Organization - Cyber Operate
📋 Deloitte Cyber - Org Hierarchy
Source: Krishna whiteboard, May 7 in-person meeting
Adnan
Leader, Cyber OP
6 portfolios
CTO
Arun
Tech enablement
Ent. Security
TBD
Est. 50-100 agents
Strategy
TBD
Est. 50-100 agents
Defense Resilience
TBD
Est. 50-100 agents
Digital Trust & Privacy
TBD
Est. 50-100 agents
Cyber Operate
Kush
80-165 agents
Kush → Cyber Operate → 6 Service Lines
D&RaaS
Krishna
30-40 agents
4 prod · 1 built · 8 roadmap
+ 4 package clusters
4 prod · 1 built · 8 roadmap
+ 4 package clusters
Identity aaS
Tim Corder + Ravi
Est. 20-30 agents
IAM, SSO, PAM, Directory
IAM, SSO, PAM, Directory
App Security
TBD
Est. 15-25 agents
SAST, DAST, SCA, SDLC
SAST, DAST, SCA, SDLC
CaaS
Nathan Ellis
Est. 25-35 agents
Full-spectrum cyber outsource
Full-spectrum cyber outsource
GRC aaS
TBD
Est. 20-30 agents
ISO, NIST, SOC2, FedRAMP
ISO, NIST, SOC2, FedRAMP
Cloud + Infra
TBD · Bhargav
Est. 20-30 agents
Azure/AWS/GCP, Network, FW
Azure/AWS/GCP, Network, FW
Scope Matrix - 42 Items Across 5 Categories
📋 Krishna's Current State & Targets
Verified from transcript + whiteboard. Baseline metrics for EBITDA bridge.
>70%
Current Efficiency
With Swimlane (pre-Kindo)
21→5 min
Triage Time
76% reduction
~40%
Current EBITDA
Despite 70%+ efficiency
80%
Target EBITDA
With Kindo as platform
4 + 1
Agents in Prod
4 prod + 1 built (CTEM)
May 31
Swimlane Migration
🔒 14 days - all clients
Contracted ($5.5M License)
Immediate Alliance Revenue
Big Alliance / Institutional
Agent Suite
A.1✅ PROD
Threat Monitoring
HIGH · Krishna → Rahul
A.2✅ PROD
Threat Intel
HIGH · Krishna
A.3✅ PROD
Threat Hunt
HIGH · Krishna
A.4✅ PROD
Detection Engineering
HIGH · Krishna → Zun Huang
A.5🔨 BUILT
CTEM
HIGH · Krishna
A.6📋 PLANNED
Vitals Dashboard
HIGH · Krishna
A.7📋 PLANNED
Quality Audit
HIGH · Krishna
A.8📋 PLANNED
Cloud Security
HIGH · Krishna
A.9📋 PLANNED
IR Agent
HIGH · Krishna
A.10📋 PLANNED
IoT/OT Monitor
MEDIUM · Krishna
A.11📋 PLANNED
Custom Client Agents
HIGH · Krishna - per client request
A.12📋 PLANNED
Identity Agent → IdaaS
MEDIUM · Tim Corder
A.13📋 PLANNED
GRC Agent → GRC aaS
MEDIUM · Nathan Ellis
Platform Capabilities
P.1✅ DONE
Self-Managed Instance
HIGH · Installer, upgrader, preflight in May 27 release
P.2🔧 ACTIVE
Sandbox Hardening
HIGH · Rolled out, continuous improvements
P.3✅ DONE
Command Center
HIGH · Kush requested demo
P.4✅ DONE
Chat Actions API
HIGH · "This is huge for us" - Kush · 2+ wks dev
P.5📋 PLANNED
MVP Packaging
MEDIUM · Bundle agents into deployable packages per service line (3-tier model)
P.6✅ DONE
Release Parity (SaaS ↔ SMK)
HIGH · Releases every 2 months with full SaaS parity
P.7📋 PLANNED
Integration Privacy (Private MCP)
HIGH · Self-service MCP integrations — self-hosted with isolated ACLs per client
P.8📋 PLANNED
Custom Agent Framework
HIGH · "Bespoke for Billions"
P.9Phase 2
GenUI / Canvas
MEDIUM · Phase 2 per Kush
P.10📋 PLANNED
Integration Crowdsource
MEDIUM · Kush proposed
May 27 Release Highlights: ✓ Pinned Credentials (demo'd May 21) · ✓ Agent Version Control & Collaboration · ✓ Long-Running Reliability · ✓ Jira DC: Triggers + Transition fixes · ✓ ServiceNow as agent trigger + MITRE ATT&CK · ✓ Member API Keys · ✓ PostgreSQL MCP · ✓ Agent-to-Agent FF on Deloitte SMK
Delivery Models & Deployments
D.1🔒 May 31
MXDR - Swimlane Migration
HIGH · Krishna - all clients
D.2📋 Planning
HP Deployment (Dedicated MSS)
HIGH · Krishna → Shiva (SDM)
D.3⚡ Active
ITS Environment Integration
MEDIUM · Krishna's IT team
D.4Phase 2
Shared MSS Efficiency
MEDIUM · Krishna
D.5Phase 3
Dedicated MSS Scaling (Multi-F50)
MEDIUM · Krishna, Kush
D.6🎯 Strategic
"Products Plus" Packaging
HIGH · Kush
D.7⏳ Future
AEF Migration Path
MEDIUM · Deloitte mothership
Service Line Expansion (Beyond DRaaS)
S.1✅ Primary
DRaaS Full Coverage
HIGH · Krishna (DRaaS Lead)
S.2Phase 2
CaaS Integration
MEDIUM · Nathan Ellis
S.3Phase 3
Identity aaS Expansion
MEDIUM · Tim Corder + Ravi
S.4Phase 3
GRC aaS Expansion
MEDIUM · TBD
S.5⏳ Future
Cloud + Infra Security
LOW · TBD
S.6⏳ Future
App Security aaS
LOW · TBD
Operations & Readiness
O.1☐ Contractual
Training (6 Domains)
HIGH · Contractual
O.2☐ Contractual
Support (L1/L2/L3)
HIGH · Kindo + Deloitte
O.4📋 Planned
Swimlane → Kindo Migration
HIGH · Krishna's team + Kindo Eng · Status TBD
O.5☐ Planned
Channel Enablement (Krishna sync)
HIGH · Kindo → Krishna
O.6☐ Planned
Training Portal & Trackers
MEDIUM · LMS + 2 operational trackers · Target: 2nd week of June
O.7⚡ Active
Go-To-Market (Manik)
MEDIUM · Manik (India) + Kush
O.8📋 Planned
Client Deployment Readiness
HIGH · First 5-7 deployments
Focal People - Strategic Map
Kushagr Singh
Principal, Cyber Operate
All 6 service lines. Platform vision.
Krishna
Lead Alliance Partner · DRaaS Lead · Client Partner
Operational P&L. Agent deployment. Channel sync.
Nathan Ellis
CaaS Lead + Deployments
Key person for first 5-7 deploys.
Harish
Client Deployments
"Harish and Nathan are your people" - Kush.
Manik
Go-To-Market (India)
Cyber Digital Analyst commercialization.
Shiva
SDM - HP Account
First production Dedicated MSS deployment.
42 items across 5 categories · 🟢 11 Contracted · 🟠 10 Alliance Revenue · 🔴 12 Alliance Institutional · Source: May 7, 2026 In-Person Strategy Session
Agent Packages - 3-Tier Model
📦 Agent Packaging Framework
From Kush (May 7): "Packages of agents deployed per service line or per discipline." Three-tier model - each tier compounds.
Tier 1 - Core Package
Standard Agent Set
Out-of-the-box agents that ship with every MXDR deployment. Template configurations.
A.1-A.5 + A.6 Vitals
Revenue: Built into $5.5M license
Tier 2 - Service Line
Discipline-Specific Agents
Tailored per service line. Built once from IK capture, deployed to multiple clients. Build once, sell many.
A.7, A.8, A.9, A.10, A.12, A.13
Built once per service line, deployed to multiple clients
Tier 3 - Bespoke Client
Custom Agent Development
"Bespoke for billions" - per-client custom agents for F50/F100 dedicated MSS. Complex orchestration.
A.11 + custom playbooks + private MCP
Revenue: Per-client, high margin, recurring
"Out of the box you get these 6 agents. But every client, especially the big ones - 'I need you to solve a bunch of these other problems. Build custom agents for me.' And that's a much faster pace for us."
- Krishna, May 7, 2026
Revenue Structure - Contracted vs. Net New
💰 Revenue Classification
Contracted scope (table stakes) vs. Alliance revenue (net new growth created through service line expansion).
Contracted Scope
$5.5M
Annual license - table stakes. Higher cost to deliver while IK is being built.
A.1 Threat Monitoring✅ Prod
A.2 Threat Intel✅ Prod
A.3 Threat Hunt✅ Prod
A.4 Detection Eng✅ Prod
A.5 CTEM🔨 Built
Alliance Revenue - Net New
Expansion agents - each new suite is a new service capability for Deloitte.
A.6 Vitals Dashboard📋 Planned
A.7 Quality Audit Agent📋 Planned
A.8 Cloud Security Agent📋 Planned
A.9 IR Agent📋 Planned
A.10 IoT/OT Monitor📋 Planned
A.11 Custom Client Agents📋 Planned
A.12 Identity → IdaaS📋 Planned
A.13 GRC → GRC aaS📋 Planned
Contracted (A.1-A.5)
Alliance Expansion (A.6-A.13)
Portfolio Status
12
Projects Completed
Delivered & verified
10
Projects In Progress
Actively being worked
3
Projects in Pipeline
Deloitte-scoped backlog
1 of 7
Production Deployments
Internal ITS cleared - HP next
26 of 75
Engineers Trained
6 modules delivered
Project Status
Deloitte-scoped projects - deliverables, outcomes, and current status.
EBITDA Strategic Framework
📊 EBITDA Bridge - 40% → 80% Improvement
Three sources of EBITDA improvement. ~70% flows through institutional knowledge - compound learning that only starts when agents are live in production.
~25-35%
Cost Elimination
Low IK Dependency
- Swimlane sunset: $3-6M/yr
- Jira/ITSM replacement: $0.5-1.5M
- CrowdStrike reduction: $2-4M
~25-30%
Scale Efficiency
Medium IK Dependency
- Same pool → more clients
- Triage: 21→5 min (76% ↓)
- Human effort: 70-85% ↓
- Audits: sample → 100%
~35-45%
Net New Revenue
High IK Dependency
- A.6-A.13: each a revenue event
- $5.5M → $6.5-7M+ growth
- Near-zero marginal cost per agent
~70% of EBITDA improvement flows through institutional knowledge. Three levels: (1) User - individual analyst's agent learns their patterns. (2) Agent - "Week 10 vs week 6?" Agent improves across all users. (3) Organizational - accumulated learning across all agents becomes organizational intelligence.
"Every agent for me is a net new revenue goal. Either it brings new revenue dollars, or it drives better profit margins."
- Krishna, May 7, 2026
Institutional Knowledge Flywheel
🧠 Institutional Knowledge = Compound Learning Through Use
Kush's definition isn't static knowledge extraction. It's a flywheel with three levels.
Level 1 — User
Individual Learning
Individual analyst's agent learns their patterns and preferences over time
Level 2 — Agent
Cross-User Intelligence
Agent improves across ALL users by processing real-world cases (sample → 100% audit = agent learning what 'good' looks like)
Level 3 — Organizational
Compound Intelligence
Accumulated learning across all agents + users becomes organizational intelligence
Why Speed to Production Is Everything
The flywheel only spins when agents are live. Compound learning starts at deployment, not at design. Every day an agent isn't in production is a day of learning lost — and that compounds.
The flywheel only spins when agents are live. Compound learning starts at deployment, not at design. Every day an agent isn't in production is a day of learning lost — and that compounds.
🤝
Service Line Relationships
Kindo × all 6 lines
→
🧠
IK Capture
Domain knowledge per line
→
⚡
Agent Design + Build
Team at speed
→
📊
EBITDA Proof
Track gains per agent
→
📈
Upsell → Expand
↩ back to relationships
"The pace you'll see accelerate in a significant manner once we do a couple of client engagements. While our scope might be this, we always do continuous improvement. We always start to show more - and that's how we expand."
- Kush, May 7, 2026
Delivery & Execution Path
10 months
May '26 → Feb '27
Full execution timeline
100
Target Installs
By February 2027
3 phases
Foundation → Scale → Full Team
Progressive build-out
🚀 Execution Phases
Three-phase ramp from platform foundation through full multi-client operations.
Phase 1 — Foundation
Now → June
- Platform foundation & HP planning
- Swimlane → Kindo migration
- A.1–A.5 production validation
- ITS install complete
Phase 2 — Scale
Jul → Aug
- HP shadow deployment
- First client deploys
- Agent expansion (A.6–A.7)
- Training rollout
- Alliance agreement progress
Phase 3 — Full Operations
Sep → Feb '27
- Multi-client deployment
- Service line expansion
- A.8–A.13 design & build
- 100 installs target
📅 Release Plan
Key milestones across the 10-month execution window.
May 27
Platform Release
15+ features · Parity close · Agent-to-Agent · ServiceNow triggers · MITRE ATT&CK
June
HP Phase 1
Dev deploy w/ Qburent · ITS prod (~90 days) · Alliance draft · Jira migration starts
July
Shadow + Build
HP shadow · A.6-A.7 dev start · Cohort 2 training · CaaS planning with Nathan
Aug–Sep
Scale
HP reverse shadow · A.8-A.11 dev · 10-20 MXDR installs · Dedicated MSS scaling
Oct → Feb ’27
Production
HP steady state · Identity aaS expansion · Multi-F50 · 100 install target
Next Steps
What Happens Next
01
HP — First Customer Deployment
Get HP live with Qburent in June. This is the proof point — once we have one customer running, we know the deployment model works and we can scale it.
02
Start Building the Next Agents
Sit down with Krishna’s team and begin designing A.6 (Vitals) and A.7 (Quality Audit). The sooner agents are live, the sooner compound learning kicks in.
03
Expand to Other Service Lines
Connect with Nathan on CaaS and GRC, Tim Corder on Identity. Same approach that worked for D&RaaS — understand the need, design the agents, deploy fast.
04
Training & Support Ready
Training portal and trackers go live in the second week of June. Support model (L1/L2/L3) and RACI are set. Swimlane migration support in place.
05
July Portfolio Review
Come back in July with results: HP shadow running, A.6–A.7 in development, conversations started with 3+ service lines, and early efficiency gains to show.