to Execution Plan
Connecting the May 7 strategy session to the delivery engine — framed for Ron, adaptable for Kush/Krishna next week.
Executive Summary
Deloitte Cyber Operate is rebuilding its entire delivery model around Kindo — not evaluating, committing. Krishna mapped Kindo into every delivery model and service line.
Why Now
- May 31: all non-contract MXDR → Kindo (Krishna directive)
- HP: first production client install — happening now
- Alliance agreement in progress — same tier as Google, SAP
- Mythos vulnerability wave — banks, healthcare, defense overwhelmed with newly discovered vulnerabilities need exactly these cybersecurity operational agents. Deloitte delivery = the forge where production-hardened agents for the Mythos response get built first
EBITDA Strategic Framework
40% → 80% improvementKindo Core Platform Team
Cost Elimination ~25–35%
Low Institutional Knowledge Dependency- Alliance contract — not controllable
- Swimlane + CrowdStrike sunset
Swimlane $3-6M/yr · Jira/ITSM $0.5-1.5M · CrowdStrike $2-4M = ~$5.5-11.5M/yr cost elimination
"Sunset Swimlane in every which capacity" — Krishna
Deloitte Rapid Response Team
Scale Efficiency ~25–30%
Medium Institutional Knowledge Dependency- Same pool → more clients
- Triage: 21→5 min (76% ↓)
- Human effort: 70–85% ↓
- Audits: sample → 100%
Deloitte Rapid Response Team
Net New Revenue ~35–45%
High Institutional Knowledge Dependency- A6–A13: each a revenue event
- $5.5M → $6.5–7M+ growth
Each agent (A.6-A.11) = new service capability = new billable offering. New revenue at near-zero marginal cost — the highest-margin source
"Every agent is a net new revenue goal — either new revenue dollars or better profit margins" — Krishna
"Speed is going to be the most essential thing for us"
Cost elimination depends on Kindo clean Self-Managed installs and training Deloitte on Kindo. But Scale Efficiency and Net New Revenue depend on custom configurations and mining new agent design/build opportunities.
Revenue Structure — Contracted vs. Net New
A1–A5: Contracted ($5.5M) — No Net New
Fulfill existing license. Cost us to deliver (IK transfer) but no incremental revenue.
| ID | Agent | Status | Model |
|---|---|---|---|
| A.1 | Threat Monitoring | PROD | MXDR |
| A.2 | Threat Intel | PROD | MXDR |
| A.3 | Threat Hunt | PROD | MXDR |
| A.4 | Detection Eng | PROD | MXDR |
| A.5 | CTEM | BUILT | MXDR |
A6–A13: Net New Revenue — Growth Engine
Each is a revenue event. Push $5.5M → $6.5–7M+. Justifies CDO role.
| ID | Agent | Status | Model | Ph |
|---|---|---|---|---|
| A.6 | Vitals Dashboard | PLAN | Cross | 2 |
| A.7 | Quality Audit | PLAN | Cross | 2 |
| A.8 | Cloud Security | PLAN | Ded/Sh | 3 |
| A.9 | IR Agent | PLAN | Ded/Sh | 3 |
| A.10 | IoT/OT | PLAN | Ded/Sh | 3 |
| A.11 | Custom Client | PLAN | Bespoke | 3 |
| A.12 | Identity→IdaaS | PLAN | New SL | 4 |
| A.13 | GRC→GRC aaS | PLAN | New SL | 4 |
Agent Packaging by Service Line
1. D&RaaS
- A.1–A.5 (4 PROD + 1 BUILT)
- A.6 Vitals, A.7 Audit, A.9 IR
- Serves: MXDR, Shared, Dedicated
2. CaaS
- Custom CaaS agents (TBD)
- A.13 GRC crossover
- Nathan owns first 5–7 deploys
3. Identity aaS
- A.12 Identity Agent
- J&J team (Adelina)
4. Cloud & Infra
- A.8 Cloud Security
- Firewall provisioning on Kindo
5. GRC aaS
- A.13 GRC Agent
- Compliance workflows
6. App Security
- TBD — Phase 4+
Platform Priorities — Critical
May 7 asks → current status1. Self-Managed Kindo Instance Stability
Ask: Click-click-click installs (was 3–5 days).
Now: 1st production Self-Managed Kindo install in Deloitte’s internal IT environment this week. Installer/upgrader/preflight in May 27 release. Observability MVP in final testing.
2. Release Parity (Cloud ↔ Self-Managed)
What this means: Kindo ships features to its cloud (SaaS) version first. Deloitte runs a Self-Managed instance on their own infrastructure. "Release Parity" = getting the same features on both versions at the same time. Kush keeps asking because Deloitte’s instance has been behind.
Ask: "You keep getting this question from me" — Kush
Now: May 27 release closes the gap with 15+ features shipping to Self-Managed: Chatbot APIs, Version Control, Pinned Credentials, ServiceNow integration, MITRE ATT&CK framework, Member API Keys. Biggest parity close yet.
3. Agent Memory & Self-Improvement
Ask: 3-layer compound learning (user → agent → org). "In Kindo, I did not see any of this stuff today."
Now: Not in May 27. Requires platform architecture. Risk: degrades compound learning in HP shadow.
4. Multi-Agent Orchestration
Ask: Supervisory triage agent calls Detection Engineering + Cyber Threat Intelligence sub-agents automatically.
Now: Agent-to-Agent feature flag enabled on Deloitte’s Self-Managed Kindo instance (calibrated rollout). General Availability gated on resource hardening.
Platform Priorities — High & Medium
May 7 asks → current status5. Integrations — MCP Ecosystem
Shipping May 27: ServiceNow triggers, MITRE ATT&CK, Dynamic API resolution
In review: SailPoint writes, PostgreSQL, Jira attachments
Urgent: Zscaler ZIA for May 27 demo; Swimlane fix (TEK-141)
6. Agent Reliability & DX
Done: Long-run reliability + Plan Mode, Agent Version Control (GitOps), Pinned Credentials, Error UX, Chat Actions API, Chatbot APIs
Backlog: Error messages (8798), re-run failed step (10190), resizable windows (9378), prompt filtering (9967)
7. Token / Cost Optimization
"$25K/month, 80% LLM" — Nathan. Four strategies planned: auto model selection, better context, structured memory, compaction. Not in May 27.
8. GenUI / Canvas
"Hold back on Canvas. We'll use TrueArch Hub." — Kush. Chat Actions API (shipping May 27) powers it. Kindo = backend/API.
HP Deployment RACI — Phase 1 & 2
First production client install (Dedicated MSS)R Responsible A Accountable C Consulted I Informed
| Activity | Krishna | Nathan | Kindo | Joana | Tony | Notes |
|---|---|---|---|---|---|---|
| Phase 1 — Installation & Document Ingestion | ||||||
| Self-Managed Kindo provisioning (Deloitte infrastructure) | A | R | R | C | I | Nathan + Brandon; AEF for prod |
| Security & NEC review | A | R | C | I | I | Nathan + Harish |
| D&RaaS agent deployment | C | A | R | C | I | Brandon + Marcos: A.1–A.5 |
| HP integrations (private MCP) | C | A | C | I | I | Robby's team; data stays in HP |
| ITSM ingestion (6 mo) | A | C | C | R | I | Warren + platform |
| SOP & doc ingestion | A | I | I | R | I | Joana + Warren |
| Phase 2 — Shadow (Parallel Operation) | ||||||
| Ticket mirroring | C | A | R | I | I | Kindo configures pipeline |
| Agent monitoring | C | I | I | R | I | Analysts + Warren compare |
| Human feedback | C | I | C | A | I | Feeds compound learning |
| Accuracy tracking | C | I | I | R | I | Vitals Dashboard proof points |
| Weekly review | A | C | I | R | C | Joana runs; Kush consulted |
HP Deployment RACI — Phase 3 & 4 + Risks
| Activity | Krishna | Nathan | Kindo | Joana | Tony | Notes |
|---|---|---|---|---|---|---|
| Phase 3 — Reverse Shadow (Agent-Primary) | ||||||
| Agent primary execution | A | C | R | I | I | Platform runs; Krishna to Kush |
| Human oversight (15%) | C | I | I | A | I | Shiva's analysts; Joana tracks |
| Validation (acc/compl/cons) | C | I | C | R | I | Warren + Audit Agent (A.7) |
| EBITDA tracking | C | I | I | R | A | Flows: us → Deloitte → client |
| Go/no-go steady state | R | C | C | C | I | Krishna recommends; Kush decides |
| Phase 4 — Steady State (Production) | ||||||
| Autonomous execution (70%) | A | I | R | I | I | Krishna owns outcomes |
| 100% audit coverage | A | I | R | C | I | Audit Agent (A.7) |
| EBITDA reporting | C | I | I | R | A | Proof points for upsell |
| Custom agent expansion | C | C | R | A | I | Warren + Kindo build |
Key Risks
| Risk | Impact | Mitigation | Owner |
|---|---|---|---|
| Platform stability | Blocks Ph 1 | Sandbox hardening; Nathan cleanup | Nathan + Brandon |
| Agent memory gap | Degrades learning | Manual IK during Shadow | Kush |
| Release parity | Limits visibility | May 27 release closes gap | Kindo Eng |
| AEF env decision | Delays provisioning | HP = prod = AEF | Nathan |
Current Operational Status
Week of May 19 — Three parallel workstreams toward May 31🔧 Platform
- Pinned Credentials LIVE
- Agent Version Control (GitOps)
- Chat Actions API
- Long-running reliability + Plan Mode
- ServiceNow triggers + Dynamic API
- MITRE ATT&CK
- Agent-to-Agent Feature Flag On
- Member API Keys (Self-Managed)
- Sandbox stability — final testing
- Self-Managed Kindo installer + Observability MVP
🚀 Deployments
- DONE 1st production Self-Managed Kindo install
- 🚨 May 31 — Swimlane migration
- HP planning next (Ded MSS, AEF)
- Target: repeatable install package
🎓 Training
- DONE Cohort 1 (26/31 attended)
- NEXT Cohort 2 (June 1st–2nd wk)
- Practitioner + Technical tracks
- 6 domains: Platform, Impl, Integrations, Governance, Use Case, Ops
- LMS + auto new-hire paths
Execution Timeline
- ✅ A.1–A.4 in production · A.5 built
- ✅ First Self-Managed Kindo production install
- ✅ May 27 release: 15+ features, agent-to-agent orchestration
- ✅ Training Cohort 1 (26/31)
- 🚨 Swimlane migration May 31
- 📋 HP deployment planning · Cohort 2 (June)
- HP Phase 1 (Self-Managed Kindo provisioning + doc ingestion)
- Alliance agreement draft contract
- MXDR efficiency data → proof points
- D&RaaS agent package finalized
- 2nd/3rd client ID from renewal pipeline
- HP Phase 2 (shadow — parallel operation)
- A.6 Vitals + A.7 Audit development
- CaaS integration planning (Nathan)
- 10–20 additional MXDR installs
- HP → steady state · A.8–A.11 dev
- Dedicated MSS scaling (multi-F50)
- Identity aaS expansion
- Target: 100 installs by February 2027
Kindo Team Considerations
Validate with Deloitte
- A1–A5 vs A6–A13 accurate against contract? ($5.5M = platform license)
- Platform blockers colliding with May 31?
- Krishna's directive aligns with deployment team tracking?
- HP timeline — when does Phase 1 provisioning start?
Agent Bundle Packaging — Feasibility
- Agent Version Control (GitOps) shipping May 27 — enables agent export/import
- Agents are configurations on the platform, not compiled code — packaging = productizing existing config patterns
- Integration patterns (ServiceNow, Splunk, ITSM) already built for Deloitte — templatize, not rebuild
- Kush already suggested "packages of agents per service line" (May 7) — Deloitte wants this for their own expansion
- Hard part is done: building and hardening agents in production. Packaging layer = product decision, not engineering moonshot
UNVERIFIED: Engineering effort estimate needs validation from Charlie/Brandon. Packaging layer itself is low-medium. Integration template QA per client vertical adds effort.
Pricing Premium — Pre-Configured Agent Bundles vs Platform-Only
Kindo can charge Aggressive pricing because there's a crisis AND because the Deloitte hardening gives Kindo a product that actually delivers at the speed the crisis demands.
Conservative Premium: 40–60%+
Pre-configured templates + integration patterns. Customer still customizes. Comparable to SOAR platform + content packs pricing (Palo Alto XSOAR, Swimlane Turbine bundles).
Target Package Premium: 60–100%+
Production-proven positioning at Deloitte. Battle-tested in F50 environment, not lab prototypes. Comparable to managed detection & response (MDR) vs self-managed EDR pricing.
Aggressive (Mythos crisis): 100–150%+
Speed premium during active vulnerability wave. Banks/healthcare under Mythos pressure can't wait months. "Deployed in days, not months." Comparable to incident response surge pricing.
Tier Progression = Deloitte Hardening Maturity
The tier progression is directly a function of how refined the Deloitte production implementation is:
- More hardened at Deloitte → faster deployment at new clients → charge more because time-to-value drops from months to days
- More refined remediation → better outcomes → premium justified by measurable threat reduction
- The speed of implementation at a new client is the pricing lever, and that speed is a direct output of institutional knowledge accumulated through Deloitte production
The tiers are both demand-driven (Mythos urgency, market panic) AND supply-driven (Deloitte hardening maturity). The supply side — how clean and repeatable the Deloitte-proven implementation is — is what actually unlocks the ability to charge at the higher tiers.
Revenue Opportunity for Kindo
| Scenario | Clients /yr | Bundle Premium | Avg Deal Size | Incremental Rev |
|---|---|---|---|---|
| Platform-only baseline | — | — | $500K–$2M | — |
| Conservative Premium (Deloitte service lines) | 3–5 | +50% | $750K–$3M | $1–5M |
| Target Package Premium (Deloitte + Mythos) | 5–10 | +75% | $875K–$3.5M | $2.5–12M |
| Aggressive Premium (Mythos surge) | 10–20 | +100–150%+ | $1–$5M | $5–25M |
UNVERIFIED: Deal sizes are structural estimates based on enterprise cybersecurity SOAR/MDR market comps ($826M→$1.7B SOAR market, MarketsandMarkets). Actual Kindo pricing needs validation from Ron/Kush. Client count scenarios are directional, not forecasted.
Mythos × Deloitte — Same Agents, Two Revenue Streams
Two-Tier Product Strategy
"There's a Venn diagram overlapping Mythos and Deloitte" — Tony, May 19
Tier 1: Platform-Only
Customer buys Kindo platform + training. Builds their own agents from scratch.
- Agent builder & orchestration engine
- Integration framework (MCP ecosystem)
- Self-Managed deployment
- Standard documentation & training
Customer starts from zero. Months to first production agent. Generic platform sale.
Tier 2: Deloitte-Hardened Agent Bundles
Kindo platform + pre-configured agent templates built from Deloitte production experience.
- Everything in Tier 1, plus:
- Pre-configured agent templates per use case
- Integration patterns already wired (ServiceNow, Splunk, ITSM)
- Decision logic & triage workflows tuned from real production
- Operational playbooks embedded from Deloitte deployment
- 3–6 months of accumulated judgment baked in
Days to first production agent. Battle-tested, not lab prototypes. Premium pricing.
The Differentiator: Deloitte Rapid Response Team
Value Chain
- 5 of 9 overlap agents already in production/built on Kindo
- Deloitte Rapid Response Team configures, deploys, hardens in real production
- Accumulated judgment from 3–6 months of live operation
- Agent configs, integration patterns, and playbooks packaged as templates
- Templates become the Kindo Mythos Response Product (Tier 2 pricing)
- Deloitte contract funds the R&D — Mythos product monetizes it at premium
Kush's Service Line Packaging (May 7)
Same template model extends across Cyber Operate portfolio:
- D&RaaS Bundle: A.1–A.5 + A.6 Vitals + A.7 Audit (Krishna)
- CaaS Bundle: Custom CaaS agents + A.13 GRC (Nathan Ellis)
- Identity aaS Bundle: A.12 Identity Agent (Tim Corder)
- Cloud & Infra Bundle: A.8 Cloud Security (Bhargav)
- GRC Bundle: A.13 GRC Agent + compliance workflows (Nathan)
- Mythos Response Bundle: A.1–A.5 + A.7 Audit + A.9 IR (cross-service)
Each bundle = a sellable product per discipline. Deloitte hardening = proof points for every bundle.
Reference: Scope Matrix v1.0
42-item scope: agents, platform, delivery, service lines, operations — with status, IK dependency, focal person.
Reference: Krishna D&RaaS Operational Map
Leadership, ops, service lines, agents, and Kindo integration points across Cyber Operate.
