Compare total cost over three years, not the first quote. Add engineer time for setup, upkeep, triage and reporting on the DIY side. On the buy side add licence cost, onboarding, tuning and exit effort. Use your own numbers, and show your assumptions.
The worksheet
| Line | DIY | Platform |
|---|---|---|
| Setup hours times loaded hourly cost | ||
| Upkeep hours per year | ||
| Triage hours per year | ||
| Reporting and evidence hours | ||
| Licence or subscription | none | from quote |
| Onboarding and tuning | ||
| Coverage gaps, as a risk note | ||
| Exit effort | ||
| Three year total |
How to fill each line honestly
Hours. Ask the engineer who would do the work, then add half again. Estimates for upkeep are almost always low.
Triage. The platform may reduce it, but do not assume. Measure in a trial how many findings need a human decision on each side.
Risk notes. Write plainly what each option misses. For example, if you cannot answer are we affected within a day, note that.
Exit effort. For DIY, the effort of replacing your scripts. For a platform, export formats and contract terms.
Compare quotes fairly
Ask each vendor to quote against the same scope: repositories, users, scans and retention. Pricing models differ, so normalise before comparing.
What the worksheet will not capture
Team morale, hiring difficulty, and the time to value. A platform running in weeks can have value that a spreadsheet misses, and a good DIY setup can fit unusual needs that no product covers.
Decide with a date
Set a review date eighteen months out, with the numbers you assumed written down. Compare them with reality then.
Safeguard covers this ground with SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. Autonomous fix PRs are off by default, with every category set to Manual. You can try a free scan at gold.safeguard.sh/scan.
Share the worksheet
Show the filled worksheet to the engineer who would own the DIY option and to the finance owner who would sign for the platform. Each will correct a different assumption. Keep a copy with the decision record so that in eighteen months you can see which estimates were wrong and improve the next one.
A worked shape, with placeholders
Suppose DIY upkeep is a hours per month and triage is b hours per month, at a loaded cost of c per hour. The yearly DIY cost is 12 times a plus b, times c, plus setup. For the platform, add the quoted subscription and the onboarding hours, and subtract the triage hours the trial showed it saves. Do not copy anyone else's numbers into a, b and c. Measure them, and write down how.
Quick check
Should I include opportunity cost?
Yes, as a note. Name what the engineers would build instead, even if you cannot put a number on it.
What horizon should I use?
Three years is common because setup costs fade and upkeep and renewal costs show up.
Last reviewed: 19 October 2026.
