(01)STACK BUILDER · DESIGN MODE

Three priced stacks, before you spend a dollar.

Name: CyberTwin
Brand: CyberTwin
Price: 4800 USD

Tell the engine your industry and size. It answers with Lean, Balanced and Advanced — real products at list prices, the architecture they form, and the order to deploy them. What you see below is one of 24 prebuilt sample profiles, modeled from those two questionnaire answers — no config is read. In the app the same engine models your answers to the full questionnaire.

INDUSTRY

COMPANY SIZE

Sample profile: a 200-person Fintech / Payments company reporting against SOC 2, PCI DSS v4, ISO 27001. One of 24 prebuilt profiles, modeled from two questionnaire answers on an otherwise fixed sample company — no config was read. Your run models your own answers to the full questionnaire.

LEAN

Lean Beacon

The minimum a defensible program needs.

$79,843/yr · list · modeled

posture 28/100 modeledcoverage 63% of tier targets18 person-weeks

Microsoft Entra ID P1Identity$16,800
AWS GuardDuty + Security HubCloud-native security$4,800
Microsoft SentinelSIEM$15,695
Veeam Data Platform FoundationBackup$4,650
AWS Amazon Inspector + AWS ConfigCloud-native security$6,000
Bitwarden EnterprisePassword management$14,400
SentinelOne Singularity CoreEndpoint$17,498

LEFT OPEN

· Secrets scanning in source repos
· Cardholder Data Environment (CDE) network segmentation
· File-integrity monitoring on CDE systems
· Documented cardholder-data key management
· and 2 more

No 24x7 managed detection in this stack — after-hours incident response relies on your own team (declared on-call: business hours).

7 PRODUCTS · LIST PRICES AS OF 2026-09-25

BALANCED · RECOMMENDED

Balanced Beacon

What most companies of this shape run.

$216,335/yr · list · modeled · +1 not priced

posture 64/100 modeledcoverage 79% of tier targets33 person-weeks

Veeam Data Platform FoundationBackup$4,650
Microsoft SentinelSIEM$15,695
Microsoft Entra ID P2Identity$24,000
Huntress Managed EDRMDR$23,970
AWS GuardDuty + Security HubCloud-native security$4,800
GitGuardian BusinessAppSec$22,000
Semgrep CloudAppSec$28,800
Delinea Secret Server CloudPAM$35,900
Nightfall AIDLPnot priced
Rapid7 InsightVMVulnerability management$9,720
Microsoft Defender for Office 365 P2Email$12,000
AWS WAF + Shield StandardAppSec$3,600
Bitwarden EnterprisePassword management$14,400
Cloudflare One Zero TrustZTNA$16,800

LEFT OPEN

· Code-to-cloud appsec (SCA, SAST, IaC, container, runtime)
· Cardholder Data Environment (CDE) network segmentation
· File-integrity monitoring on CDE systems
· Documented cardholder-data key management
· and 2 more

1 pick is not priced (Nightfall AI) — the $216,335 total excludes it, so fitting the $250,000 budget ceiling is unconfirmed; each pick says why.

14 PRODUCTS · LIST PRICES AS OF 2026-09-25

ADVANCED

Advanced Beacon

Defence in depth for a mature program.

$291,479/yr · list · modeled

posture 72/100 modeledcoverage 81% of tier targets43 person-weeks

Veracode Application Security PlatformAppSec$23,774
Cloudflare WAFAppSec$2,400
GitGuardian BusinessAppSec$22,000
Microsoft Entra SuiteIdentity$28,800
Microsoft SentinelSIEM$15,695
CrowdStrike Falcon CompleteMDR$81,340
Veeam Data Platform FoundationBackup$4,650
Rapid7 InsightVMVulnerability management$9,720
Wiz Cloud Security PlatformCloud-native security$24,000
Microsoft Defender for Office 365 P2Email$12,000
Microsoft Purview Information Protection + DLPDLP$16,800
Bitwarden EnterprisePassword management$14,400
Delinea Secret Server CloudPAM$35,900

LEFT OPEN

· Offsite restore drills run at least quarterly
· Cardholder Data Environment (CDE) network segmentation
· File-integrity monitoring on CDE systems
· Documented cardholder-data key management
· and 2 more

Exceeds the stated $250,000 budget ceiling by $41,479/year.

13 PRODUCTS · LIST PRICES AS OF 2026-09-25

ARCHITECTURE · WHERE EACH PRODUCT SITS

The Balanced stack, as a system

Every product docks into the zone it defends; the thin lines are telemetry into detection and response and the backup path out of Data. Empty zones are gaps this tier leaves open — named, not hidden.

THE PLAN · BALANCED TIER

14 steps, in the order that works

Identity before the tools that depend on it; logging before the tools that feed it. About 33 person-weeks end to end. 6 of the 14 steps ship with a CyberTwin playbook — configuration, prerequisites, validation, compliance side-effects; the rest link the vendor's own setup docs.

01AWS GuardDuty + Security HubAWS · Cloud-native security
2wPLAYBOOK
02BusinessGitGuardian · AppSec
1wVENDOR DOCS
03Nightfall AINightfall · DLP
2wVENDOR DOCS
04Defender for Office 365 P2Microsoft · Email
2wPLAYBOOK
05Microsoft Entra ID P2Microsoft · Identity
3wPLAYBOOK
06Semgrep CloudSemgrep · AppSec
1wVENDOR DOCS
07WAF + Shield StandardAWS · AppSec
1wVENDOR DOCS
08Bitwarden EnterpriseBitwarden · Password management
1wVENDOR DOCS
+ 6 more in the full plan

LEFT AS IS · MODELED

Expected annual loss for this profile without a stack: $3.1M–$26.7M ○ range · MODELED · central $9.2M · from headcount

against $216,335/yr + 1 not priced for the Balanced stack

Prices are vendor list prices, each verified on the date it carries (the oldest is 2026-09-25) — an estimate for budgeting, not a quote. A product with no published price is marked “not priced” and left out of the total, never counted as $0. Posture and dollars are modeled from the sample profile. Nothing here read a config or scanned anything: in the app the same engine models your questionnaire answers, and an uploaded config is graded separately, by config review. Coverage is scored against each tier's own target set — a richer tier aims at a broader one — so compare tiers on posture, the single ruler applied to all three.

(02)HOW IT DECIDES

Capabilities first. Products second. Prices last — and dated.

01 · REQUIRED

Your shape sets the requirements

Industry, headcount and the frameworks you report against decide which capabilities are must-have, should-have and nice-to-have — MFA on every admin account, managed detection, immutable backups. The tier is the depth you buy, not a different opinion.

02 · CATALOG

99 products, each with a cited price or a stated reason it has none

Every priced product carries its price source and the date it was verified (newest 2026-09-26), the capabilities it provides, and the alternatives that were considered. A product with no citable price (quote-only, or no longer sold) says so and stays out of the total — never counted as $0. The engine picks for fit and ecosystem — a Microsoft 365 company gets Entra and Defender, not a parallel identity stack.

03 · STATED

What each tier leaves open is printed

Unmet capabilities, each tier's trade-offs read from its own picks, the assumed products you already run, and a posture score with its modeled range — all labeled modeled, all in the report. 24 frameworks are scored from the same profile, no second questionnaire.

(03)FROM STACK TO RUNNING

The plan is the product, not a PDF of logos.

The Balanced stack comes with its deployment plan: the steps in dependency order, an effort estimate per step, and — where CyberTwin has written one — a setup guide with the settings to make, the prerequisites and the validation checks, and from Operate the compliance controls each step maps to. Every guide is a draft your team reviews, tests and applies; CyberTwin never changes anything on your systems. Steps without a guide link the vendor's own setup docs and say so.

Then you upload the configs of what you actually deployed, and config review grades what they really contain. The stacks above stay modeled: they are built from answers, not read from any config. Starting from requirements instead? In the app you can also design a target architecture for AWS, Azure, on-premises or hybrid — re-run through the attack-path engine, priced against your budget, with a draft FortiGate config to review. All of it is modeled.

ONE PLAYBOOK STEP · AS DELIVERED

02Microsoft Entra ID P2 — Conditional Access baseline3 person-weeks

Prerequisites: P2 licenses in scope, MFA enrolled, hybrid or Entra join, device compliance feeding Intune
Policies: block legacy authentication; require MFA for all users; require compliant device for admins; named locations
Validation: pilot group first — conditional-access misconfigurations lock people out
Maps to: SOC 2 CC6.1 · CC6.3 — noted on the step as a modeled mapping, not an audit result

Excerpt from the sample deployment plan (Balanced tier). Per-step compliance annotations ship on Operate and above; the plan itself on every plan.

(04)WHO BUILDS A STACK HERE

Four moments when the stack is the decision.

The first program

A startup hiring its first security lead, or a founder doing it themselves: a defensible baseline priced out in an afternoon, with the order to deploy it.

The rebuild

After an incident, a renewal shock or a failed audit — the current stack scored next to three alternatives, with what each one closes and what it leaves open.

The integration

Two companies, two stacks, one budget. Model each company as its own environment and put the two side by side before deciding what to keep (the side-by-side comparison is on Program).

The new CISO

Ninety days to a plan the board will fund. Three tiers, dollars attached, the roadmap sequenced — and a re-check each time an updated config is uploaded.

Build yours from your answers, not a fixture.

Assess includes the full intake, all three stacks, the architecture, the deployment plan, the upgrade roadmap and the report. No call required. The intake starts fresh — the industry and size you picked here aren't carried into it yet.

Start on Assess — build your stack →Read a finished report first →How every number is computed →