The realistic year-one TCO of a security-platform agentic AI procurement at mid-sized SOC scale runs 4 to 7 times the order-form platform-fee line, decomposing across five cost components (platform fee, integration of SIEM and EDR and identity and ticketing telemetry, analyst retraining of the L1 and L2 SOC tier, tuning by the detection-engineering function in the first 6 months, and exit migration if the relationship ends); vendor-published ROI figures should be discounted by 30 to 50 percent against demo-environment bias, 20 to 40 percent against the customer's actual false-positive-adjusted alert backlog, and 60 to 80 percent against the survivorship bias in published case studies; the structural procurement instrument that prices these discounts at signing is a contractual 90-day in-environment paid-pilot evaluation gate that runs at production scope against four pre-defined customer baseline measurements (mean-time-to-triage, false-positive rate per detection class, analyst-hours per closed incident, backlog age), with a documented walk-away clause that returns the customer to the pre-pilot operating state without successor-platform commitment.

Anchored on three primary sources. (a) Public per-unit vendor pricing for Microsoft Security Copilot ($4 per Security Compute Unit hour, 1 SCU minimum, per microsoft.com Security Copilot pricing page) and CrowdStrike Charlotte AI (bundled into the Falcon Insight tier per crowdstrike.com platform documentation); these set the platform-fee floor. (b) IBM Cost of a Data Breach Report 2024 ($4.88M global average, $9.36M US average, $9.77M healthcare) anchors the false-negative-tail asymmetric-cost argument and the cost-of-being-wrong differential against general-purpose agentic AI TCO. (c) SANS 2024 SOC Survey (40 to 60 percent median false-positive rate, 70 to 80 percent at the long-tail SOCs) anchors the alert-quality discount factor. The 4-to-7x first-year multiplier is calibrated from procurement-team observation of integration + retraining + tuning + exit costs against the platform-fee line across mid-sized SOC deployments; published independent (non-vendor-funded) audits at this granularity are not available, so the multiplier is presented as the buying-committee planning range rather than a measured industry average. 60-day review cadence (26 Jul 2026) because vendor pricing models in security AI shift quarterly. Trigger conditions: (1) a published independent audit of security-platform agentic AI deployment outcomes that materially changes the discount factors moves toward Partial; (2) Microsoft, CrowdStrike, Palo Alto, or SentinelOne announcing structural pricing-model changes for their security AI tiers requires cost-component-model revision; (3) regulatory action under the EU AI Act, NIST AI RMF, or sector-specific cybersecurity rules constraining how security-platform AI is contracted changes the evaluation gate structure; (4) a published case study of a regulated-industry breach traceable to a security-platform AI false negative would harden the asymmetric-cost argument. Sibling AM-180 (agentic IAM TCO model at 2,000-employee scale) covers the IAM-axis TCO calculation that closes the identity side of the security-platform procurement.