Telemetry can contain infrastructure metadata, customer identifiers, stack traces, secrets, or personal information. Security therefore affects enterprise eligibility, insurance, contract liability, architecture, sales cycles, and incident reserves.
The NIST Cybersecurity Framework 2.0 organizes risk management around Govern, Identify, Protect, Detect, Respond, and Recover. For an observability company, that translates into documented access control, encryption, tenant isolation, secure development, vendor review, incident response, recovery testing, and executive ownership. AICPA's Trust Services Criteria cover security, availability, processing integrity, confidentiality, and privacy—the areas commonly evaluated in SOC 2 work.
Budget $50,000-$180,000 for initial legal, privacy, security, penetration testing, and audit-readiness work, then $6,000-$25,000 per month as the company grows. Highly regulated or federal-market ambitions can require far more. Treat every requested compliance program as an investment case: expected contract value, probability of closing, time to readiness, annual maintenance cost, and effect on the sales pipeline.
Every important input should flow to an observable financial outcome. Customer count, price, telemetry, retention, and sales ramp must drive revenue, direct cost, staffing, cash, and payback in one connected model.
Start with a customer cohort schedule. New customers enter by month, ramp usage, convert from pilot, renew, expand, contract, or churn. Then calculate revenue by billing unit. Next, translate customer behavior into telemetry units and multiply by cloud unit cost. Add support based on implementation hours, tickets, and SLA. Fixed costs follow the hiring plan. Cash timing follows invoice terms and annual prepayments.
Public observability companies also show that growth requires sustained product and selling investment. Datadog's 2025 annual report showed research and development at 45% of revenue and sales and marketing at 28% of revenue while gross margin was 80%. A smaller company should not copy those ratios mechanically, but the operating expense disclosure is a useful reminder that high gross margin does not automatically create operating profit.
The final decision is not whether observability is a promising category. It is whether this specific platform can acquire the right customers, process their telemetry at a controlled unit cost, retain and expand them, finance the sales cycle, and still produce cash after reliability and security promises are honored.