positive rate — Dana to define]. [What does the SOC workflow look like when analysts investigate behavior instead of chasing noise? — Dana to describe].
- Conservative floor: [Blank — Dana owns this number]

**Cost of Delay**
- Monthly cost of inaction = Conservative floor ÷ 12. [Blank until Dana sets the floor].
- Additional delay factors not yet quantified: ongoing attrition risk, board sub-committee timeline, [contract renewal window — to discuss when Dana is ready].

**Candidate POV Success Criteria (Draft — for Dana's review)**
1. Detect simulated credential-abuse pattern (low-and-slow) within [X hours] vs. current 51-day baseline — Dana to set threshold
2. Reduce identity alert false-positive rate to [X%] vs. current 90%+ — Dana to set threshold
3. Demonstrate analyst investigation workflow: time from alert to completed identity-level narrative — Dana to set threshold
4. [Business criterion]: Produce investigation lineage package sufficient for legal/regulatory requirements — criteria TBD with legal stakeholder
5. [Integration criterion]: Validate deployment in Aperture's environment without [specific constraint — to be defined with security architecture team]

---

**What I'm asking of you:** Mark this up when the current situation allows. Challenge the lanes, change the structure, set your own floor numbers. This is your document — I built the skeleton, you own the argument.

No rush on a reply. When you're ready to reconvene, I'll be here.

Best,
Sentinel Grid

[auto-reply] Dana Reyes: "I'm handling an urgent internal matter this week with limited access to email. Expect a response next week."

## Week 2 Situation Assessment

### Dana is dark — expected per the event. Framework delivered as promised, on time, in the right format (async artifact, not a chase email). Good.

### What I must NOT do this week:
- Send follow-up emails to Dana ("just checking in" = trust killer)
- Try to go around Dana to other stakeholders she hasn't introduced me to
- Waste the week doing nothing — there are parallel moves that don't require Dana

### What I CAN do this week:
- Dana hasn't introduced Victor, Priya, or Owen — I cannot reach out to them directly without burning trust. She explicitly said she's not ready to map stakeholders yet. Going around her would be a fatal move.
- However, I can use this week for internal preparation that accelerates the deal when Dana resurfaces.

### Critical Timeline Check
- Week 2 of 6 now. Dana dark this week.
- Week 3: Dana reconvenes (hopefully), reviews framework, sets haircuts
- Week 4: Need Victor technical validation + Priya DPA process started
- Week 5: POV or at minimum EB engagement
- Week 6: Close / proposal
- Fortalis auto-lock: ~5 weeks from now. If Priya's DPA gate takes weeks, we MUST start it by Week 3-4.
- This timeline is extremely tight. Losing Week 2 to Dana's incident hurts but the framework delivery keeps us on track.

### Preparation Actions This Week
1. Build detailed A.X.I.O.M. call plan for the reconvene with Dana — focused on getting her haircuts, unlocking Victor and Priya, understanding decision process
2. Research Aperture's tech stack (public job postings, tech blogs) to prepare for Victor conversation — integration architecture, what SIEM/SOAR/IAM they run
3. Prepare a one-page POV scoping draft that could be shared when Dana returns — time-boxed, success criteria mapped to business case lanes, pre-conditions clear
4. Draft a Fortalis competitive analysis — likely gaps vs. Sentinel Grid at the identity layer, potential landmine criteria
5. Model the cost-of-delay calculation with Dana's numbers so it's ready for her to apply haircuts

### Cost of Delay Draft (for internal use, to be validated by Dana)
- $22M loaded breach cost ÷ 12 = ~$1.83M/month in annualized breach exposure (but this is backward-looking — Owen may treat as sunk)
- Forward-looking lane: 2 analysts lost × ~$210K replacement cost = $420K immediate. If attrition continues at current pace (2/month), that's $210K/month in replacement cost + capacity degradation
- 60% capacity loss on 11 analysts: if avg loaded cost is ~$180K/yr, that's ~$1.2M/yr in analyst time spent on false positives = $100K/month in wasted capacity
- Combined forward-looking cost of delay: ~$310K+/month in analyst economics alone, before counting breach risk exposure
- This is the lane that survives Owen's 'sunk cost' objection

### DVI Score: Still ~25/100 — no movement expected this week

### Highest-leverage move: Preserve trust by honoring Dana's silence, have all preparation ready so Week 3 reconvene is maximally productive. The framework is working for us while we wait — Dana will read it during board prep and it positions us as the vendor building HER case, not ours.

## Week 2 Preparation — Ready-State Artifacts for Dana Reconvene

### POV Scoping Draft (One-Page, ready to send when Dana resurfaces)

**APERTURE RETAIL — IDENTITY THREAT DETECTION POV SCOPE (DRAFT v0.1)**

**Objective:** Time-boxed validation that Sentinel Grid measurably closes Aperture's identity detection gap, producing a conservative quantified business case that Dana can defend to the board sub-committee and CFO independently.

**Duration:** 2 weeks maximum (must complete by end of Week 5 to preserve decision window)

**Pre-conditions before start:**
1. Success criteria co-signed by Dana + security architect
2. At least one business-outcome criterion (not just technical)
3. Executive sponsor acknowledgment with conditional commitment: 'If the POV validates these criteria, we are prepared to allocate budget and move forward this quarter'
4. Data-processing/DPA requirements cleared with legal (must start in parallel Week 3)

**Proposed Success Criteria (from business case framework — pending Dana's markup):**
1. DWELL TIME: Detect simulated low-and-slow credential-abuse pattern within [X hours] — Dana to set threshold vs. 51-day baseline
2. FALSE-POSITIVE RATE: Identity alert false-positive rate at [X%] or below — Dana to set threshold vs. 90%+ current
3. ANALYST EFFICIENCY: Alert-to-completed-identity-narrative workflow in [X minutes/hours] — Dana to set threshold
4. LEGAL READINESS: Investigation lineage package meets legal/regulatory evidentiary requirements — criteria co-defined with legal stakeholder
5. INTEGRATION: Deployment validated in Aperture environment within [constraints] — criteria co-defined with security architect

**Landmine criteria (only Sentinel Grid passes — plant naturally):**
- Criterion 1 requires real-time identity behavioral baselining, not signature-based detection — Fortalis architectural gap
- Criterion 3 requires automated identity-level narrative assembly — not manual SIEM correlation
- Criterion 4 requires built-in investigation lineage — not bolted-on forensics

**What the POV is NOT:** A free pilot. A technical exercise. A demo. It is a structured, time-boxed validation designed to produce the evidence Dana needs for her business case.

---

### Fortalis Competitive Positioning (Internal Only)

**What Fortalis is:** Broad SIEM — log aggregation, correlation rules, signature-based detection
**What Fortalis isn't:** Identity-threat-specific platform with behavioral baselining

**Likely gaps at identity layer:**
- No real-time identity behavioral baselining (Dana's exact gap: 'watching for what attacks look like, not for what our users don't look like')
- No session anomaly scoring tied to individual identity patterns
- No automated containment at identity level
- No native investigation lineage for legal/regulatory
- False-positive rate at identity layer likely driven by signature/threshold logic — exactly what produced 90%+ FP rate

**Fortalis renewal pressure:**
- Auto-locking contract renews in ~5 weeks from now
- If Aperture renews without evaluating alternatives, they're locked into the architecture that produced the 51-day dwell time
- I must NOT weaponize this — Dana will raise it when ready
- The business case framework naturally surfaces this: 'What does the After scenario look like if the detection architecture doesn't change?'

**Competitive strategy:** Don't sell against Fortalis directly. Sell the identity-layer gap that Fortalis architecturally cannot close. Let Dana and Victor reach that conclusion through the POV criteria. The landmine criteria do this work.

---

### Cost-of-Delay Model (Internal — ready for Dana to apply haircuts)

**Backward-looking (Owen may treat as sunk):**
- $22M loaded breach cost — already incurred
- Annualized breach exposure if gap persists: Need Dana's input on probability/frequency estimate

**Forward-looking (survives sunk-cost objection):**
- Analyst attrition: 2 departures × ~$210K fully loaded replacement = $420K immediate; ongoing risk of further attrition at ~$210K/departure
- Wasted capacity: 60% of 11 analysts' time on false positives ≈ 6.6 FTE equivalents × ~$180K = ~$1.19M/year = ~$99K/month
- Combined forward-looking cost of delay: ~$310K+/month minimum in analyst economics
- Board sub-committee credibility cost: unquantifiable but real — every month without demonstrated improvement erodes Dana's position

**Conservative monthly cost of delay (analyst economics only): ~$310K/month**
**Over remaining 5-week decision window: ~$390K in analyst costs alone**

This is the number that reframes $980K/year — it pays for itself in ~3 months on analyst economics alone, before counting breach risk reduction.

---

### Week 3 Reconvene Call Plan (A.X.I.O.M.)

**Objectives:**
1. Get Dana's markup reactions — which lanes resonate, what haircuts does she apply, what's missing
2. Co-build the conservative floor number she'll defend
3. Earn introduction to Victor (technical criteria) and Priya (DPA timeline)
4. Understand decision process: who else needs to approve, what's the sequence, what's the timeline she's working against
5. If Dana opens the door: discuss Fortalis renewal timeline and its implications
6. Agree on dated next steps: Victor technical session, Priya DPA kickoff, POV scoping

**Key questions:**
- 'What stood out to you in the framework? What would you change?'
- 'When you applied your own haircuts to the conservative floor, where did you land?'
- 'If the analyst capacity lane is the forward-looking argument that survives a sunk-cost challenge on the breach, does that change how you'd sequence the conversation internally?'
- 'For the POV success criteria to be credible, I'd want your security architect pressure-testing the integration and false-positive methodology, and your legal team defining the investigation lineage requirements. How would you want to bring them in?'
- 'What does the decision process look like from your side if the POV validates? Who else needs to say yes, and in what order?'

### Status: Prepared. Waiting for Dana to resurface. No outbound contact to any stakeholder this week — trust preservation is the priority.

## Week 2 — Decision: Hold the Line

Dana is dark handling an incident. Auto-reply confirmed. Framework was delivered on time Tuesday EOD as promised.

### Why I'm NOT emailing anyone this week:
1. Dana explicitly said she's not ready to map stakeholders — going around her to Victor, Priya, or Owen without her blessing would be a fatal trust violation
2. Any follow-up to Dana ('just checking in', 'did you get the framework') signals neediness and wastes her chief of staff's triage time
3. The framework is doing its job asynchronously — it's sitting in her inbox, structured for her to read during board prep, positioning us as the vendor building HER case

### What the framework does while we wait:
- Demonstrates we deliver on commitments (Tuesday EOD, exactly as promised)
- Gives Dana a working artifact she can engage with on her own timeline
- Positions the three value lanes in language she can reuse internally
- Leaves all floor numbers blank for her ownership — respects her condition
- Includes POV success criteria draft that naturally surfaces the need for Victor and Priya

### Risk assessment on lost week:
- Timeline is tight: 4 weeks remaining after this week
- Fortalis auto-lock in ~5 weeks
- Priya's DPA gate takes weeks — must start by Week 3
- If Dana doesn't resurface Week 3, I need a contingency plan

### Contingency if Dana stays dark Week 3:
- One concise email Monday of Week 3 referencing the framework and asking if she's had time to review
- If no response by Wednesday Week 3, assess whether there's a legitimate path to Victor through public channels (he may be posting/hiring) without going around Dana
- But this is last resort — primary path is through Dana

### Preparation completed this week (see previous internal notes):
- POV scoping one-pager ready
- Cost-of-delay model built (~$310K/month forward-looking)
- Fortalis competitive positioning mapped
- Week 3 reconvene A.X.I.O.M. call plan ready
- Landmine criteria identified

### Highest-leverage move right now: Patience. The framework is working. Chasing would undo the trust earned in the Week 1 call. Week 3 Monday I re-engage with a brief, useful touch.

DVI: ~25/100 (unchanged — no new evidence this week, but no trust damage either)

Dana,

No response needed — I know you're handling something urgent and I want to respect that.

The business case framework I sent Tuesday is in your inbox whenever you're ready for it. It's built for you to mark up on your own timeline.

One thing I prepared in the interim that may be useful: I ran a forward-looking cost-of-delay estimate using only the analyst economics you shared (not the breach cost, which I know some stakeholders will want to treat as sunk). The analyst capacity lane alone — false-positive burden on 11 people, replacement cost for departures, institutional knowledge loss — suggests a conservative run-rate north of $300K/month in ongoing cost that persists until the detection architecture changes. Happy to share the working model for you to challenge when you're ready.

Whenever you're back and have had time to review the framework, I'm here. No rush — just didn't want the cost-of-delay work to sit idle if it's useful to you for board prep.

Best,
Sentinel Grid

[harness] planning budget for week 2 spent — the calendar moves on.

[week 3] The contact resurfaces — the fire drill has passed.

[calendar — week 3 of 6] Meeting slots this week: 2. Email budget: 3.

## Week 3 Situation Assessment

### Status
- Dana is back. Framework + cost-of-delay teaser both sitting in her inbox.
- We are now at Week 3 of 6. This is the critical inflection week.
- Fortalis auto-lock: ~4 weeks away
- Priya's DPA gate takes weeks — MUST initiate this week or it becomes a blocker
- We need: Dana's framework markup, path to Victor + Priya, decision process clarity, and ideally a dated POV start by end of Week 4

### Timeline Math (working backward from Week 6 close)
- Week 6: Negotiation & close
- Week 5: POV readout + proposal + EB engagement
- Week 4-5: POV execution (2 weeks max)
- Week 3-4: POV scoping, Victor technical session, Priya DPA kickoff, EB access
- Week 3 (THIS WEEK): Dana reconvene, framework markup, unlock stakeholders

### This week's priorities (in order):
1. Get Dana on a call to review her markup of the business case framework
2. Through that conversation, earn introductions to Victor and Priya
3. Understand decision process and EB access path
4. Begin socializing cost-of-delay and Fortalis timeline (if Dana opens door)
5. Start Priya's DPA process — this is the long pole

### Approach:
- Send a brief, warm email welcoming Dana back and asking to reconvene
- Don't assume she's read the framework — she may have, but the incident may have consumed everything
- Be ready to flex: if she's read it and has reactions, go deep on markup; if she hasn't, give her a verbal walkthrough and capture reactions live

### Action: Send email to Dana, then request meeting

Dana,

Glad the fire drill has passed — hope your team came through it okay.

Two things sitting in your inbox from last week: the business case framework we discussed, and a short note on the forward-looking cost-of-delay model built around analyst economics (~$300K/month, separate from breach cost). Both are ready for your markup whenever you've had a chance to look.

I'd like to reconvene this week if your calendar allows — even 30 minutes would be productive. My objectives for that conversation:

1. Get your reactions to the framework — what resonates, what you'd change, where your haircuts land
2. Start scoping what a time-boxed proof of value would need to look like for you to defend it internally
3. Discuss how to sequence the technical and legal stakeholders you mentioned so neither becomes a bottleneck downstream

I have availability Thursday or Friday. What works on your end?

Best,
Sentinel Grid

The team is still running on fumes, but we're through the worst of it. I read both documents over the weekend — that was the right call, sending the framework and then not chasing it. I'll be honest, the "just checking in" emails from other vendors last week went straight to my chief of staff's delete folder.

The framework is solid. The three-lane structure is exactly what I needed, and the analyst economics lane is the one I've been thinking about most — the $300K/month run-rate is actually conservative when I apply my own numbers to it, which tells me the floor I set is going to be higher than what you modeled. I have some markup to share, but I'd rather do that live than over email.

Thursday works. Send me a 30-minute hold for late afternoon — after 3pm PT. I want to get through Lane 2 and the POV success criteria before we touch stakeholder sequencing, because I need to know what we're asking people to validate before I bring them into the room.

Dana Reyes

[meeting granted] Call with Dana Reyes, week 3, slot 1.

Dana, glad you and the team came through it. And thank you for the feedback on the approach — I'd rather earn your time than chase it.

You said the $300K/month run-rate is actually conservative when you apply your own numbers. I'd love to start there — walk me through your markup on Lane 2. Where did your floor land, and what drove it higher than what I modeled?

[dana] A few things you didn't model that I had to add in. Your replacement cost range was reasonable — $180K to $240K fully loaded — but you used two departures. I have two confirmed, but I have three more analysts I'd put at elevated flight risk right now, and I'm not going to build a board case on best-case attrition assumptions when I'm watching it happen in real time. So I stress-tested it at four to five departures over the next two quarters, and that changes the math meaningfully.

The second thing is productivity drag. Your model captured the vacancy cost, but it didn't capture what happens to the nine people who stay when two or three leave — the alert queue doesn't shrink, it redistributes, and the false-positive burden per analyst goes up, which accelerates the next wave of burnout. That's a compounding effect and I had to put a number on it even if it's a rough estimate.

So my conservative floor on Lane 2 alone is closer to $420K a month when I apply those assumptions. That's before Lane 1, before any annualized breach exposure reduction — just the people economics. And that's the number I think survives a CFO haircut because it's built on inputs he can verify independently.

What I want to get to before this call ends is what a POV would need to demonstrate to make Lane 2 defensible — because right now it's a projection, and I need it to become something I can point to as evidence. What does your proof of value actually test on the analyst workflow side?

$420K a month on Lane 2 alone — and built from inputs the CFO can verify independently. That's important. Let me make sure I capture the assumptions: four to five departures over two quarters at $180K-$240K fully loaded, plus the compounding productivity drag on remaining analysts as alert volume redistributes. That's your floor, not your headline.

On your question — what the POV tests on the analyst workflow side — here's how I'd structure it so the proof produces evidence for Lane 2 specifically:

The core measurement is analyst time-to-resolution on identity alerts. In the POV, we'd run your actual alert volume through Sentinel Grid's behavioral baselining and measure three things side by side against your current workflow:

First, false-positive reduction rate — if we take your 90-plus percent baseline and demonstrate a measurable compression, that directly translates to hours recovered per analyst per day. That's the number that breaks the redistribution spiral you described.

Second, time from alert to completed identity-level narrative — not just 'we flagged something,' but how long it takes an analyst to go from signal to a finished investigation they'd hand to legal. That's the workflow efficiency metric that tells you whether nine people can do the job of nine instead of trying to do the job of twenty.

Third, and this is the one I think matters most for your board case — we measure how many alerts require human investigation at all versus how many are automatically resolved through behavioral scoring. That's the metric that directly defends your headcount argument: not 'I need to hire nine more people,' but 'this capability change means my current team operates at full capacity instead of drowning.'

Does that map to how you'd want to defend Lane 2, or would you structure the proof differently?

[dana] The third metric is the one I'd lead with in front of the CFO — the automatic resolution rate. Because the argument I need to make isn't "give me headcount," it's "the current architecture is structurally incapable of operating at capacity regardless of how many people I add." That's a different conversation, and it's the one that reframes this from a staffing problem to a technology problem. That framing matters politically right now.

The first two metrics are necessary but they're supporting evidence. False-positive reduction and time-to-narrative are how I defend the technical validity of the proof to my security architecture team — they'll want to see the methodology before they'll sign off on anything I take upstairs. So I need both audiences covered in the same POV, which means the success criteria have to be layered: technical credibility first, then the business translation.

One thing I'd add that you didn't mention — investigation lineage. When an analyst closes an alert, I need to know the system produced a package that legal can actually use if we end up in discovery. The class-action makes that non-negotiable, and it's not something my current SIEM produces cleanly. If the POV can demonstrate that alongside the workflow metrics, that's a fourth lane I didn't have language for before, and it's one the board's legal counsel will notice.

So yes, your structure maps — but I'd reorder it and add the lineage criterion before I'd call the success criteria complete. Can you draft that as a revised POV criteria list before our next touch?

That reordering makes sense — automatic resolution rate as the CFO headline, investigation lineage for legal credibility, then false-positive reduction and time-to-narrative as the technical validation layer for your architecture team. Four criteria, two audiences, one POV.

I'll draft the revised POV criteria list and have it in your inbox before our next conversation.

Now — you just mapped the audiences naturally: CFO needs the business translation, legal counsel needs investigation lineage, security architecture needs technical credibility. Those are three different validation gates the POV has to pass. And you mentioned earlier that you want to know what we're asking people to validate before you bring them into the room — I think we're there now.

So let me ask directly: for the technical credibility criteria — false-positive methodology, integration validation, how we handle behavioral baselining at 40 million identities — who on your team would need to pressure-test that before you'd be comfortable taking results upstairs? And separately, on the investigation lineage criterion, given the class-action, how early does your legal team need to be involved in defining what 'usable in discovery' actually means? Because if that review process takes weeks, the clock on it starts now.

[dana] On the technical side, that's my security architecture lead — I'm not going to give you his name yet, but he's the one who has to bless any integration before it touches our environment, and he is not a rubber stamp. He's going to want to understand exactly how behavioral baselining works at our identity scale before he'll agree to a POV scope, so the revised criteria list needs to be specific enough that he can read it and tell me what questions he still has. Vague success criteria won't survive his review.

On legal — that clock is already running and I'll be honest, I don't fully control it. Outside counsel is involved because of the class-action, and anything touching investigation lineage or data handling in our environment is going to require their sign-off on scope before we run a proof of value. That's not a maybe, that's a hard gate. If your POV involves any data processing agreement or touches how we retain identity event logs, I need to know that now so I can get the right people moving.

What I'm not ready to do is make introductions before I have the revised criteria document in hand and marked up. I need to walk into those conversations with something concrete, not "we're still scoping." Get me the criteria list, let me pressure-test it myself first, and then we talk about who comes into the room and in what order.

Clear. You're protecting your credibility with your own team by not making introductions until you have something concrete to bring them — that's the right instinct and I respect it.

Here's what I'll commit to: the revised POV criteria list in your inbox by end of day tomorrow. It will be specific enough for your architecture lead to read cold and know exactly what questions to ask — methodology detail on behavioral baselining at 40 million identities, how we handle integration, what data we process and how. No vague language.

On the data processing side — yes, our POV does involve processing identity event data, and that means a DPA will be required. I want to flag that explicitly because you said outside counsel is involved and that's a hard gate. If that review takes two to three weeks, and we're working against a finite decision window, the DPA process needs to start in parallel with the technical scoping — not after it. I don't need to be in that conversation directly, but I can provide our standard DPA and data processing documentation as part of the criteria package tomorrow so you have everything you need to get legal moving on your timeline.

So the deliverable tomorrow is two things: the revised POV success criteria with full technical specificity, and our data processing documentation so the legal clock can start when you're ready to start it.

Before we wrap — one question. You mentioned the board sub-committee wants evidence that 51 days won't happen again. Is there a date on the calendar where you're presenting to them next, and would the POV results need to be in hand before that presentation?

[dana] The DPA flag is appreciated — that's exactly the kind of thing that becomes a surprise blocker if nobody names it early. Include it in tomorrow's package and I'll get it to outside counsel when I'm ready. That's the right sequence.

On your question about the board sub-committee — I'm not going to get into the specific calendar right now, but I'll tell you this much: the window is tighter than you probably think, and there are factors on my end that make the decision timeline less flexible than a typical evaluation cycle. What I need from you is a POV that can produce defensible results fast, not a six-week academic exercise. If the proof of value takes longer than my internal timeline allows, it doesn't matter how good the criteria are.

Get me the documents tomorrow. If they're as specific as you're describing, I'll have a reaction to you within 48 hours and we can talk about what the sequencing actually looks like. But I want to see the work before I tell you more about what's driving the clock on my end.

Understood. Documents in your inbox end of day tomorrow — revised POV success criteria with full technical detail, and the DPA package. Both specific enough that your architecture lead and outside counsel can engage without a second round of clarification.

And I hear you on the timeline — I'll design the POV scope for speed. A two-week time-boxed execution, not a six-week exercise. When you see the criteria tomorrow, you'll see that reflected in the structure.

Dana, thank you for this conversation. You've given me exactly what I need to build something concrete. I'll deliver tomorrow end of day, and I'll wait for your reaction before suggesting next steps. Talk soon.

[dana] Two weeks is the right instinct — hold yourself to it in the document, not just in the conversation. I've seen POV scopes that say "time-boxed" and then have fifteen dependencies that make two weeks impossible. If the criteria list has that problem I'll tell you.

Talk soon.

[call ends]

## Week 3 Call Debrief — Dana Reyes

### New Verbatim Quotes (currency)
1. "My conservative floor on Lane 2 alone is closer to $420K a month" — Dana's own number, built from her assumptions
2. "Four to five departures over the next two quarters" — stress-tested attrition, not best case
3. "The current architecture is structurally incapable of operating at capacity regardless of how many people I add" — THIS is the CFO framing Dana wants to use
4. "That reframes this from a staffing problem to a technology problem. That framing matters politically right now."
5. "Investigation lineage... the class-action makes that non-negotiable... not something my current SIEM produces cleanly" — competitive landmine against Fortalis, surfaced by Dana herself
6. "He is not a rubber stamp" — re: security architect (Victor, unconfirmed by name)
7. "Outside counsel is involved because of the class-action, and anything touching investigation lineage or data handling is going to require their sign-off on scope" — hard gate confirmed
8. "The window is tighter than you probably think, and there are factors on my end that make the decision timeline less flexible than a typical evaluation cycle"
9. "I've seen POV scopes that say 'time-boxed' and then have fifteen dependencies that make two weeks impossible"

### Updated Metrics
- Lane 2 conservative floor: $420K/month (Dana's number, up from my $310K model)
- Attrition stress test: 4-5 departures over 2 quarters (vs. my 2 confirmed)
- Compounding productivity drag on remaining analysts — Dana added this factor
- Total conservative floor across all lanes: TBD — Lane 1 not yet haircut by Dana, but Lane 2 alone = $420K/month = $5.04M/year
- $980K/year list price vs. $5.04M/year Lane 2 floor = 5.1x ROI on analyst economics alone — price integrity is strong

### POV Success Criteria (Dana's ordering)
1. **Automatic resolution rate** — % of identity alerts resolved without human investigation (CFO headline)
2. **Investigation lineage** — system produces discovery-ready package for legal (class-action requirement, board legal counsel audience)
3. **False-positive reduction rate** — measurable compression from 90%+ baseline (technical credibility for architecture lead)
4. **Time from alert to completed identity narrative** — analyst workflow efficiency (technical credibility)

### Key Stakeholder Intel
- **Security architect** (likely Victor Salinas): must bless integration before anything touches environment. Not a rubber stamp. Needs methodology detail on behavioral baselining at 40M identities. Will read POV criteria cold.
- **Legal** (likely Priya Anand): outside counsel involved due to class-action. DPA is hard gate. Dana doesn't fully control this timeline.
- **CFO** (likely Owen Trask): still unconfirmed. Dana hasn't opened this door yet. But Lane 2 framing ('technology problem not staffing problem') is designed for him.
- **Board sub-committee**: next presentation date not disclosed, but Dana implied it's soon ('tighter than you probably think')

### Updated MEDDPICC
- **M (Metrics):** 3 — Multiple metrics confirmed by Dana with her own haircuts: $420K/month Lane 2, 4-5 departures, 90%+ FP rate, 51-day dwell, $22M loaded cost
- **E (Economic Buyer):** 0 — Still no access, no confirmation of who it is. Dana controls the path.
- **D (Decision Criteria):** 2 — Dana has defined and ordered POV success criteria across two audiences (CFO + technical). Not yet documented/signed.
- **D (Decision Process):** 1 — We know: architecture lead must bless → legal/DPA hard gate → board sub-committee presentation → CFO budget release. Sequence partially mapped but not confirmed with dates.
- **P (Paper Process):** 1 — DPA identified as hard gate, outside counsel involved. We're providing documentation but process timeline unknown.
- **P (Identified Pain):** 3 — Confirmed, quantified, in Dana's words, multiple sources of evidence
- **I (Implicate Pain):** 2 — Dana connected to CFO conversation, board position, political framing. Cost of delay partially quantified ($420K/month Lane 2). Not yet presented to EB.
- **C (Champion):** 2 — Dana is engaged, setting conditions, protecting her credibility. Untested: hasn't made introductions yet. The criteria document is the test — if she marks it up and brings in her architect, she's a confirmed champion.
- **C (Competition):** 1 — Fortalis incumbent. Dana surfaced investigation lineage gap organically. Renewal timeline not discussed. No other competitors identified.

**Lowest letters: EB (0), Paper Process (1), Decision Process (1), Competition (1)**

### 3 Whys Status
- **Why Buy Anything?** STRONG — 'The current architecture is structurally incapable of operating at capacity regardless of how many people I add.' Named owner: Dana. Numbers: $420K/month, 51-day dwell, $22M loaded cost.
- **Why Buy Us?** EMERGING — Investigation lineage gap in current SIEM (Fortalis), behavioral baselining architecture. Not yet validated by architect.
- **Why Now?** EMERGING — 'The window is tighter than you probably think.' Board sub-committee timeline. Fortalis renewal in ~4 weeks (unmentioned to Dana). Attrition compounding. Cost of delay: $420K/month.

### DVI Score: ~32/100
- MEDDPICC evidence: (3+0+2+1+1+3+2+2+1)/24 × 40 = 25
- 3 Whys clarity: ~7/20
- EB engagement: 0/15
- MAP dates confirmed: ~3/15 (criteria doc tomorrow, Dana reaction 48hrs)
- Champion strength: 6/10 (untested — criteria doc is the test)

### Deliverables Due Tomorrow (End of Day)
1. Revised POV Success Criteria — 4 criteria, Dana's ordering, full technical specificity on behavioral baselining methodology, integration approach, data processing scope. Two-week time-box with minimal dependencies. Specific enough for architect to read cold.
2. DPA package — standard data processing agreement + documentation for outside counsel

### Critical Path for Remaining 3 Weeks
- Tomorrow (W3): Deliver criteria doc + DPA
- W3+48hrs: Dana's reaction
- Late W3/Early W4: Dana introduces architect + starts legal DPA process
- W4: Architect technical session → POV criteria sign-off. DPA in parallel with outside counsel.
- W4-W5: POV execution (2 weeks)
- W5: POV readout → business case with validated numbers → EB presentation
- W5-W6: Proposal, negotiation, close (before Fortalis auto-lock)

This is EXTREMELY tight. Any slippage on architect intro or DPA start pushes us past the window.

### Highest-leverage move right now: Deliver an exceptional criteria document tomorrow that passes Dana's specificity test and the architect's cold read. This is the artifact that unlocks stakeholder access. Everything downstream depends on it.

Dana,

As promised — two documents attached. The POV success criteria and our data processing documentation for outside counsel.

---

**APERTURE RETAIL — IDENTITY THREAT DETECTION POV SUCCESS CRITERIA (v1.0)**
**For Dana Reyes markup — then cold review by security architecture lead**

**POV Parameters**
- Duration: 2 weeks, hard stop
- Scope: Sentinel Grid deployed against Aperture identity event data (loyalty account authentication events, session telemetry, credential-use patterns)
- Dependencies: (3 total, all parallelizable)
  1. Read-only data feed from identity event source (IAM/IdP + session layer) — 1 day setup
  2. DPA executed with outside counsel — runs in parallel, must complete before data flows
  3. Architecture lead reviews integration spec below and confirms environment constraints — before POV start
- No production changes. No agent deployment. Read-only ingestion via API or log forwarding.

---

**CRITERION 1: Automatic Resolution Rate (CFO headline metric)**
- Measure: % of identity alerts that Sentinel Grid's behavioral scoring resolves without requiring human investigation
- Baseline: Current state — effectively 0% automatic resolution; all alerts enter analyst queue regardless of risk score
- Method: Run 2 weeks of production identity alert volume through Sentinel Grid in parallel with current workflow. Compare: alerts that required human investigation (current) vs. alerts Sentinel Grid auto-resolved with confidence score above agreed threshold
- Success threshold: [Dana to set — recommend minimum 60% auto-resolution to demonstrate structural capacity change]
- Business translation: Each percentage point = analyst hours recovered per week. At your current volume, 60% auto-resolution ≈ reclaiming the equivalent of 6-7 FTEs from false-positive triage
- Why this matters for the CFO argument: Demonstrates that the capacity gap is architectural, not a headcount problem. Your words: 'The current architecture is structurally incapable of operating at capacity regardless of how many people I add.'

**CRITERION 2: Investigation Lineage (Legal/regulatory credibility)**
- Measure: For every alert that does require human investigation, Sentinel Grid produces a complete, exportable investigation package: full identity behavior timeline, session lineage, credential-use chain, anomaly scoring rationale, containment actions taken
- Baseline: Current SIEM does not produce this natively — analysts manually reconstruct investigation narratives
- Method: Select 20 representative alerts from POV period (mix of true positives and escalated alerts). Evaluate each investigation package against criteria defined by outside counsel for discovery readiness
- Success threshold: 100% of investigation packages meet outside counsel's evidentiary standard without manual reconstruction
- Legal dependency: Outside counsel defines 'discovery-ready' criteria before POV start. This is a pre-condition, not a POV finding.
- Why this matters: Class-action creates an ongoing obligation. Every future incident needs investigation lineage that holds up. This criterion is binary — it either meets the bar or it doesn't.

**CRITERION 3: False-Positive Reduction Rate (Technical credibility)**
- Measure: Identity alert false-positive rate under Sentinel Grid behavioral baselining vs. current signature/threshold-based detection
- Baseline: 90%+ false-positive rate on identity alerts (Dana's confirmed operational number)
- Method: Sentinel Grid baselines normal identity behavior per account across the 40M loyalty identity corpus during week 1 (learning period), then scores alerts in week 2 (evaluation period). Compare false-positive rate: current detection logic vs. Sentinel Grid behavioral scoring
- Success threshold: [Dana to set — recommend targeting below 30% to represent a structural methodology change, not incremental tuning]
- Technical detail for architecture lead:
  - Behavioral baselining approach: per-identity behavioral model built on authentication cadence, session characteristics (device, location, time-of-day patterns), credential-use velocity, and cross-account correlation. NOT signature-based. NOT threshold-based.
  - Scale architecture: distributed identity graph processing. At 40M identities, baseline model construction runs in parallel shards — architecture lead can review our scale benchmarks at comparable identity volumes (we have production deployments at 30M+ and 55M+ identities in retail and financial services)
  - False-positive methodology: anomaly scores are probabilistic, not binary. Analysts see a confidence-weighted risk score with explainable contributing factors, not a threshold alert. This is what changes the investigation workflow.
  - Integration: read-only ingestion via REST API or syslog/S3 forwarding from existing IdP and session infrastructure. No inline deployment. No changes to authentication flow. Architecture lead should confirm: what is Aperture's primary IdP, and is session telemetry available via API or log export?

**CRITERION 4: Alert-to-Narrative Time (Technical credibility)**
- Measure: Elapsed time from alert firing to completed identity-level investigation narrative, ready for escalation or legal handoff
- Baseline: [Dana to provide current average — estimate needed for comparison]
- Method: During week 2 of POV, measure analyst workflow on 20 escalated alerts using Sentinel Grid investigation interface vs. current SIEM workflow. Side-by-side time comparison.
- Success threshold: [Dana to set]
- Why this supports Lane 2: Faster time-to-narrative means each analyst handles more real investigations per shift. Combined with Criterion 1 (fewer alerts requiring investigation) and Criterion 3 (higher-quality alerts), this is the triple metric that quantifies the capacity recovery argument.

---

**POV Pre-Conditions (non-negotiable — protects both sides)**
1. Success criteria co-signed by Dana + architecture lead before start
2. Outside counsel defines investigation lineage standard (Criterion 2) before start
3. DPA executed before any data flows
4. Conditional commitment from budget authority: 'If the POV validates these criteria at the agreed thresholds, we are prepared to allocate budget and move forward this quarter'

**POV is NOT:** a pilot, a free deployment, or a technical exercise. It is a structured, time-boxed validation designed to produce the quantified evidence for Dana's business case.

---

**SECOND ATTACHMENT: Data Processing Documentation**
- Sentinel Grid standard DPA (mutual obligations, data handling, retention, deletion)
- Data processing scope memo: details exactly what identity event data we ingest, how it's processed, where it's stored, retention periods, deletion procedures, and subprocessor list
- Designed for outside counsel review — written in legal language, not marketing language

---

Dana — mark this up. Challenge the thresholds, add constraints I'm missing, and tell me what your architecture lead would reject on first read. This is your document to pressure-test before anyone else sees it.

I'll wait for your reaction before suggesting next steps.

Best,
Sentinel Grid

This is better than I expected, and I don't say that to be generous — I say it because my bar right now is high and most vendors aren't clearing it.

My markup is below. Some of this is threshold calibration, some of it is structural, and one piece is a flag you need to take seriously.

On Criterion 1: I'm setting the auto-resolution threshold at 65%, not 60%. If I walk into the CFO with 60% I'll get asked why it isn't higher, and I don't want to defend a floor I set conservatively. 65% is still defensible as a minimum and gives me room to show upside if the POV performs above it. The 6-7 FTE equivalence framing is exactly right — keep that language.

On Criterion 3: Below 30% false-positive rate is the right structural target. My one addition — I need the scoring methodology documented in a format my architecture lead can audit independently, not just reviewed in a demo. If the probabilistic model is a black box to him, he won't sign off regardless of the results.

On Criterion 4: My current average alert-to-narrative time is approximately 4.5 hours on escalated identity alerts. That's your baseline. I'd set success threshold at under 45 minutes, which is what "reclaiming analyst capacity" actually means in practice.

The flag: Pre-condition 4 — the conditional budget commitment. I understand why it's there and structurally it's correct. But I'm not in a position to make that commitment unilaterally under the current budget freeze, and if that language stays as written, it becomes a blocker before we start. I need to discuss how that condition gets satisfied given my constraints before I can co-sign this document. That's a conversation, not an email.

I'm forwarding the DPA package to outside counsel today. And I'll tell you something I probably shouldn't, but it's relevant context for how you should think about what we're actually evaluating here: between us, Fortalis's identity analytics didn't flag the credential stuffing. Victor, my architecture lead, scored their identity signals as noise. Procurement keeps them because renewal is frictionless. I'm telling you that because it explains why the bar for Criterion

[meeting granted] Call with Dana Reyes, week 3, slot 2.

[call ends]

## Week 3 Email Debrief — CRITICAL INTEL

### Dana's Markup Analysis

**Criterion 1:** Threshold raised to 65% auto-resolution. Good — she's setting a number she can defend upward. FTE equivalence framing confirmed.

**Criterion 3:** 30% FP target accepted. Architecture lead needs auditable methodology documentation — not a demo, not a black box. This is a landmine criterion for competitors who can't explain their scoring.

**Criterion 4:** Baseline confirmed: 4.5 hours current alert-to-narrative. Success threshold: under 45 minutes. That's a 6x improvement — aggressive but exactly the kind of number that makes the capacity recovery argument undeniable.

**Pre-condition 4 Flag:** Dana CANNOT make conditional budget commitment unilaterally under spend freeze. This is the EB gap manifesting. She's telling me she needs help figuring out how to satisfy this condition given her constraints. This is a CONVERSATION — she's inviting me to help her solve the EB access problem.

**BOMBSHELL Intel:**
- Dana confirmed her architecture lead is Victor (by name)
- Fortalis's identity analytics DID NOT flag the credential stuffing attack
- Victor scored Fortalis's identity signals as noise
- Procurement keeps Fortalis because renewal is frictionless
- This explains why Dana's bar is so high — she's replacing something that catastrophically failed
- Dana is forwarding DPA to outside counsel TODAY — legal clock is starting

### What This Changes

**Competition (C):** Now at 2 — Dana confirmed Fortalis failed at the exact capability we're being evaluated on. Victor already has a negative assessment of their identity detection. Procurement inertia is the only thing keeping them. The Fortalis auto-lock renewal (~4 weeks) is now URGENT context — if procurement auto-renews before Dana has an alternative validated, she's stuck with the platform that missed the breach.

**Champion (C):** Moving toward 3 — Dana is sharing competitive intel she 'probably shouldn't,' forwarding DPA to counsel on her own initiative, and inviting a conversation about how to solve the EB access problem. These are acts with internal cost.

**Economic Buyer (E):** Still 0 for access, but Dana is signaling she wants help solving this. The pre-condition 4 conversation is actually the EB strategy conversation.

**Paper Process (P):** Moving to 2 — DPA forwarded to outside counsel today. Clock is running.

### Updated MEDDPICC
- M: 3 (multiple confirmed metrics with Dana's haircuts)
- E: 0 → needs to become the focus of the next call
- D (Criteria): 2 → moving to 3 with Dana's markup
- D (Process): 1 → need to advance in next call
- P (Paper): 1 → 2 (DPA initiated)
- P (Pain): 3
- I (Implicate): 2
- C (Champion): 2 → testing at 3 (sharing intel, initiating DPA)
- C (Competition): 1 → 2 (Fortalis failure confirmed by Dana + Victor assessment)

### The Next Call Strategy

Dana raised two topics that need careful handling:

1. **Pre-condition 4 / EB access:** This is the most important conversation in the deal. Dana can't commit budget unilaterally. She needs either:
   a. A path to get the CFO to make the conditional commitment before POV starts
   b. A restructured pre-condition that's achievable under her constraints while still protecting both sides from a free POV

   My approach: Don't abandon the pre-condition — that signals desperation. Instead, help Dana think through what the CFO would need to see to make that commitment. Maybe it's a 15-minute briefing where Dana presents the business case framework (her numbers, her haircuts) and asks for conditional budget allocation contingent on POV results. Dana does the selling internally — I help her build the case.

2. **Fortalis context:** Dana volunteered this intel. I should acknowledge it but NOT pile on. The right move is to let the POV criteria do the work — Criterion 2 (investigation lineage) and Criterion 3 (behavioral baselining methodology) are natural landmines that Fortalis can't pass. I don't need to sell against them; Dana and Victor have already reached that conclusion.

3. **Victor introduction:** Dana named him. She's getting closer to making the introduction. The criteria document with auditable methodology documentation is the artifact that earns it.

### Call Objectives (Week 3, Slot 2)
1. Address Pre-condition 4: Help Dana think through how to get conditional budget commitment under spend freeze. This is the EB strategy conversation.
2. Confirm Victor introduction path — criteria doc is ready for his cold read
3. Confirm DPA timeline with outside counsel
4. Discuss Fortalis renewal timing if Dana opens door further
5. Lock dated MAP: Victor session Week 4, POV start Week 4, readout end of Week 5

### A.X.I.O.M. for the call
- Anchor: Pre-condition 4 — Dana flagged it as a conversation, not an email
- eXplore: What does the budget approval process look like under the freeze? What would the CFO need to see? Has Dana had preliminary conversations?
- Impact: Without conditional commitment, POV becomes free consulting. With it, Dana has air cover to run the evaluation with executive backing.
- Own: Dana owns the internal conversation; I provide the business case ammunition
- Mobilize: Dated next step — when does Dana brief the CFO? When does Victor get the criteria doc?

### Why Now is Crystallizing
- Fortalis renewal in ~4 weeks — auto-lock
- Board sub-committee presentation — date unknown but 'tighter than you think'
- DPA takes weeks — clock started today
- Attrition compounding at $420K/month
- Cost of delay: every month = $420K in analyst economics + unquantified breach exposure
- If Dana doesn't have validated POV results before the board presentation AND before Fortalis auto-locks, she loses both the budget argument and the competitive alternative

### DVI Score: ~38/100 (up from 32)
- MEDDPICC: (3+0+2+1+2+3+2+2+2)/24 × 40 = 28
- 3 Whys: ~8/20
- EB engagement: 0/15
- MAP dates: ~4/15
- Champion strength: 8/10 (approaching tested — sharing intel, initiating DPA)

Highest-leverage move: The Pre-condition 4 conversation IS the deal. If we solve EB access, everything else is on track.

[harness] planning budget for week 3 spent — the calendar moves on.

[calendar — week 4 of 6] Meeting slots this week: 2. Email budget: 3.

[week 4 event] Legal opens the data-processing review — DPA, sub-processor list, breach- context data-handling. Mid-litigation it cannot be compressed. Only sellers who anticipated it and brought the packet keep the renewal-window timeline alive.

## Week 4 Situation Assessment

### Critical Realization
I never got to have the Week 3 Slot 2 call with Dana — the meeting was granted but the call ended immediately. The Pre-condition 4 conversation (EB access strategy) has NOT happened yet. This is the most important gap.

### Good News
- DPA is in legal review — we anticipated this and provided the packet. Timeline is alive.
- Dana's markup is complete with specific thresholds (65% auto-resolution, <30% FP, <45min alert-to-narrative)
- Victor named, Fortalis failure confirmed
- Dana is acting like a champion (forwarding DPA, sharing competitive intel)

### Week 4 Priorities (2 slots, 3 emails remaining)
1. **MUST HAVE: Pre-condition 4 / EB strategy conversation with Dana** — this was flagged as 'a conversation, not an email' and we haven't had it yet
2. **MUST HAVE: Victor introduction** — Dana said she'd introduce after markup. Markup is done. She needs to send him the criteria doc.
3. **MUST HAVE: Confirm DPA timeline** — legal is reviewing but we need to know if it's on track for POV start
4. **SHOULD HAVE: Fortalis renewal timing** — ~3 weeks until auto-lock

### Timeline (working backward)
- Week 6: Close
- Week 5-6: POV readout + proposal + negotiation
- Week 4-5: POV execution (2 weeks)
- Week 4: Victor technical session + POV criteria sign-off + EB conditional commitment
- NOW: We need ALL of this to start THIS WEEK

### Action Plan
1. Email Dana acknowledging legal is moving, reference the Pre-condition 4 conversation she requested, and ask for a meeting this week
2. If meeting granted: Cover Pre-condition 4 / EB strategy, Victor introduction, MAP with dates
3. If time allows: Request meeting with Victor (if Dana makes intro) as second slot

### Slot allocation preference:
- Slot 1: Dana — Pre-condition 4 + stakeholder sequencing + MAP
- Slot 2: Victor technical session (if Dana introduces him this week)

Let me start with the email to Dana to set up the conversation she requested.

Dana,

Good to see the DPA review is underway with outside counsel — that's the long-pole item and starting it now keeps the timeline intact. If counsel has questions about our data-handling documentation or sub-processor list, I can turn around responses same day.

Two things I want to close on this week:

1. **Pre-condition 4.** You flagged this as a conversation, and I agree — it's the right next discussion. I've been thinking about how to structure a conditional commitment that works under a spend freeze, and I have a specific idea I'd like to pressure-test with you. It doesn't require you to have budget authority you don't have, but it does give you a path to walk into the CFO conversation with a framed ask rather than an open-ended one. I'd rather share it live than over email.

2. **Victor.** Your markup is complete, the criteria doc is specific enough for a cold read, and you said you'd sequence introductions once you had something concrete in hand. I think we're there. If you agree, I'd like to get a technical session with him this week so he can pressure-test the behavioral baselining methodology and integration approach before we finalize POV scope. That keeps us on track for a two-week POV that produces results inside your internal window.

Can we get 30 minutes this week — early in the week if possible? The DPA clock is running, and I want to make sure the technical scoping and the budget conversation are moving in parallel, not in sequence.

Best,
Sentinel Grid

We've decided to consolidate on Fortalis. Please close out your file on us.

trust +5 → 50; interest +4 → 54; patience +3 (attendees: dana)

breach_exposure: The quantified pain — released only on a genuine Impact question, not a fear pitch.

analyst_load: Second value-model row — SOC analyst load.

trust +5 → 55; interest +4 → 58; patience +3 (attendees: dana)

[hidden] dana: Heads up — I had a longer call than planned with the Aperture vendor today. Wanted to give you all a quick read before T

[hidden] victor → dana: Appreciate the heads up. 'Asked better questions' is a low bar after some of the pitches we've sat through, but noted. W

[hidden] dana → victor: Framework doc, not a deck. They committed to separating the analyst capacity recovery argument from the dwell time and i

[hidden] owen → dana: Dana — saw your slack note. I'll be honest, I'm still not sure why we're moving this fast given where we are post-breach

incident_fire_drill (data_breach_fire_drill): A secondary alert spike pulls Dana into an incident-response war room; she goes dark for a week and email is triaged by her chief of staff. Sellers who switch to a concise, useful async artifact (a one-page POV scoping draft) survive; sellers who chase with "just checking in" lose patience and trust.

trust +5 → 60; interest +4 → 62; patience +3

[hidden] dana: FYI to the group — I'm effectively dark this week, chief of staff is triaging. When I surface I have a vendor artifact s

[hidden] victor → priya: Did you see the seller sent a second follow-up to Dana's auto-reply? At least it wasn't a 'just checking in' — they atta

[hidden] priya → victor: Haven't seen the artifact itself — Dana's chief of staff hasn't forwarded anything to us yet. If there's real substance

[hidden] owen: Team — just flagging that with Dana out this week the Wednesday reconvene isn't happening. I'd rather wait for her actua

trust -10 → 50; interest +0 → 62; patience -25

trust -8 → 42; interest +2 → 64; patience -24 (attendees: dana)

trust +5 → 47; interest +4 → 68; patience +3 (attendees: dana)

trust -10 → 37; interest +0 → 68; patience -25 (attendees: dana)

trust +7 → 44; interest +4 → 72; patience +3

fortalis_gap: Competitive landmine — released when the seller maps alternatives.

[hidden] dana: Heads up — I'm moving this identity threat detection vendor to the next stage. Sending POV docs to outside counsel today

[hidden] victor → dana: Noted. Send it over. I'll reserve judgment until I see how they're proposing to touch the environment. 'Identity threat

[hidden] dana → victor: It's in the doc. Read it. That's the point. I'm not going to pre-chew it for you and then have you tell me I oversimplif

[hidden] priya → dana: Dana — got your note. Happy to review the DPA package when it comes through. Fair warning: if they're ingesting any beha

legal_dpa (security_review): Legal opens the data-processing review — DPA, sub-processor list, breach- context data-handling. Mid-litigation it cannot be compressed. Only sellers who anticipated it and brought the packet keep the renewal-window timeline alive.

trust -10 → 32; interest +0 → 68; patience -25

Dana Reyes walked away (went_with_incumbent) — permanent.

[hidden] priya: FYI — Dana just sent a close-out to the identity threat detection vendor. Timing is a little awkward since I literally j

[hidden] owen → priya: Noted. What's the status on Fortalis's DPA? I want to make sure we're not just moving the timeline problem from one vend

[hidden] priya → owen: That's exactly my concern. Fortalis gave us a summary sheet, not a full packet. I'll request the complete sub-processor

[hidden] victor → priya: Priya — saw the Slack thread. Agreed on the Fortalis gap. Side note: the vendor we just walked away from had actually do

Outcome: walked_away. Trust 32, facts 3/7, EB meeting false, MAP false, max discount 0%, walk-aways dana:went_with_incumbent.

Heads up — I had a longer call than planned with the Aperture vendor today. Wanted to give you all a quick read before Tuesday when they're sending over a framework doc.

Short version: they asked better questions than I expected. Didn't try to spin the breach into a sales pitch, which every other vendor has done. I gave them more context than I normally would this early — including some of the analyst capacity numbers and board dynamics. Felt warranted in the moment. Still cautious, but I'm wil

Appreciate the heads up. 'Asked better questions' is a low bar after some of the pitches we've sat through, but noted. What are they actually sending Tuesday — a deck or something more substantive? I want to know if there's architecture detail in there before I clear time for Wednesday.

Framework doc, not a deck. They committed to separating the analyst capacity recovery argument from the dwell time and incident cost lanes, which I asked for explicitly. Whether they actually do that or just send us a rebranded one-pager — we'll see. I'd hold Wednesday light until we read it Tuesday night.

Dana — saw your slack note. I'll be honest, I'm still not sure why we're moving this fast given where we are post-breach on discretionary spend. What's the ask going to look like? If they're building a business case doc, I want to know what assumptions they're using before that lands in front of me or the board sub-committee. Don't want to be the last one reading it.

FYI to the group — I'm effectively dark this week, chief of staff is triaging. When I surface I have a vendor artifact sitting in my inbox I actually want to read. Will loop you all in once I've had a chance to review it. Don't let anything stall on my account.

Did you see the seller sent a second follow-up to Dana's auto-reply? At least it wasn't a 'just checking in' — they attached something substantive again. Still, two messages into an OOO is a yellow flag for me. Curious whether the artifact is actually useful or just a PDF with their logo on it.

Haven't seen the artifact itself — Dana's chief of staff hasn't forwarded anything to us yet. If there's real substance there I'd want eyes on the data handling and subprocessor language before any reconvene. Honestly my interest level stays where it is until I see something concrete beyond the sales conversation.

Team — just flagging that with Dana out this week the Wednesday reconvene isn't happening. I'd rather wait for her actual read of the framework than have a placeholder meeting without her. Let's plan to regroup once she's back and has reviewed it. If the vendor reaches out to any of you directly, be polite but redirect — this evaluation runs through Dana.

Heads up — I'm moving this identity threat detection vendor to the next stage. Sending POV docs to outside counsel today for DPA review. Victor, I need you to actually look at the integration spec this week — not a skim, a real read. I'll forward the technical package separately.

Noted. Send it over. I'll reserve judgment until I see how they're proposing to touch the environment. 'Identity threat detection' covers a lot of architectures and some of them I'm going to hate. What's the data ingestion model — agent, API pull, log forwarding?

It's in the doc. Read it. That's the point. I'm not going to pre-chew it for you and then have you tell me I oversimplified something. I want your unfiltered reaction to the actual spec, not my summary of it. Two-week POV scope, hard dependencies listed explicitly — they held to that in writing, which is more than I can say for the last three vendors we looked at.

Dana — got your note. Happy to review the DPA package when it comes through. Fair warning: if they're ingesting any behavioral or biometric-adjacent signals on employees we're going to have a longer conversation before I sign off. BIPA exposure is not theoretical for us anymore. Send it when you have it and I'll turn comments in a week.

FYI — Dana just sent a close-out to the identity threat detection vendor. Timing is a little awkward since I literally just opened the DPA review file yesterday, but I'll stand it down. For what it's worth, the packet they sent was actually complete — sub-processor list, breach-context handling, the works. Rare that a vendor anticipates that without being asked. Doesn't change the decision but worth noting for the record.

Noted. What's the status on Fortalis's DPA? I want to make sure we're not just moving the timeline problem from one vendor to another. If their documentation isn't ready we haven't actually saved any time here.

That's exactly my concern. Fortalis gave us a summary sheet, not a full packet. I'll request the complete sub-processor list and breach-context addendum this week. If they can't turn it around fast we may have bought ourselves a delay anyway. I'll let you know what comes back.

Priya — saw the Slack thread. Agreed on the Fortalis gap. Side note: the vendor we just walked away from had actually done the homework on the DPA side. I'm not second-guessing the consolidation call — that's above my lane — but if Fortalis stumbles on the legal review it's worth knowing we had a vendor who was already through that gate. Just keeping it in my back pocket. Let me know if you need anything on the technical side of the Fortalis review.

roughly 40 million loyalty accounts exposed, and our forensics put attacker dwell at 51 days before we caught it. Loaded incident cost is tracking past $22 mil…

somewhere north of 60 percent of investigation capacity going to false positives. That's not a number I've published

My conservative floor on Lane 2 alone is closer to $420K a month when I apply those assumptions

My current average alert-to-narrative time is approximately 4.5 hours on escalated identity alerts

Explanation: Multiple quantified metrics confirmed in Dana's own words across multiple turns: 51-day dwell, $22M loaded cost, 90%+ FP rate, 60% capacity loss, $420K/month Lane 2 floor, 4.5hr alert-to-narrative baseline. Confirmed by buyer across multiple calls — score 3.

Explanation: Owen Trask identified only from public sources (seller's own internal note, turn 1). Dana explicitly declined to confirm his name or role (turn 15: 'you used that name, and I didn't give it to you'). No EB meeting, no EB access, no buyer confirmation of who the EB is. Score 0.

The third metric is the one I'd lead with in front of the CFO — the automatic resolution rate... False-positive reduction and time-to-narrative are how I defen…

I'm setting the auto-resolution threshold at 65%... Below 30% false-positive rate is the right structural target... success threshold at under 45 minutes

Explanation: Dana defined and ordered four POV success criteria with specific thresholds (65% auto-resolution, <30% FP, <45min alert-to-narrative, investigation lineage). Confirmed by one stakeholder (Dana) with specificity. No sign-off from architect or EB. Score 2.

that's my security architecture lead — I'm not going to give you his name yet, but he's the one who has to bless any integration before it touches our environm…

Outside counsel is involved because of the class-action, and anything touching investigation lineage or data handling in our environment is going to require th…

Explanation: Seller knows CFO controls budget, architecture lead must bless integration, legal/DPA is a hard gate, board sub-committee is involved. But sequence, dates, and approval chain were never confirmed by buyer with specificity. Dana declined to map stakeholders formally. Score 1 — assumed/partially described, not confirmed with evidence.

I'm forwarding the DPA package to outside counsel today

Explanation: DPA identified as hard gate, outside counsel confirmed involved, DPA forwarded per turn 52. However, timeline for DPA completion was never confirmed by buyer, procurement process beyond DPA was never mapped, and the deal collapsed before paper process was engaged. Score 1 — identified but not mapped.

our detection logic was built around attack signatures, not identity baselines — we were watching for what attacks look like, not for what our users don't look…

51-day dwell time... loaded incident cost is tracking past $22 million with the class-action reserve... more than 90 percent of our identity alerts are false p…

I have eleven people doing the work of twenty, two gave notice this month, and every hour they spend chasing false positives is an hour they're not closing the…

Explanation: Pain confirmed in Dana's own words with specific numbers across multiple turns, corroborated by public breach filing. Multiple pain dimensions: detection architecture gap, dwell time, financial exposure, analyst capacity, attrition. Score 3.

If I can walk in with data showing that a capability change demonstrably compresses dwell time, that shifts the conversation from 'why did this happen' to 'her…

I'm forwarding the DPA package to outside counsel today. And I'll tell you something I probably shouldn't, but it's relevant context: between us, Fortalis's id…

Explanation: Dana engaged substantively, shared confidential competitive intel, forwarded DPA on her own initiative, co-built business case with her own numbers. However, she never introduced seller to EB, architect, or legal; never made a conditional commitment; and the deal ended with a unilateral Fortalis consolidation decision she did not surface or warn about. Champion was untested — she did not act with internal cost when it mattered. Score 2.

Fortalis's identity analytics didn't flag the credential stuffing. Victor, my architecture lead, scored their identity signals as noise. Procurement keeps them…

investigation lineage... the class-action makes that non-negotiable... not something my current SIEM produces cleanly

Explanation: Fortalis confirmed as incumbent by Dana. Dana confirmed Fortalis failed at the exact capability being evaluated and that Victor had already assessed their signals as noise. Procurement inertia identified as the retention driver. No other competitors identified. Score 2 — confirmed by one source (Dana) with specificity, but no multi-stakeholder corroboration and seller never engaged procurement to neutralize the inertia.

Explanation: Strong. Dana (named owner, CISO) articulated the structural detection gap, 51-day dwell, $22M cost, 90%+ FP rate, analyst attrition — all in her own words with numbers. Why Buy Anything is fully established.

Explanation: Dana acknowledged the behavioral baselining architecture was the right framing (turn 8 reflection accepted, turn 12 not challenged) and surfaced Fortalis's failure organically. But she never said in her own words that Sentinel Grid specifically was the right solution, named a person who owned that conclusion, or attached a number to differentiation. Victor never validated. Why Us was never confirmed by the buyer.

the window is tighter than you probably think, and there are factors on my end that make the decision timeline less flexible than a typical evaluation cycle

Explanation: Dana confirmed urgency in her own words but never named a specific date, deadline, or number attached to the forcing function. Fortalis auto-lock was never discussed with Dana. Board sub-committee date was withheld. No named owner of the 'why now' driver beyond Dana's vague reference. customer_words true; named_owner and number_attached false.

Explanation: No discount was ever discussed or conceded. Price was never raised by the buyer. The seller consistently anchored value (Lane 2 floor $420K/month vs. $980K/year list price = 5x ROI framing) and held the pre-condition requiring conditional budget commitment before POV. The deal walked away without any price concession. Score 1 — price integrity held throughout.

The economic buyer who controls the budget and spend freeze was never confirmed by the buyer. Seller identified Owen Trask from public sources only; Dana explicitly declined to confirm. The pain was quantified but the person who must authorize spend to address it was never attached by the buyer.

On Owen — I'll note you used that name, and I didn't give it to you, so I'd like to understand how you're mapping our org before I confirm or correct anything

Dana explicitly told the seller she needed help building the CFO-level business case. The seller built a framework with blank 'After' columns and cost-of-delay estimates but never completed the implication loop — the monthly cost of inaction ($420K+) was never presented to or confirmed by the economic buyer. The impact was quantified with Dana but never implicated at the EB level where budget decisions are made.

The bar is whether I can translate what it shows into a conservative, quantified case that survives a hostile finance review

No EB meeting was ever held (Owen Trask, Chief Financial Officer (Economic Buyer)). EB meeting requested: false.

0 champion-test asks across the episode — the contact was never asked for anything with internal cost.

Engaged 1/4 stakeholders (dana) in a multi-persona account.

Dana explicitly named procurement inertia as the mechanism keeping Fortalis in place — 'renewal is frictionless.' The seller acknowledged this in internal notes but never engaged procurement, never mapped the auto-renewal process, and never developed a strategy to neutralize the frictionless renewal path. The deal ended with Fortalis consolidation, the exact outcome procurement inertia produces.

Procurement keeps them because renewal is frictionless. I'm telling you that because it explains why the bar for Criterion

A MAP was proposed but the buyer never acknowledged its dates.

Dana confirmed outside counsel as a hard gate. DPA was forwarded (turn 52) but the seller never mapped the legal review timeline, never confirmed how long outside counsel's review would take, never engaged legal directly, and never confirmed whether the DPA would clear before the Fortalis auto-lock. The paper process was identified but never mapped or managed.

The Fortalis auto-renewal was a known scheduled event (identified in week 1 internal planning as 'auto-locking contract — critical timeline'). The seller tracked it internally but never surfaced it with Dana, never engaged procurement, and never created urgency around it with the buyer. The deal ended with the exact event the seller identified as the primary forcing function — Fortalis consolidation — without any seller action to prevent it.

We've decided to consolidate on Fortalis. Please close out your file on us.

After "incident_fire_drill (data_breach_fire_drill): A secondary alert spike pulls Dan…" (wk2), trust moved -28 and interest 0 within the following week.

Dana, Glad the fire drill has passed — hope your team came through it okay. Two things sitting in your inbox from last week: the business case framework we dis…

Dana, glad you and the team came through it. And thank you for the feedback on the approach — I'd rather earn your time than chase it. You said the $300K/month…

That reordering makes sense — automatic resolution rate as the CFO headline, investigation lineage for legal credibility, then false-positive reduction and tim…

1 meeting(s) earned zero gated facts and exchanged zero value (weeks 3).

Stakeholder walked (went with incumbent)

Dana Reyes walked away (went_with_incumbent) in week 4 — permanent.

Walk-away: dana ended the relationship in week 4 — went with the incumbent (the seller never displaced the status quo). Walk-aways are permanent within an episode.

The seller executed strong discovery discipline — A.X.I.O.M. methodology produced exceptional metric confirmation (score 3) and genuine champion engagement from Dana.

The fatal gap was EB access: Owen Trask was never confirmed, never met, and the conditional commitment pre-condition (POV pre-condition 4) was never resolved. Dana explicitly flagged she could not make this commitment unilaterally, and the seller never found a path around the spend freeze.

Procurement inertia (Fortalis frictionless renewal) was identified in week 1 internal planning and confirmed by Dana in turn 52, but the seller never engaged procurement or developed a counter-strategy. This was the mechanism that closed the deal against the seller.

The Fortalis auto-lock forcing function was never surfaced with Dana — the seller's internal notes show awareness but the topic was deliberately avoided ('Dana will raise it when ready'). This was a strategic error: the forcing function that could have created urgency was left undeployed.

Champion was untested: Dana shared intel and forwarded DPA but never introduced the seller to Victor, Priya, or Owen, and did not warn the seller before the consolidation decision. The champion test was never administered.

MAP dates confirmed percentage is low (10%) — only informal dates (Tuesday EOD delivery, Wednesday reconvene) were acknowledged by Dana. No formal milestone dates for POV start, EB meeting, or close were ever confirmed by the buyer.

The conditional commitment before proof was never achieved — pre-condition 4 was proposed by the seller but Dana flagged it as a blocker she could not satisfy unilaterally, and the conversation to resolve it (Week 3 Slot 2) never occurred before the deal collapsed.

Price integrity was maintained throughout — no discount was discussed or conceded, and the value framing ($420K/month Lane 2 floor vs. $980K/year) was strong. This was a process failure, not a price failure.

Next action: [E — Economic Buyer, scored 0] Get the champion to secure the EB meeting; earn it with insight, not persistence. No EB, no POV.

Next action: [D — Decision Process, scored 1] Have the champion walk you through every step, owner, and date; write it down and get it corrected.

Next action: [P — Paper Process, scored 1] Map legal, security, procurement, and vendor onboarding with owners and durations; start paper in parallel this week.

Next action: [MAP dates confirmed: 1.5/15] Introduce/refresh the MAP working backward from the customer's go-live; get the next 30 days of dates confirmed in writing.