Business case · for decision

Managed fraud detection and alert triage for Harbor Credit Union

To: Helen Achterberg, Chief Financial Officer, and the Finance Committee
From: Theo Lindqvist, Account Director, Cobalt Security
Re: Moving card-fraud monitoring and alert triage from your analysts to Cobalt, on a three-year term
Decision requested: Approve the agreement at the 4 Nov 2026 meeting: $95,700 in year one, $75,804 a year after.

Payback

6.2months

Year-one net, after every cost: $90,756
Three-year net: $312,060

01The cost of doing nothing

Standing still costs Harbor CU $494,160 a year, in three places.

0$494,160 a year

Fraud losses written off

$302,400

42,000 members × $8,000 card spend × 9 bps

e.g. Card-not-present purchases on cloned debit cards
e.g. Account takeover after a social-engineered password reset
e.g. Mule accounts opened and emptied within a week

Analyst hours on alerts

$149,760

40 hrs a week × 52 × $72 an hour, loaded

e.g. Clearing velocity alerts that turn out to be travel
e.g. Manual review of every peer-to-peer limit increase
e.g. Monday mornings spent on the weekend backlog

Exam findings to remediate

$42,000

3 open findings × $14,000 each

e.g. Alert dispositions not documented
e.g. Rule thresholds untuned since they were set
e.g. No independent review of analyst overrides

02The payback model

Set the three numbers your team knows best. The payback follows.

Members42,000 Drives fraud exposure and the license. Analyst hours a week on alerts40 Triage only, not investigations. Fraud loss rate, bps of card spend9 Net write-offs over annual card spend.

Held constant
Loaded analyst cost: $72 / hr
Card spend per member: $8,000 / yr
Fraud losses Cobalt stops: 25%
Triage hours Cobalt removes: 60%
Exam findings Cobalt closes: 50%
License: $42,000 + $0.75 / member

Saved each year: $186,456
Payback: 6.2months
Three-year net: $312,060

Cumulative cash, month 0 to 36Month 36: $312,060

Year 2 fee Year 3 fee

Savings = fraud stopped $75,600 + analyst time $89,856 + exam work $21,000. Costs = year one $95,700, then $75,804 a year. Month 0 starts at −$95,700.

03Risk, before and after

Today four of the five risks sit in the top‑right corner. By month six, none do.

24

1

5

3

Impact →

2

1

5

4

3

Impact →

1Account takeover~~Likely · Severe~~ Possible · Moderate
2Card-not-present fraud~~Likely · Moderate~~ Possible · Minor
3Real alert missed in the backlog~~Possible · Severe~~ Rare · Severe
4Repeat exam finding~~Likely · Moderate~~ Rare · Moderate
5Analyst burnout and turnover~~Possible · Moderate~~ Rare · Minor

04Three-year cost

Every dollar Cobalt costs over the term, including your own people’s time.

Line	Basis	Year 1	Year 2	Year 3	Total
License	$42,000 platform + 42,000 members × $0.75	$73,500	$73,500	$73,500	$220,500
Implementation	One-time, fixed fee	$15,000	–	–	$15,000
Internal time	100 hrs, then 32 hrs a year, × $72	$7,200	$2,304	$2,304	$11,808
Total cost		$95,700	$75,804	$75,804	$247,308
Savings	From the model in section 02	$186,456	$186,456	$186,456	$559,368
Net	1.3× return on total cost	$90,756	$110,652	$110,652	$312,060

05What the board will ask

The questions we expect, answered before the meeting.

Q1What if the savings don’t show up?

We measure every month against the baseline in this memo. If measured year-one savings come in under the $95,700 year-one cost, we credit the gap against year two.

Q2Where does the 60% triage figure come from?

A four-week shadow test on your own alert queue. Cobalt dispositioned alerts alongside your analysts and matched their call on 60% of them with no human needed. The rest stay with your team.

Q3Why does the license move with members?

Fraud exposure grows with membership, so part of the price does too: a $42,000 platform fee plus $0.75 per member a year, recounted at each renewal. Move the members slider in section 02 and both sides of the case move.

Q4Is this a headcount cut?

No. About 1,248 hours a year come back to your analysts, roughly 0.7 of a full-time role, and go to investigations and member callbacks.

Q5What does it take from our side?

100 hours in year one, mostly your core-banking admin and BSA officer during a six-week setup. After that, about 32 hours a year for quarterly tuning reviews.

Q6Can we leave?

Yes. You can opt out at each anniversary with 90 days’ notice, and your rules, alert history and dispositions export in a standard format.

Q7How will examiners see it?

Every disposition is logged with its reason and reviewer, which answers the documentation finding directly. We join your next exam-prep call.

06Approvals

Four signatures, then live on every card by 12 Jan 2027.

21 Oct 2026Memo issued
4 Nov 2026Committee decision
18 Nov 2026Agreement signed
1 Dec 2026Kickoff, rules export
12 Jan 2027Live on all cards
13 Jul 2027First savings review

Chief Financial Officer

ApproveDecline

Signature

Date

Chief Risk Officer

ApproveDecline

Signature

Date

Information Security Officer

ApproveDecline

Signature

Date

Finance Committee Chair

ApproveDecline

Signature

Date

Print for the committee. This page prints as a paper memo with these sign-off lines, and the model prints at whatever settings you leave it on.

07Next step

Walk the committee through the model before 4 Nov 2026.

Twenty minutes with your numbers on screen. Bring the sliders, we’ll bring the shadow-test data.

Book the walkthrough

Sample. Cobalt Security and Harbor Credit Union are made up, and so are the people and figures. Sell Unfairly built this page to show what a business case can be.

CS-HCU-0412 · 21 Oct 2026