June 2022

The Total Economic Impact™ Of Of CrowdStrike Falcon LogScale

Cost Savings And Business Benefits Enabled By Falcon LogScale

CrowdStrike logo

A Forrester Total Economic Impact™ Study Commissioned By CrowdStrike, June 2022

Table Of Contents

As a result of rapid, global digitalization, today’s enterprises are ingesting an ever-increasing amount of data and require effective tools for ingesting, logging, organizing, monitoring, and querying event-based information in real time. Falcon LogScale offers these capabilities in a cloud, multicloud, or hybrid platform, promoting efficiencies, reducing security risk, and helping organizations deliver a high return on investment.

CrowdStrike Falcon LogScale, formerly known as Humio provides enterprises with a fast, cost-effective, cloud-based platform to log, monitor, query, and access all event data from systems, networks, and applications, enabling IT departments to eliminate blind spots and prevent outages and performance degradation issues in real time. With an extremely fast log-and-search system at any scale, teams can quickly identify and remedy infrastructure performance and security incidents that occur, resulting in operational efficiency gains, lower risk exposure, and an improved overall mean-time-to-resolution (MTTR). This delivers real-time insights while improving business performance.

CrowdStrike commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying Falcon LogScale.1 The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of Falcon LogScale on their organizations.

To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed five enterprise representatives with experience using Falcon LogScale. For the purposes of this study, Forrester aggregated the interviewees’ experiences and combined the results into a single composite organization, a financial services company that generates revenue of $5 billion per year and ingests 5 terabytes (TB) of data per day.

icon
Optimization of resolution time:
$4.3 million

Prior to using Falcon LogScale, these interviewees reported that their organizations were managing data with a combination of logging and monitoring tools and were limited as to how much data they could ingest and process daily. The inability to access and see all relevant data presented an unacceptable amount of risk to the organizations. And, due to technical limitations and economic considerations such as expensive storage, licensing, human capital costs, and maintenance and computing costs, scalability and speed was impracticable.

After the investment in Falcon LogScale, the interviewees consolidated their data logging and monitoring toolsets and scaled the amount of daily ingested data without adding infrastructure costs. Falcon LogScale allowed for improved data fidelity from source to target, and an index-free architecture that removed the need to deduplicate data, which minimized storage and computing costs. With improved visibility and real-time speed from Falcon LogScale, the interviewees reduced time to identify and resolve performance and security issues, thereby improving security postures, breaking down silos, and gaining back time for their DevOps, security operations (SecOps), and IT operations (ITOps) teams.

Consulting Team:
  • Rachel Ballard, Henry Huang

Key Statistics

  • icon
    ROI
    210%
  • icon
    Benefits PV
    $9.88M
  • icon
    NPV
    $6.69M
  • icon
    Payback
    <6 months

Key Findings

Quantified benefits. Three-year, risk-adjusted present value (PV) quantified benefits for the composite organization include:

  • Optimization of resolution time.

    Falcon LogScaleallows direct access to all logged data in real time with a greater portion of it available in “hot,” or instantly accessible storage. Rather than waiting for information to traverse through multiple tools and different storage mediums, the IT team and security investigators immediately see and assess relevant data. Historical data is also easily and quickly searchable with the Falcon LogScaleplatform, saving considerable time when identifying the root cause of incidents. The total risk-adjusted efficiencies the composite organization gains due to resolution time savings results in a PV of $4.3 million over three years.

  • Logging storage and compute optimization.

    The composite organization channels data from applications and other deployments to Falcon LogScalewithout having to build, aggregate, and configure at the application level. Falcon LogScalehandles structured, semistructured, and unstructured logs, automatically parsing data according to the user’s query configuration. Falcon LogScaleprocesses large amounts of information quickly due to its data compression technique, allowing users to manage more logged data while reducing storage and computing costs. The three-year, risk-adjusted PV savings due to consolidation of logging solutions totals $1.5 million for the composite.

  • Developer workback time gained.

    Falcon LogScale allows DevOps, ITOps, and SecOps teams to quickly access needed data with its live-tailing and aggregation capabilities, allowing developers to focus on higher value tasks. The total risk-adjusted PV of developer workback time gained equals $1.7 million over three years.

  • Operational engineers reassigned within organization.

    With increased ingestion rates, rapid compression rates, and real-time visibility, Falcon LogScale promotes operational efficiencies, freeing up internal resources for other projects. The composite organization no longer requires the dedicated time of engineers to manage and maintain their sprawl of logging and monitoring tools. The three-year, risk-adjusted PV savings totals $473,000.

  • Retained profit from outage reductions and degradations.

    A lack of IT system visibility creates outages of greater magnitudes, which is costly from a revenue perspective, as during an outage or performance issue, customers abandon sites and balk, leading to lost profit. Improved visibility allows teams to eliminate infrastructure blind spots and prevent outages, while also lowering the risk of losing customer revenue, resulting in a risk-adjusted PV of $1.9 million over three years for the composite.

Unquantified benefits. Benefits that are not quantified in this study include:

  • Scalability and agility.

    In their legacy environments, the interviewees’ organizations required a significant amount of engineering work when it was necessary to increase capacity. This was both time-consuming and costly. The ability to process more information with fewer resources, while reducing the storage needed, allows organizations to quickly respond to their changing needs in an economically feasible manner.

  • Streaming observability.

    As Falcon LogScale allows users to rapidly ingest data from a large variety of sources, a team can see log information that was not available in its legacy environment. The ability to easily add and design data sources to flow through Falcon LogScale enables organizations to maintain accurate logs, which in turn provides teams with the ability to quickly identify and apply preventative infrastructure remediations.

  • Time savings to integrate new data sources.

    With approachable API endpoints, Falcon LogScale seamlessly integrates with multiple data sources, including existing tech stacks, other third-party platforms, and internal custom solutions. There is rarely need for extra support or professional services when adding additional data sources.

  • Improved audit and regulatory compliance.

    Falcon LogScale allows organizations to recreate incidents and events at any given moment, making regulatory compliance and audits a less daunting process.

Costs. Three-year, risk-adjusted PV costs for the composite organization include:

  • Annual license cost.

    The composite organization ingests 5 TB per day and pays a fixed, three-year contract price of $1.3 million per year, equaling a three-year PV of $3.1 million.

  • Initial and ongoing costs.

    Initial costs for the composite organization include internal engineering hours required for implementation. Ongoing management represents the effort required to maintain the platform. The risk-adjusted PV of initial and ongoing costs totals $77,000 over three years.

    The representative interviews and financial analysis found that a composite organization experiences benefits of $9.88 million over three years versus costs of $3.19 million, adding up to a net present value (NPV) of $6.69 million and an ROI of 210%

“Before adopting [Humio], developers would have to ask the ITOps team for logs needed for analysis. It would sometimes take days or even weeks. Now, they have access to everything they need in seconds. The whole value we get from the tools in Falcon LogScale is priceless.”

Product owner, banking

Benefits (Three-Year)

TEI Framework And Methodology

From the information provided in the interviews, Forrester constructed a Total Economic Impact™ framework for those organizations considering an investment in Falcon LogScale.

The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Forrester took a multistep approach to evaluate the impact that Falcon LogScale can have on an organization.

  • icon
    DUE DILIGENCE

    Interviewed CrowdStrike stakeholders and Forrester analysts to gather data relative to Humio.

  • icon
    INTERVIEWS

    Interviewed five representatives at organizations using [Humio] to obtain data with respect to costs, benefits, and risks.

  • icon
    COMPOSITE ORGANIZATION

    Designed a composite organization based on characteristics of the interviewees’ organizations.

  • icon
    FINANCIAL MODEL FRAMEWORK

    Constructed a financial model representative of the interviews using the TEI methodology and risk-adjusted the financial model based on issues and concerns of the interviewees.

  • icon
    CASE STUDY

    Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks. Given the increasing sophistication of ROI analyses related to IT investments, Forrester’s TEI methodology provides a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology.

DISCLOSURES

Readers should be aware of the following:

This study is commissioned by CrowdStrike and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis.

Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the study to determine the appropriateness of an investment in Falcon LogScale.

CrowdStrike reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester’s findings or obscure the meaning of the study.

CrowdStrike provided the customer names for the interviews but did not participate in the interviews.

NEXT SECTION: The Falcon LogScale Customer Journey

Total Benefits

Role Industry Description
Manager, technical infrastructure Fintech HQ in Europe with global operations
Senior engineer, SecOps Financial services 25,000 employees
VP, cloud operations Software $15 billion to $20 billion in total revenue
CTO Banking Using the cloud for all data logging
Product owner Banking 600 engineers using Falcon LogScale
“We used to have a couple of applications running to build up an aggregate of data, then pump it into the final logging system. With Falcon LogScale, I don’t need that. I just set up the data fire hose and let Falcon LogScale do all the processing. This has allowed me to remove a lot of complexity from my stack.”

CTO, banking

Key Challenges

Prior to implementing Falcon LogScale, the interviewees’ organizations managed their log data with a combination of in-house and third-party solutions. They did not have the ability to increase ingested information without significant economic impact, and the data they collected was not always adequately parsed or accessible. Increasing data capacity was always a concern as it required a considerable financial investment and IT engineering resources across geographically distributed locations. With this lack of data accessibility and visibility, they experienced frequent outages and faced an uncomfortable level of associated risk exposure. When incidents did occur, the remediation process was time-consuming, costly, and frustrating. The interviewees sought a single, streamlined platform with automated logging and monitoring that would mitigate their challenges.

The interviewees noted how their organizations struggled with common challenges, including:

  • Rising costs for data ingestion and storage.

    Before deploying Falcon LogScale, teams struggled with the increasing cost of ingesting data coupled with the prohibitive cost of storing data, especially as the need for both was growing to satisfy internal service-level agreement (SLA) goals and regulatory requirements. Due to the multitude of data centers and data storage locations, scaling data and compute resources was complex and difficult to execute quickly.

  • Inability to integrate data from a variety of sources.

    The legacy solutions lacked universal compatibility with new data sources, and organizations were unable to onboard all sources that required log management and monitoring. To avoid leaving holes in the aggregate data, extra engineering work and infrastructure investment were often necessary to expand data accessibility and visibility.

  • Lack of scalability and flexibility.

    The interviewees’ organizations’ previous solutions were limited in functionality. Without increasing dedicated human capital and computing resources, scalability was not feasible. They needed a more robust platform that allowed for real-time customization as their data needs changed.

“There is significant savings in terms of growth because Falcon LogScale’s technology footprint, and TCO [total cost of ownership] is way, way smaller than the competition. We can grow without incurring excessive costs.”

Manager technical infrastructure, financial

Solution Requirements/Investment Objectives

The interviewees’ organizations searched for a solution that could:

  • Deploy easily and quickly while integrating with existing and other third-party solutions.
  • Reduce storage costs and its daily per-TB ingestion cost
  • Enhance data collection, alert, and search capabilities, resulting in fewer infrastructure performance issues and outages.
  • Serve as a data lake with easy access for retrieval and analysis.
  • Provide a reliable, cloud-based solution with fewer maintenance requirements.
  • Be scalable and agile, increasing visibility to avoid infrastructure and security incidents and events.

Composite Organization

Based on the interviews, Forrester constructed a TEI framework, a composite company, and an ROI analysis that illustrates the areas financially affected. The composite organization is representative of the five interviewees, and it is used to present the aggregate financial analysis in the next section. The composite organization has the following characteristics:

  • Description of composite.

    The composite is a global financial services organization with $5 billion in annual revenue with 12,000 employees and 3,000 engineers.

  • Deployment characteristics.

    The composite organization seeks a cloud-based, consolidated solution to improve the speed of data retrieval and increase its daily ingestion rate from 3 TB per day to 5 TB per day, while significantly reducing data storage and computing costs. Increasing data ingestion and accessibility results in internal efficiencies, productivity gains, and retained profits.

Key assumptions
  • $5B revenue
  • 12,000 employees
  • Daily ingestion from 3 TB/day to 5 TB/day
  • 3,000 engineers access Falcon LogScale
  • Major outages reduced by 50%
  • Annual license cost is $1.25M
NEXT SECTION: Analysis Of Benefits

Total Benefits

Ref. Benefit Year 1 Year 2 Year 3 Total Present Value
Atr Optimization of resolution time $1,748,304 $1,748,304 $1,748,304 $5,244,913 $4,347,774
Btr Logging storage and compute optimization $652,800 $518,976 $622,771 $1,794,547 $1,490,258
Ctr Developer workback time gained $669,780 $669,780 $669,780 $2,009,340 $1,665,644
Dtr Operational engineers reassigned within organization $190,190 $190,190 $190,190 $570,570 $472,974
Etr Retained profit from outage reductions and degradations $686,198 $766,992 $854,150 $2,307,340 $1,899,430
Total benefits (risk-adjusted) $3,947,272 $3,894,243 $4,085,196 $11,926,711 $9,876,080

Optimization Of Resolution Time

  • Evidence and data.

    The interviewees revealed the following about their organizations’ use of Falcon LogScale:

    • Falcon LogScale allowed the interviewees’ organizations to manage far more data more efficiently and with much lower operational and infrastructure costs. Data was collected, logged, and accessible in real time, greatly reducing the time needed to investigate and resolve potential infrastructure performance and security issues. A CTO commented: “With Falcon LogScale, we are able to get an aggregate view of all our systems. The flexibility of the tool is much better than the tooling we had before. It allows us to get the information we need when we need it.”
    • Postdeployment, interviewees reported experiencing fewer outages and less downtime. A manager of technical infrastructure in fintech noted: “In our previous situation, the frequent outages and downtime were causing disruption and lack of productivity for a lot of the engineers. These costs were fairly high.” With Falcon LogScale, the technical team could easily see issues and find resolution.
  • Modeling and assumptions.

    For the financial analysis, Forrester assumes:

    • The composite organization experiences two outages or performance degradations per day in its previous environment.
    • Postdeployment, a DevOps, ITOps, or SecOps analyst earns $55 per hour and saves 30 minutes per outage to resolve.
    • The organization incurs an annual internal productivity loss of $12,600 due to outage downtime.
    • The organization faces two security incidents involving logs per day.
    • Postdeployment, a cybersecurity analyst earns $59 per hour and saves one hour per security incident to resolve.
    • A 50% productivity capture is applied.
  • Risks.

    The optimization of resolution time will vary with:

    • The volume of data ingested by the organization.
    • The number of outages and security incidents realized in the legacy environment.
    • Hourly rates, depending on skill level and geographical location.
  • Results.

    To account for these risks, Forrester adjusted this benefit downward by 25%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $4.3 million.

Optimization Of Resolution Time

Ref. Metric Source Year 1 Year 2 Year 3
A1 Infrastructure performance degradation and outage incidents before Falcon LogScale 2 per day*365 days 730 730 730
A2 Hours saved per infrastructure performance degradation or outage incident after Falcon LogScale Interviews 0.5 0.5 0.5
A3 Hourly rate of operations analyst TEI standard $55 $55 $55
A4 End-user productivity loss due to infrastructure performance degradation and outages 3%*12,000 total employees impacted*$35 per hour $12,600 $12,600 $12,600
A5 Subtotal: Improvement in infrastructure performance and MTTR A1*A2*(A3+A4) $4,619,075 $4,619,075 $4,619,075
A6 Security incidents involving logs 2 per day*365 days 730 730 730
A7 Hours saved per security incident involving logs Interviews 1 1 1
A8 Hourly rate of cybersecurity operations analyst TEI standard $59 $59 $59
A9 Subtotal: Improvement in security-related MTTR A6*A7*A8 $43,070 $43,070 $43,070
A10 Productivity capture TEI standard 50% 50% 50%
At Optimization of resolution time (A5+A9)*A10 $2,331,073 $2,331,073 $2,331,073
Risk adjustment ↓25%
Atr Optimization of resolution time (risk-adjusted) $1,748,304 $1,748,304 $1,748,304
Three-year total: $5,244,913 Three-year present value: $4,347,774

Logging Storage And Compute Optimization

  • Evidence and data.

    The interviewees revealed the following about their organizations’ use of Humio:

    • Humio offered users efficient data compression, allowing for significant reduction in the need for storage space and maintenance. Interviewees reported spending less on infrastructure, hardware, and maintenance. A VP of cloud operations mentioned: “Apart from just the efficiency, we have been able to decrease the resource usage in terms of the number of nodes needed. We have reduced our costs considerably by using Falcon LogScale.”
    • The seamless implementation and integration with a large variety of data sources provided interviewees’ organizations with access to more information. Not only was information available in real time, but the cost per terabyte made the increased collection more financially feasible.
  • Modeling and assumptions.

    For the financial analysis, Forrester assumes:

    • The composite organization ingests 3 TB of data per day in the previous environment, increasing to 3.6 and 4.32 in Years 2 and 3, respectively.
    • The cost per GB is $100.
    • Volume of data stored with a 30-day look back in the previous environment totals 180 TB in year one, increasing to 216 TB and 259 TB in Years 2 and 3, respectively.
    • Cold storage per TB equals $1,800 in Year 1, declining to $360 in Years 2 and 3.
  • Risks.

    Logging storage and compute optimization will vary with:

    • The size of the organization and amount of data ingested and stored.
    • The cost of storage depending on type, method, and geographical location.
  • Results.

    To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $1.5 million.

“We now have an improved ability to manage data at scale — before we couldn’t, and now we can. It’s amazing. Falcon LogScale allows us to find a needle in a digital haystack.”

Senior engineer, SecOps, financial services

Logging Storage And Compute Optimization

Ref. Metric Source Year 1 Year 2 Year 3
B1 TB ingested per day in previous environment Composite 3.00 3.60 4.32
B2 Conversion of TB to GB B1*1,000 3,000 3,600 4,320
B3 Cost per GB Assumption $100 $100 $100
B4 Subtotal: License optimization B2*B3 $300,000 $360,000 $432,000
B5 Monthly compute cost savings Composite $12,000 $14,400 $17,280
B6 Subtotal: Annual compute cost savings B5*12 $144,000 $172,800 $207,360
B7 Volume of data stored in previous environment B1*30 days*2HA (high-availability storage) 180 216 259
B8 Cost of storage per terabyte (inclusive of hardware, infrastructure, and maintenance) Assumption $1,800 $360 $360
B9 Subtotal: Reduced cost of storage (inclusive of hardware — every three years) B7*B8 $324,000 $77,760 $93,312
Bt Logging storage and compute optimization B4+B6+B9 $768,000 $610,560 $732,672
Risk adjustment ↓15%
Btr Logging storage and compute optimization (risk-adjusted) $652,800 $518,976 $622,771
Three-year total: $1,794,547 Three-year present value: $1,490,258
“The technology that Falcon LogScale uses works in the way you expect it to work. There is something about the way you interact with Falcon LogScale, which separates it from other logging solutions.”

CTO, banking

Developer Workback Time Gained

  • Evidence and data.

    The interviewees revealed that Falcon LogScale allowed users to tail live log data or obtain a feed of log events in real time, creating significant efficiencies for the DevOps team. The VP cloud operations at a software organization reported: “The tail log feature in Falcon LogScale is something we really like. It provides significant efficiencies for our log management system.”

  • Modeling and assumptions.

    For the financial analysis, Forrester assumes:

    • Seventy-five engineers are impacted by tail log efficiencies.
    • Thirty minutes per day are saved due to the efficiencies Falcon LogScale provides.
    • The hourly rate of a DevOps engineer is $61.
  • Risks.

    The developer workback time gained will vary with:

    • The volume of data the organization ingests.
    • The number of DevOps engineers with access to Falcon LogScale.
    • The hourly rate of a DevOps engineer, depending on skill level and geographical location.
  • Results.

    To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV of $1.7 million.

Developer Workback Time Gained

Ref. Metric Source Year 1 Year 2 Year 3
C1 Number of development operations engineers impacted by tail log efficiencies Composite 75 75 75
C2 Hours saved per year 0.5 hours saved per day*365 days per year 183 183 183
C3 Hourly rate of development operations engineer TEI standard $61 $61 $61
Ct Developer workback time gained C1*C2*C3 $837,225 $837,225 $837,225
Risk adjustment ↓20%
Ctr Developer workback time gained (risk-adjusted) $669,780 $669,780 $669,780
Three-year total: $2,009,340 Three-year present value: $1,665,644
“Since implementing Falcon LogScale, we have been able to reassign two of our four engineers to higher-value tasks, so that has helped considerably on the cost front. It’s a big win for us.”

VP cloud operations, software

Operational Engineers Reassigned Within Organization

  • Evidence and data.

    The interviewees revealed the following about their organizations’ use of Falcon LogScale:

    • Upon implementing Falcon LogScale, the organizations saved dedicated engineering hours previously necessary to properly manage the data logging and monitoring stack. One product owner at a banking organization said: “If we hadn’t deployed Falcon LogScale, we would have had to hire at least two more engineers just for management.”
    • Falcon LogScale maintained the platform, freeing up engineering hours for other tasks within the organization. A product manager in the banking industry commented: “The fact that Falcon LogScale does the maintenance now, and we no longer have to have FTEs assigned to data management is by far and away the biggest gain for us.”
  • Modeling and assumptions.

    For the financial analysis, Forrester assumes:

    • Two operational engineers are reassigned.
    • The fully loaded salary of a DevOps engineer is $100,100.
  • Risks.

    Operational engineers reassigned within the organization will vary with:

    • The size of the organization.
    • The nature of the organization’s legacy solution and management of that solution.
    • The salary level, depending on skill level and geographical location.
  • Results.

    To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV of $473,000.

Operational Engineers Reassigned Within Organization

Ref. Metric Source Year 1 Year 2 Year 3
D1 Number of operational engineers reassigned Interviews 2 2 2
D2 Fully loaded annual salary of an operational engineer TEI standard $100,100 $100,100 $100,100
Dt Operational engineers reassigned within organization D1*D2 $200,200 $200,200 $200,200
Risk adjustment ↓5%
Dtr Operational engineers reassigned within organization (risk-adjusted) $190,190 $190,190 $190,190
Three-year total: $570,570 Three-year present value: $472,974

Retained Profit From Outage Reduction And Degradations

  • Evidence and data.

    The interviewees revealed that latency, caused by outages and infrastructure performance issues, could result in customer cart abandonment and a significant loss of revenue. Even a half-second website search delay caused a considerable drop in an organization’s conversion rates, as customers, requiring speed for a positive customer experience, looked to other vendors for their online retail purchases.2

  • Modeling and assumptions.

    For the financial modeling, Forrester assumes:

    • The organization’s annual revenue totals $5 billion.
    • The organization experiences two major outages per day in legacy environment.
    • The average time required to resolve an outage is 30 minutes.
    • The organization realizes a 5% revenue loss during an outage.
    • The organization reduces the number of daily outages by 50% after implementing Falcon LogScale.
    • The organization reduces its MTTR postdeployment by 55% in Year 1 and 65% and 75% in Years 2 and 3, respectively.
    • The organization realizes a profit margin of 10%.
  • Risks.

    Retained profit from outage reductions and degradations will vary with:

    • Size of the organization and its annual revenue.
    • Percent revenue lost per outage in legacy environment.
    • Number of outages in the legacy environment and percent reduction postdeployment.
    • Reduction in an organization’s MTTR in the postdeployment environment.
    • Percent profit margin, depending on industry and geographical location.
  • Results.

    To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $1.9 million.

“We have experienced significant growth in our customer base, and even with that exponential growth in our log activity, we are spending less than half the amount per customer for data management.”

CTO, banking

Retained Profit From Outrage Reductions And Degradations

Ref. Metric Source Year 1 Year 2 Year 3
E1 Annual revenue Composite $5,000,000,000 $5,250,000,000 $5,512,500,000
E2 Average revenue generated per hour (rounded) E1/(365*24) $570,776 $599,315 $629,281
E3 Major outages and degradations before Falcon LogScale (annual) 2 per day*365 days 730 730 730
E4 Average time to resolve outage or degradation (hours) Interviews 0.5 0.5 0.5
E5 Percentage of revenue permanently lost during an outage or degradation Composite 5% 5% 5%
E6 Revenue lost from outages and degradations prior to Falcon LogScale E2*E3*E4*E5 $10,416,667 $10,937,500 $11,484,375
E7 Reduction in major outages and degradation due to Falcon LogScale Interviews 50% 50% 50%
E8 Number of outages and degradation after Falcon LogScale (annual, rounded) 1 per day*365 days 365 365 365
E9 Reduction in mean-time-to-recover after Falcon LogScale (rounded) Interviews 55% 55% 55%
E10 Revenue lost from outages and degradations after Falcon LogScale E2*E4*(1-E9)*E5*E8 $2,343,750 $1,914,063 $1,435,547
E11 Business profit margin Composite 10% 10% 10%
Et Retained profit from outage reductions and degradations E12 $807,292 $902,344 $1,004,883
Risk adjustment ↓15%
Etr Retained profit from outage reductions and degradations (risk-adjusted) $686,198 $766,992 $854,150
Three-year total: $2,307,340 Three-year present value: $1,899,430

Unquantified Benefits

Additional benefits that customers experienced but were not able to quantify include:

  • Scalability and agility.

    The volume of data an organization logged could change considerably depending on the company’s growth rate, strategy adjustments, and other factors. Due to licensing restrictions and storage and computing costs, IT staff was often required to ingest only a part of the log and event data their systems generated. Organizations need to quickly adapt to changes, preferably without a large additional investment in resources. A product owner in the banking industry stated: “At any point when we ran out of capacity in our previous environment, a significant amount of engineering work was required for us to expand the capacity. Now, Falcon LogScale just scales elastically for us. We basically just say we need more power, more room, and we get it. Part of the problem with other solutions is that the underlying technology does not scale very well, and it becomes very, very expensive.”

  • Streaming observability.

    Falcon LogScale offered users live access to an unlimited number of data sources, enabling teams to have a real-time view of all log and event data. One interviewee commented: “With Falcon LogScale, we have better visibility to more data sources. We can be more specific with our queries. It’s like we have laser-sharp access to data at our fingertips.” Additionally, the competitive pricing, including usage-based (per GB or TB) and unlimited plans, offered users a more economically feasible way to manage and see more data. A senior SecOps engineer in the financial services industry noted: “Now that we have a less expensive solution, we can see that we have much greater coverage in terms of the amount that we ingest and the logs we can see.”

  • Time savings to integrate new data sources.

    The streamlined integration process enabled users to choose which and how much data they wanted to integrate into their data flow. A CTO in the banking industry stated: “Since we are now more in control of our data, we are realizing time savings whenever we are adding new data sources. We have end-to-end responsibility, so we can speak directly to the data owners and tell them how they should integrate with us.” A product manager in the banking sector commented: “With everything automated in Falcon LogScale, adding new data sources is quick and easy. The operations team does not have to onboard or anything. It just happens, and people get the right logs and everything they need right after IT releases it.”

  • Improved audit and regulatory compliance.

    Having instant access to all necessary log data enabled teams to respond to audit or regulatory requests more efficiently. Organizations could easily select and send the necessary information with minimal resources. Falcon LogScale held the data for the user, removing that responsibility from the organization. A CTO at a banking organization said: “The auditors want to make sure the logs are an accurate representation of what happened and that there is no chance of that information being manipulated. With Humio, we can simply tell them that the entire system is externally controlled ... that we don’t have the data.” The CTO further explained: “Since we can re-ingest past logs, we can easily retrieve historical information when requested. This is hugely beneficial and saves us so much time. If the auditors question the validity of the data, we can clearly show them the chain of custody. We cannot manipulate any one of those steps along the way. Since deploying Humio, we have not had any problems with auditors.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Falcon LogScale and later realize additional uses and business opportunities, including:

  • Additional usage and performance insight.

    As operations teams were quickly adopting Falcon LogScale as an easy-to-use tool that increases efficiencies, other departments were finding added-value opportunities. A product manager in the banking industry noted: “Product owners and business leaders are now using Falcon LogScale to get information for product development as well. It’s easy for them to learn to use Falcon LogScale, so why not use it for this purpose, too.”

  • Enhanced security solutions.

    The toolset enabled SecOps team members to be more proactive to comply with the organizations’ security strategy. A senior engineer, SecOps at a financial services organization mentioned: “We have several security solutions integrated with Falcon LogScale, as well as some internal, custom tools. And we are developing alerts that can trigger our investigations. We plan to continue to use the APIs further to make our investigations smoother and faster.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix A).

NEXT SECTION: Analysis Of Costs

Total Costs

Ref. Costs Initial Year 1 Year 2 Year 3 Total Present Value
Ftr Annual license cost $0 $1,250,000 $1,250,000 $1,250,000 $3,750,000 $3,108,565
Gtr Initial and ongoing costs $70,200 $2,765 $2,765 $2,765 $78,494 $77,076
Total costs (risk-adjusted) $70,200 $1,252,765 $1,252,765 $1,252,765 $3,828,494 $3,185,641

Annual License Costs

  • Evidence and data.

    The interviewees revealed the following about their organizations’ use of Falcon LogScale:

    • The organization increased its daily data ingestion rate from 3 terabytes to 5 terabytes.
    • Falcon LogScale offers three-year contracts with a static annual fee.
  • Modeling and assumptions.

    For the financial analysis, Forrester assumes:

    • The flat annual license cost is $1.25 million over three years.
    • Pricing varies depending on volume. Contact Falcon LogScale for additional details.
  • Risks.

    Given Falcon LogScale flexible pricing structure, Forrester did not apply a risk adjustment.

  • Results.

    The three-year total PV (discounted at 10%) of the annual license cost totals $3.1 million.

Annual License Cost

Ref. Metric Source Initial Year 1 Year 2 Year 3
F1 Annual license cost Interviews $1,250,000 $1,250,000 $1,250,000
Ft Annual license cost F1 $0 $1,250,000 $1,250,000 $1,250,000
Risk adjustment 0%
Ftr Annual license cost (risk-adjusted) $0 $1,250,000 $1,250,000 $1,250,000
Three-year total: $3,750,000 Three-year present value: $3,108,565

Initial And Ongoing Costs

  • Evidence and data.

    The interviewees revealed the following about their organizations’ use of Falcon LogScale:

    • Initial implementation required the dedicated time of IT engineers responsible for the configuration and customization of the platform specific to the needs of the organization.
    • Ongoing management included the general maintenance of the platform and the relationship with Falcon LogScale.
  • Modeling and assumptions.

    For the financial model, Forrester assumes:

    • Two IT engineers, earning $100,100 per year, are needed for three months to implement Falcon LogScale.
    • Ongoing management requires one IT engineer dedicating 4 hours per month, earning $48 per hour.
  • Risks.

    Initial and ongoing costs will vary with:

    • The organization’s legacy environment and current data needs.
    • The complexity of the solution’s configuration and customization requirements.
    • The salary level and hourly rate, depending on skill level and geographical location.
  • Results.

    To account for these risks, Forrester adjusted this cost upward by 20%, yielding a three-year, risk-adjusted total PV of $77,000.

Initial And Ongoing Costs

Ref. Metric Source Initial Year 1 Year 2 Year 3
G1 Implementation 2 IT engineers*($100,100 annual salary/12 months)*3 months*100% time $58,500
G2 Ongoing management 1 IT engineer*4 hours per month*12 months*$48 per hour $2,304 $2,304 $2,304
Gt Initial and ongoing costs G1+G2 $58,500 $2,304 $2,304 $2,304
Risk adjustment ↑20%
Gtr Initial and ongoing costs (risk-adjusted) $70,200 $2,765 $2,765 $2,765
Three-year total: $78,494 Three-year present value: $77,076
NEXT SECTION: Financial Summary

  • icon

    These risk-adjusted ROI, NPV, and payback period values are determined by applying risk-adjustment factors to the unadjusted results in each Benefit and Cost section.

Cash Flow Chart (Risk-Adjusted)

Cash Flow Table (Risk-Adjusted Estimates)

Initial Year 1 Year 2 Year 3 Total Present Value
Total costs ($70,200) ($1,252,765) ($1,252,765) ($1,252,765) ($3,828,494) ($3,185,641)
Total benefits $0 $3,947,272 $3,894,243 $4,085,196 $11,926,711 $9,876,080
Net benefits ($70,200) $2,694,507 $2,641,478 $2,832,431 $8,098,216 $6,690,439
ROI 210%
Payback <6 months

The financial results calculated in the Benefits and Costs sections can be used to determine the ROI, NPV, and payback period for the composite organization’s investment. Forrester assumes a yearly discount rate of 10% for this analysis.

NEXT SECTION: Appendices

Appendix A: Total Economic Impact

Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.

Total Economic Impact Approach

  • icon

    Benefits represent the value delivered to the business by the product. The TEI methodology places equal weight on the measure of benefits and the measure of costs, allowing for a full examination of the effect of the technology on the entire organization.

  • icon

    Costs consider all expenses necessary to deliver the proposed value, or benefits, of the product. The cost category within TEI captures incremental costs over the existing environment for ongoing costs associated with the solution.

  • icon

    Flexibility represents the strategic value that can be obtained for some future additional investment building on top of the initial investment already made. Having the ability to capture that benefit has a PV that can be estimated.

  • icon

    Risks measure the uncertainty of benefit and cost estimates given: 1) the likelihood that estimates will meet original projections and 2) the likelihood that estimates will be tracked over time. TEI risk factors are based on “triangular distribution.”

  • icon
    PRESENT VALUE (PV)

    The present or current value of (discounted) cost and benefit estimates given at an interest rate (the discount rate). The PV of costs and benefits feed into the total NPV of cash flows.

  • icon
    NET PRESENT VALUE (NPV)

    The present or current value of (discounted) future net cash flows given an interest rate (the discount rate). A positive project NPV normally indicates that the investment should be made unless other projects have higher NPVs.

  • icon
    RETURN ON INVESTMENT (ROI)

    A project’s expected return in percentage terms. ROI is calculated by dividing net benefits (benefits less costs) by costs.

  • icon
    DISCOUNT RATE

    The interest rate used in cash flow analysis to take into account the time value of money. Organizations typically use discount rates between 8% and 16%.

  • icon
    PAYBACK PERIOD

    The breakeven point for an investment. This is the point in time at which net benefits (benefits minus costs) equal initial investment or cost.

The initial investment column contains costs incurred at “time 0” or at the beginning of Year 1 that are not discounted. All other cash flows are discounted using the discount rate at the end of the year. PV calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur.

Appendix B: Endnotes

1 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.

2 Source: Yoav Einav, “Amazon Found Every 100ms of Latency Cost them 1% in Sales,” Gigaspaces, January 20, 2019

About Forrester Consulting

Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester’s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting.

Forrester Research, Inc.© All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to forrester.com.

Cookie Settings