Incorporating Tony's strategic framework + Joana's execution plan. Framed for Ron.
Alliance agreement in progress — once locked, other firms can't replicate the embedded position. But only while Deloitte is the sole enterprise deployment partner.
May 31 Swimlane migration, HP install, Mythos vulnerability wave — first mover with production agents wins. The market won't wait.
Compound learning starts only when agents are live in production. Every week of delay = competitors close the gap.
Swimlane $3-6M/yr · Jira/ITSM $0.5-1.5M · CrowdStrike $2-4M = ~$5.5-11.5M/yr cost elimination
Each agent (A.6-A.11) = new service capability = new billable offering. New revenue at near-zero marginal cost
Cost elimination depends on Kindo clean Self-Managed installs and training Deloitte on Kindo. But Scale Efficiency and Net New Revenue depend on custom configurations and mining new agent design/build opportunities.
Fulfill existing license. Cost us to deliver (IK transfer) but no incremental revenue.
Each is a revenue event. Push $5.5M → $6.5-7M+. Justifies CDO role.
Institutional knowledge ≠ static knowledge extraction. Kush's definition = compound learning through use. This is a flywheel, not a one-time transfer.
Individual analyst's agent learns their patterns and preferences over time
"Week 10 vs week 6?" — Kush
Agent improves across all users by processing real-world cases
Accumulated learning across all agents becomes organizational intelligence
"There's a Venn diagram overlapping Mythos and Deloitte" — Tony, May 19
Customer buys Kindo platform + training. Builds their own agents from scratch.
Customer starts from zero. Months to first production agent. Generic platform sale.
Kindo platform + pre-configured agent templates built from Deloitte production experience.
Days to first production agent. Battle-tested, not lab prototypes. Premium pricing.
Same template model extends across Cyber Operate portfolio:
Each bundle = a sellable product per discipline. Deloitte hardening = proof points for every bundle.
Pre-configured templates + integration patterns. Comparable to SOAR platform + content packs pricing.
Production-proven at Deloitte. Battle-tested in F50 environment. Comparable to MDR vs self-managed EDR.
Speed premium during active vulnerability wave. "Deployed in days, not months." IR surge pricing.
| Scenario | Clients /yr | Bundle Premium | Avg Deal Size | Incremental Rev |
|---|---|---|---|---|
| Platform-only baseline | - | - | $500K-$2M | - |
| Conservative Premium (Deloitte service lines) | 3-5 | +50% | $750K-$3M | $1-5M |
| Target Package Premium (Deloitte + Mythos) | 5-10 | +75% | $875K-$3.5M | $2.5-12M |
| Aggressive Premium (Mythos surge) | 10-20 | +100-150%+ | $1-$5M | $5-25M |
UNVERIFIED: Deal sizes are structural estimates based on enterprise cybersecurity SOAR/MDR market comps ($826M→$1.7B SOAR market, MarketsandMarkets). Actual Kindo pricing needs validation from Ron/Kush. Client count scenarios are directional, not forecasted.
Think: former SOC analyst who learns the Kindo platform
Builds the plumbing connecting agents to client systems
7-person commitment: Tony, Joana, Victor, Charlie, Dukane, Agent Designer, Engineer. Warren comes with the package. Phase growth: 3 engineers → 5 + delivery lead → 10 + team.
Move beyond A.1-A.5 contracted scope into A.6-A.13 net new revenue. Revenue trajectory: $5.5M → $1-2M+ net new → $5-12M+ upside (2-3× expansion). Share of net new revenue that T&C creates through the alliance expansion.
Operating partner for the engagement. The only person who can acquire the institutional knowledge that 55% of scope depends on. CDO role = learning loop accelerator for the ~70% of EBITDA improvement that flows through IK.
May 31 Swimlane AI migration → HP deployment → 100 installs by Feb 2027. "Speed of engagement > depth of engagement." The exclusivity window closes when competitors catch up.
Ask: Click-click-click installs (was 3-5 days).
Now: 1st production Self-Managed Kindo install in Deloitte's internal IT environment this week. Installer/upgrader/preflight in May 27 release. Observability MVP in final testing.
What this means: Kindo ships features to cloud first. Deloitte runs Self-Managed. "Release Parity" = same features on both at the same time.
Ask: "You keep getting this question from me" — Kush
Now: May 27 release closes the gap with 15+ features shipping to Self-Managed: Chatbot APIs, Version Control, Pinned Credentials, ServiceNow integration, MITRE ATT&CK, Member API Keys. Biggest parity close yet.
Ask: 3-layer compound learning (user → agent → org). "In Kindo, I did not see any of this stuff today."
Now: Not in May 27. Requires platform architecture. Risk: degrades compound learning in HP shadow.
Ask: Supervisory triage agent calls Detection Engineering + Cyber Threat Intelligence sub-agents automatically.
Now: Agent-to-Agent feature flag enabled on Deloitte's Self-Managed Kindo instance (calibrated rollout). General Availability gated on resource hardening.
Shipping May 27: ServiceNow triggers, MITRE ATT&CK, Dynamic API resolution
In review: SailPoint writes, PostgreSQL, Jira attachments
Urgent: Zscaler ZIA for May 27 demo; Swimlane fix (TEK-141)
Done: Long-run reliability + Plan Mode, Agent Version Control (GitOps), Pinned Credentials, Error UX, Chat Actions API, Chatbot APIs
Backlog: Error messages (8798), re-run failed step (10190), resizable windows (9378), prompt filtering (9967)
"$25K/month, 80% LLM" — Nathan. Four strategies planned: auto model selection, better context, structured memory, compaction. Not in May 27.
Now: "Hold back on Canvas. We'll use TrueArch Hub." — Kush. Chat Actions API (shipping May 27) powers it.
But: Kush calls Canvas/UX "uber uber important" for the long-term vision — making Kindo the "everyday workbench for the entire security organization." Deprioritized for Phase 1-2; strategic priority for Phase 3-4 CISO-level engagement.
R Responsible A Accountable C Consulted I Informed
| Activity | Krishna | Nathan | Kindo | Joana | Tony |
|---|---|---|---|---|---|
| Ph 1 — Installation & Doc Ingestion | |||||
| SMK provisioning (AEF) | A | R | R | C | I |
| Security & NEC review | A | R | C | I | I |
| D&RaaS agent deployment (A.1-A.5) | C | A | R | C | I |
| HP integrations (private MCP) | C | A | C | I | I |
| ITSM + SOP ingestion | A | I | C | R | I |
| Ph 2 — Shadow (Parallel Operation) | |||||
| Ticket mirroring + monitoring | C | A | R | R | I |
| Human feedback + accuracy tracking | C | I | C | A | I |
| Weekly review | A | C | I | R | C |
| Ph 3 — Reverse Shadow (Agent-Primary) | |||||
| Agent primary + 15% human oversight | A | C | R | A | I |
| Validation + EBITDA tracking | C | I | I | R | A |
| Go/no-go steady state | R | C | C | C | I |
| Ph 4 — Steady State (Production) | |||||
| Autonomous execution (70%) + 100% audit | A | I | R | C | I |
| EBITDA reporting + custom expansion | C | C | R | A | A |
Tony (strategy / IK) · Joana (program) · Charlie (architecture) + Warren
Now → June · Platform foundation + HP planning
+ Victor (product) · Dukane (delivery) · Delivery Lead
Jul → Aug · HP shadow + first client deploys
+ Agent Designer · Engineer · 2 additional · Full support org
Sep → Feb '27 · Multi-client + alliance expansion
Think: former SOC analyst who learns the Kindo platform
"In Kindo, I did not see any of this stuff today." — Kush
42-item scope: agents, platform, delivery, service lines, operations — with status, IK dependency, focal person.
Leadership, ops, service lines, agents, and Kindo integration points across Cyber Operate.