Most consulting engagements fail before the first consultant logs in. The failure is structural: a statement of work gets negotiated for six weeks, scoped against assumptions that will be wrong by month two, staffed with whoever is on the bench, and billed in day-rate blocks whether or not the work needed a full day. By the time anyone notices the drift, the change-order process costs more energy than the work itself.
We built mesh™ to remove those failure points one at a time. It is a subscription model for Splunk and Cribl consulting: a fixed monthly cost, work billed in 15-minute increments, and everything aligned to OKRs you set and we calibrate quarterly. The engagement runs through four phases (Subscribe, Align, Execute, Optimize), and each phase exists to kill a specific pathology of traditional consulting.
Here is what each phase actually involves, why it is there, and what you should expect to see in the first 30 and 90 days.
Subscribe: kill the procurement friction
In the Subscribe phase you pick a tier and lock a fixed monthly rate. That is the entire commercial negotiation. The tiers are sized by duration and monthly hours:
- Introduction: 3 months, up to 20 hours per month. Built to land: prove the model on a contained problem.
- Foundation: 6 months, 20–40 hours per month. Built to govern: standards, ownership, and repeatable practice.
- Strategic: 6 months, 40–80 hours per month. Built to scale: multiple workstreams running in parallel.
- Enterprise: 12 months, 80–120 hours per month. Built to accelerate: sustained, program-level capacity.
The reason this phase exists is that per-project SOWs punish you twice. First in procurement: every new task means legal review, rate cards, and a signature cycle measured in weeks. Second in behavior: once the SOW is signed, every idea that was not in it becomes a change order, so your team stops raising ideas. A subscription with a fixed monthly cost means one procurement event covers the whole engagement, and new work is a prioritization conversation, not a contract negotiation. Budget owners get a number that does not move; practitioners get a backlog that can.
Align: kill the scope ambiguity
Align is a structured kickoff: we define OKRs with your stakeholders and build a quarterly roadmap against them. This is the phase most engagements skip, and it is why they drift. “Improve our Splunk environment” is not a scope; it is an invitation to disagree later about what was promised.
OKRs force the conversation that hourly billing lets everyone avoid. An objective like “reduce ingest cost without losing detection coverage” with measurable key results gives both sides the same definition of done. The quarterly roadmap then sequences the work: what ships in the first 90 days, what depends on what, and which of your people need to be in the room. When priorities shift mid-quarter (they will), the roadmap is the artifact you renegotiate against, not a 40-page SOW.
Alignment is also where accountability gets its cadence: monthly reviews track progress against the key results, and quarterly calibration resets the OKRs themselves as your situation changes.
Execute: kill the idle billing
Execution is where the 15-minute increment matters. Traditional models bill in days or half-days, which quietly converts “a 40-minute pipeline review” into a billed half-day. Across a year, that rounding is a meaningful fraction of your spend. Worse, it discourages exactly the interactions that make embedded consulting valuable. Nobody schedules a quick question when a quick question costs four hours.
Under mesh™, consultants work embedded with your team and the meter runs in 15-minute increments against your monthly allocation. That changes behavior on both sides. Your engineers pull us into a working session when it is useful and drop us when it is not. A month might be one sustained migration effort, or it might be forty short touchpoints across detection engineering, ingest optimization, and platform administration. The model does not care, and neither does your invoice. You pay for work performed, at a monthly cost you already fixed in the Subscribe phase.
Optimize: kill the lock-in
The Optimize phase is the standing right to resize. At monthly reviews and quarterly calibrations, you can scale hours up or down and move between tiers as the work demands. Started at Introduction and found three quarters of backlog? Step up to Foundation or Strategic. Finished the heavy build and moving into steady-state? Step down.
This phase exists because lock-in is the quiet tax of traditional consulting. When capacity is fixed by contract, the vendor’s incentive is to keep it filled, which is how engagements accumulate low-value work that exists to justify headcount. Making tier changes a routine part of the model inverts that incentive: the only way we keep the subscription is to keep the OKRs moving. If the work is done, the honest move is to scale you down, and the model makes that a normal conversation instead of a breakup.
What you should see in the first 30 and 90 days
Hold any subscription consulting model, ours included, to concrete early checkpoints.
By day 30, you should have:
- A completed kickoff with named stakeholders on both sides;
- Written OKRs with measurable key results, not aspirational themes;
- A quarterly roadmap sequencing the first body of work;
- Consultants already executing against it, visible in your ticketing system and your Slack, not just in a status deck;
- Your first monthly review on the calendar with an hours ledger showing exactly where the increments went.
By day 90, you should have:
- At least one key result measurably moved, with the evidence to show your leadership;
- Three monthly reviews’ worth of transparent hours accounting;
- A quarterly calibration that honestly re-scored the OKRs, including any that missed, and why;
- A fact-based view of whether your tier is right-sized, and a costless path to change it.
If a provider cannot show you those artifacts on that timeline, the model is subscription in name only.
The model is the point
None of the four phases is exotic on its own. Fixed pricing exists; OKRs exist; time-and-materials billing exists. What matters is the combination: fixed cost without fixed scope, granular billing without granular contracts, and a built-in exit ramp that keeps everyone honest. That is the difference between buying hours and buying outcomes on a predictable budget.
If you want to see how a mesh™ tier would map to your Splunk or Cribl backlog, talk to us. A scoping conversation costs you nothing and takes less than an hour.