An ArcSight EPS and connector finding, cut from $6.0M to $1.8M

The opening finding

The vendor priced the finding against peak events per second and a raw connector inventory, treating short lived bursts as the sustained throughput the license is sized to. The connector count included collectors that were no longer deployed. At list price with back maintenance, the opening position was heavily inflated.

How we defended it

We ran the same four operations we apply to every engagement, set out in full in the method.

Respond. We took over first contact inside the seven day notice window, scoped the engagement under NDA, and consolidated all communication onto a single controlled channel before measurement began.

Reconstruct. We rebuilt the entitlement position and documented sustained EPS separately from momentary spikes, then reconciled the connector inventory against what was actually deployed in production.

Rebut. We rebutted the finding line by line, showing that the license is sized to sustained throughput rather than transient bursts, and that decommissioned connectors do not belong on the audit.

Resolve. We settled against the corrected sustained throughput and connector count, and wrote defined measurement terms into the forward agreement to fix how EPS is counted.

The result

The finding fell from $6.0M to $1.8M, a 70 percent reduction, settled on the buyer's terms. Sustained throughput, not peak bursts, set the licensed position.

Related defense work

The detail of this work lives in our ArcSight SIEM security audit defense. Products overlap across the estate, so the same approach informs our ALA and entitlement review and Fortify and AppSec audit defense. The end to end sequence behind every reduction is in the complete OpenText audit defense playbook.