Cost of Goods Sold

Expanded Definition

Cost of goods sold, or COGS, is the direct cost of delivering what a business sells. In a service-led security business, that usually means the labour, tooling, and operational effort needed to perform client work, not the broader overhead of running the company. For an MSSP, COGS sits closer to service delivery economics than to accounting abstraction.

In practice, COGS helps separate the cost of serving one customer from the cost of maintaining the business as a whole. That distinction matters because automation, standardised workflows, and careful service design can reduce delivery effort without changing the value proposition. The term is sometimes discussed alongside gross margin, but they are not the same: COGS is the cost base, while margin is the result after revenue is measured against that base.

A common boundary mistake is to include general administration, sales, and strategy costs inside COGS. That inflates delivery cost and can hide whether a service line is actually efficient. For a more formal accounting treatment, the IFRS Foundation is a useful authority on how costs are recognised and separated in financial reporting.

Examples and Use Cases

COGS is easiest to understand when it is tied to a specific service motion or delivery workflow. In security operations, the term often reflects how much human effort is consumed by repeatable work that could otherwise be standardised or automated.

• An MSSP measures analyst time spent on alert triage, escalation, and ticket handling as part of service delivery cost.
• A managed detection team tracks the operational cost of running enrichment, correlation, and case management workflows for each customer.
• A cloud security provider calculates the labour and platform consumption required to onboard, monitor, and support a client environment.
• A compliance service team estimates how much manual review is needed per assessment cycle before pricing the service.

One useful tradeoff is that reducing COGS with automation can increase dependency on tooling and workflow design. That is often a good outcome, but it means the service must be engineered so that automation failure does not collapse delivery quality or create hidden rework.

Where machine-driven workflows materially replace manual delivery effort, cost structure can shift quickly. In that setting, the economics of service delivery may intersect with the governance of non-human systems, and the OWASP Non-Human Identity Top 10 is relevant because it helps explain how machine credentials and automated access paths can become part of the delivery model.

Security Implications

COGS has security implications because it can reveal whether a service is being delivered with enough operational control to remain reliable at scale. If cost is reduced only by cutting oversight, narrowing logging, or weakening review steps, the apparent margin improvement can mask rising incident risk and customer exposure.

Another failure mode is uncontrolled service complexity. When delivery teams build ad hoc automations to reduce effort, they may create brittle dependencies, orphaned credentials, or undocumented access paths. Those issues can increase support cost later, but they also create trust and containment problems if a workflow is abused or fails during an incident.

For service providers, COGS also shapes how much resilience can be funded into the delivery model. If every additional control adds manual effort, organisations may be tempted to underinvest in detection, validation, or segregation of duties. The result is often a service that looks efficient on paper but becomes expensive to operate during exceptions, investigations, or customer escalations.

A useful practitioner observation is that low COGS is only durable when delivery is repeatable, observable, and recoverable. If those qualities are missing, the cost simply reappears later as rework, incident handling, or contractual pressure.

Domain and Governance Relevance

COGS matters in security-adjacent services because it links operational design to commercial viability. In managed security, identity services, and cloud operations, the delivery model must be economically sustainable enough to support monitoring, quality assurance, and timely response. If it is not, organisations may quietly trade control depth for short-term price competitiveness.

Where automation is part of the service model, the governance question is not just whether automation exists, but whether it is controlled well enough to remain dependable. That becomes more important when automated workflows hold credentials, call APIs, or act across customer environments, because the delivery layer then carries both economic and security significance.

For NHIMG, the most important lens is that service economics and machine-operated delivery are increasingly linked. As automation takes on more repetitive work, the organisation must understand which non-human components are now part of the cost base, the control surface, and the accountability chain. That is where delivery efficiency and identity assurance begin to overlap in a meaningful way.

In short, COGS is not only a finance term for service businesses. It is also a practical indicator of whether delivery can scale without undermining control, resilience, or trust.

Related resources from NHI Mgmt Group

• What breaks when software vendors rely on as-is clauses for digital goods sold in the EU?
• What is the difference between secure identity optimisation and simple cost cutting?
• How can organisations reduce AI cost without slowing adoption?
• Why does vendor access usually cost more to secure than employee access?