Deep Dive · Risk & Outcomes

Security that reports in verbs, not noise.

A board does not want to hear that you processed three billion events last week. They want to hear that the four incidents that mattered were contained, eradicated, and recovered, with the times, the signatures, and the evidence the insurer and regulator will ask for already in the envelope. Edge is built around that reporting model.

The Outcome Framework

Every incident closes with a verb.

Traditional SIEM reports tell you what happened to the pipeline: events ingested, alerts triggered, rules tuned. Edge reports tell you what happened to the business. Every incident graduates through three verbs, each with a wall-clock time and a signed artefact.

Contained.

The blast radius stops growing.

Host isolation, credential lockout, session revocation, process kill, network segment quarantine. Time-to-containment is measured from the first triaged alert to the moment the adversary's reach is bounded. Insurers increasingly quote on this number.

Eradicated.

The adversary's foothold is removed.

Persistence mechanisms cleared, implants pulled, credentials rotated, malicious artefacts quarantined with signed hash. The eradication artefact lists every indicator, every system touched, and every remediating action with its operator.

Recovered.

Business function is fully restored.

Endpoints reimaged or cleared, services returned to production, users unblocked, monitoring uplift applied. Time-to-recovery is the number your CFO, board and cyber-insurer all ultimately care about. Edge records it as a first-class field on every case.

Time-to-Outcome

One number, tracked from first alert to business restored.

MTTD and MTTR are useful, but they stop at the wrong line. MTTD ends when you notice. MTTR ends when the alert is closed. Neither measures the gap that insurers and regulators actually price: the time your business was degraded. Edge records time-to-outcome on every incident, with full event-level reproducibility.

MTTD
Mean time to detect
MTTC
Mean time to contain
MTTE
Mean time to eradicate
MTTR
Mean time to recover

Each metric is a direct derivation of the verb lifecycle, broken out by business unit, severity band and attack category. Your CISO can report against the trend, your risk team against the variance, and your insurer against the commitment.

The board-ready one-pager

Four verbs. Four timings. One page. No event counts. No rule-tuning language. Edge produces this automatically per quarter, per business unit, per programme, signed and ready to include in the risk committee pack. The CISO stops writing the summary. The platform writes it.

Cyber-Insurer Integration

Evidence your underwriter can consume without translation.

Renewal season is now the most expensive quarter of the year for security teams. Underwriters increasingly want proof of control, not attestation. Edge's case package is designed to be handed over intact, with a signed manifest, zero post-processing, and every artefact an insurer's forensic panel will reasonably request.

What the case package contains

The renewal conversation, flipped

Insurers price on unquantified risk. When you can hand an underwriter a one-page outcome certificate that shows your last four incidents closed with a median time-to-containment of 11 minutes and a median time-to-recovery of 4 hours, the conversation stops being about premium scaling and starts being about deductible reduction. Customers on Edge typically see premium-retention benefits within the first renewal cycle.

Regulatory Alignment

Outcome reporting is what regulators are now asking for.

Every major financial, critical-infrastructure and health-sector regulator has pivoted in the last three years away from control-library compliance and toward operational resilience. They want to know whether you could contain, whether you could recover, and how long it took. Edge produces that evidence natively.

DORAEU Financial Services
Digital Operational Resilience Act, effective January 2025. Requires ICT incident classification, root-cause analysis, and significant-incident reporting within 24 hours. Edge's case package maps directly to DORA's major incident report schema, with the outcome certificate as the required "final report."
APRA CPS 230Australia Prudential
Operational risk management standard, effective July 2025. Requires APRA-regulated entities to notify of operational incidents within 72 hours and evidence restoration-time tolerances. Edge's time-to-recovery field is the direct measurement CPS 230 is asking for.
NIS2EU Cross-Sector
Network and Information Security Directive 2, transposed across EU member states since October 2024. Requires 24-hour early warning, 72-hour incident notification and one-month final report. Edge's verb lifecycle produces all three artefacts from a single case record.
HIPAAUS Healthcare
Security Rule and Breach Notification Rule. Covered entities must document "reasonable and appropriate" safeguards and report breaches within 60 days. Edge's signed manifest and immutable lineage provide the forensic chain of custody that OCR expects in post-breach review.
GDPR Art. 33EU Data Protection
Personal data breach notification within 72 hours. Edge's data-affected field is populated at containment time, not at report time, giving your DPO real numbers on the 72-hour clock, not a placeholder.
SEC 8-KUS Public Companies
Material cybersecurity incident disclosure rule, effective December 2023. Requires disclosure within four business days of materiality determination. Edge's outcome certificate gives the disclosure committee a defensible basis to decide.
The Economic Case

Outcome-led security, priced like commodity infrastructure.

The cost of traditional SIEM is not the licence. It is the way the licence grows with your data. Per-GB ingest, per-event pricing, per-analyst seat. Edge flips the economics. The platform is priced per endpoint, on open-core licensing your CFO can forecast against. At 500 endpoints, the difference is not single-digit percent. It is an order of magnitude.

Platform 500 endpoints, annual Includes
SIEMonster Edge from $22,788 Full platform, unlimited ingest, on-device AI, response agent
Splunk Enterprise Security $100K–$250K Licence + ingest + ES add-on; excludes infra
Microsoft Sentinel $120K–$300K Per-GB ingest; excludes connectors and Defender licensing
CrowdStrike NG-SIEM $150K–$280K Per-GB ingest + seat + agent; bundle pricing varies

The 70–90% delta is the baseline. The deeper cost advantage sits in infrastructure displaced: Edge's co-located storage removes the warehouse tier most traditional SIEMs require you to stand up, and the on-device AI removes the per-token inference spend that cloud analyst assistants are starting to accrue.

Risk-adjusted, not just price-adjusted

The platform saving is the visible line. The larger number is risk reduction: faster containment, demonstrable outcomes, a case pack the insurer can read. The combined effect is what lets CFOs sign the budget and risk committees sign the posture in the same quarter.