(01)STACK BUILDER · DESIGN MODE

Three priced stacks, before you spend a dollar.

Name: CyberTwin
Brand: CyberTwin
Price: 4800 USD

Tell the engine your industry and size. It answers with Lean, Balanced and Advanced — real products at list prices, the architecture they form, and the order to deploy them. What you see below is one of 24 prebuilt sample profiles, modeled from those two questionnaire answers — no config is read. In the app the same engine models your answers to the full questionnaire.

INDUSTRY

COMPANY SIZE

Sample profile: a 200-person SaaS / Software company reporting against SOC 2. One of 24 prebuilt profiles, modeled from two questionnaire answers on an otherwise fixed sample company — no config was read. Your run models your own answers to the full questionnaire.

LEAN

Lean Beacon

The minimum a defensible program needs.

$79,843/yr · list · modeled

posture 35/100 modeledcoverage 91% of tier targets18 person-weeks

Microsoft Entra ID P1Identity$16,800
Microsoft SentinelSIEM$15,695
Veeam Data Platform FoundationBackup$4,650
AWS Amazon Inspector + AWS ConfigCloud-native security$6,000
Bitwarden EnterprisePassword management$14,400
SentinelOne Singularity CoreEndpoint$17,498
AWS GuardDuty + Security HubCloud-native security$4,800

LEFT OPEN

· Secrets scanning in source repos

Leaves 1 lower-priority capability uncovered at this tier: Secrets scanning in source repos.

7 PRODUCTS · LIST PRICES AS OF 2026-09-25

BALANCED · RECOMMENDED

Balanced Beacon

What most companies of this shape run.

$185,235/yr · list · modeled

posture 69/100 modeledcoverage 100% of tier targets29 person-weeks

Veeam Data Platform FoundationBackup$4,650
Microsoft Entra ID P2Identity$24,000
Huntress Managed EDRMDR$23,970
Microsoft SentinelSIEM$15,695
AWS Amazon Inspector + AWS ConfigCloud-native security$6,000
Microsoft Defender for Office 365 P2Email$12,000
Bitwarden EnterprisePassword management$14,400
Cloudflare WAFAppSec$2,400
AWS GuardDuty + Security HubCloud-native security$4,800
Rapid7 InsightVMVulnerability management$9,720
Cloudflare One Zero TrustZTNA$16,800
GitGuardian BusinessAppSec$22,000
Semgrep CloudAppSec$28,800

9 vendors in this stack, 7 of them new to this estate — each new one is another console, integration and renewal to run.

13 PRODUCTS · LIST PRICES AS OF 2026-09-25

ADVANCED

Advanced Beacon

Defence in depth for a mature program.

$286,679/yr · list · modeled

posture 87/100 modeledcoverage 93% of tier targets36 person-weeks

Microsoft Entra ID P2Identity$24,000
CrowdStrike Falcon CompleteMDR$81,340
Microsoft SentinelSIEM$15,695
Veeam Data Platform FoundationBackup$4,650
Microsoft Defender for Office 365 P2Email$12,000
Rapid7 InsightVMVulnerability management$9,720
Bitwarden EnterprisePassword management$14,400
Wiz Cloud Security PlatformCloud-native security$24,000
Delinea Secret Server CloudPAM$35,900
Cloudflare WAFAppSec$2,400
Veracode Application Security PlatformAppSec$23,774
Cloudflare One Zero TrustZTNA$16,800
GitGuardian BusinessAppSec$22,000

LEFT OPEN

· Data loss prevention with classification
· Offsite restore drills run at least quarterly

Exceeds the stated $250,000 budget ceiling by $36,679/year.

13 PRODUCTS · LIST PRICES AS OF 2026-09-25

ARCHITECTURE · WHERE EACH PRODUCT SITS

The Balanced stack, as a system

Every product docks into the zone it defends; the thin lines are telemetry into detection and response and the backup path out of Data. Empty zones are gaps this tier leaves open — named, not hidden.

THE PLAN · BALANCED TIER

13 steps, in the order that works

Identity before the tools that depend on it; logging before the tools that feed it. About 29 person-weeks end to end. 6 of the 13 steps ship with a CyberTwin playbook — configuration, prerequisites, validation, compliance side-effects; the rest link the vendor's own setup docs.

01Bitwarden EnterpriseBitwarden · Password management
1wVENDOR DOCS
02Semgrep CloudSemgrep · AppSec
1wVENDOR DOCS
03Cloudflare WAFCloudflare · AppSec
1wVENDOR DOCS
04BusinessGitGuardian · AppSec
1wVENDOR DOCS
05Defender for Office 365 P2Microsoft · Email
2wPLAYBOOK
06Microsoft Entra ID P2Microsoft · Identity
3wPLAYBOOK
07Huntress Managed EDRHuntress · MDR
2wVENDOR DOCS
08AWS GuardDuty + Security HubAWS · Cloud-native security
2wPLAYBOOK
+ 5 more in the full plan

LEFT AS IS · MODELED

Expected annual loss for this profile without a stack: $607K–$5.9M ○ range · MODELED · central $1.9M · from headcount

against $185,235/yr for the Balanced stack

Prices are vendor list prices, each verified on the date it carries (the oldest is 2026-09-25) — an estimate for budgeting, not a quote. A product with no published price is marked “not priced” and left out of the total, never counted as $0. Posture and dollars are modeled from the sample profile. Nothing here read a config or scanned anything: in the app the same engine models your questionnaire answers, and an uploaded config is graded separately, by config review. Coverage is scored against each tier's own target set — a richer tier aims at a broader one — so compare tiers on posture, the single ruler applied to all three.

(02)HOW IT DECIDES

Capabilities first. Products second. Prices last — and dated.

01 · REQUIRED

Your shape sets the requirements

Industry, headcount and the frameworks you report against decide which capabilities are must-have, should-have and nice-to-have — MFA on every admin account, managed detection, immutable backups. The tier is the depth you buy, not a different opinion.

02 · CATALOG

99 products, each with a cited price or a stated reason it has none

Every priced product carries its price source and the date it was verified (newest 2026-09-26), the capabilities it provides, and the alternatives that were considered. A product with no citable price (quote-only, or no longer sold) says so and stays out of the total — never counted as $0. The engine picks for fit and ecosystem — a Microsoft 365 company gets Entra and Defender, not a parallel identity stack.

03 · STATED

What each tier leaves open is printed

Unmet capabilities, each tier's trade-offs read from its own picks, the assumed products you already run, and a posture score with its modeled range — all labeled modeled, all in the report. 24 frameworks are scored from the same profile, no second questionnaire.

(03)FROM STACK TO RUNNING

The plan is the product, not a PDF of logos.

The Balanced stack comes with its deployment plan: the steps in dependency order, an effort estimate per step, and — where CyberTwin has written one — a setup guide with the settings to make, the prerequisites and the validation checks, and from Operate the compliance controls each step maps to. Every guide is a draft your team reviews, tests and applies; CyberTwin never changes anything on your systems. Steps without a guide link the vendor's own setup docs and say so.

Then you upload the configs of what you actually deployed, and config review grades what they really contain. The stacks above stay modeled: they are built from answers, not read from any config. Starting from requirements instead? In the app you can also design a target architecture for AWS, Azure, on-premises or hybrid — re-run through the attack-path engine, priced against your budget, with a draft FortiGate config to review. All of it is modeled.

ONE PLAYBOOK STEP · AS DELIVERED

02Microsoft Entra ID P2 — Conditional Access baseline3 person-weeks

Prerequisites: P2 licenses in scope, MFA enrolled, hybrid or Entra join, device compliance feeding Intune
Policies: block legacy authentication; require MFA for all users; require compliant device for admins; named locations
Validation: pilot group first — conditional-access misconfigurations lock people out
Maps to: SOC 2 CC6.1 · CC6.3 — noted on the step as a modeled mapping, not an audit result

Excerpt from the sample deployment plan (Balanced tier). Per-step compliance annotations ship on Operate and above; the plan itself on every plan.

(04)WHO BUILDS A STACK HERE

Four moments when the stack is the decision.

The first program

A startup hiring its first security lead, or a founder doing it themselves: a defensible baseline priced out in an afternoon, with the order to deploy it.

The rebuild

After an incident, a renewal shock or a failed audit — the current stack scored next to three alternatives, with what each one closes and what it leaves open.

The integration

Two companies, two stacks, one budget. Model each company as its own environment and put the two side by side before deciding what to keep (the side-by-side comparison is on Program).

The new CISO

Ninety days to a plan the board will fund. Three tiers, dollars attached, the roadmap sequenced — and a re-check each time an updated config is uploaded.

Build yours from your answers, not a fixture.

Assess includes the full intake, all three stacks, the architecture, the deployment plan, the upgrade roadmap and the report. No call required. The intake starts fresh — the industry and size you picked here aren't carried into it yet.

Start on Assess — build your stack →Read a finished report first →How every number is computed →