1. Scope. Behavioral anomaly detection (login, data-access, network, config-change baselines), automated threat classification with confidence scoring, intelligent alert correlation (target up to 90% false-positive reduction vs. uncorrelated rule-based alerting — aspirational claim, not guaranteed), continuous/monthly model retraining (including de-identified cross-client data use per §6), fully integrated within Vantage Platform (Package 39 tier). Excludes unbounded custom model development, Client-specific training datasets, and model export/licensing.
2. Fees & Billing. All-inclusive monthly/annual subscription fee per Package 39 pricing; no separate per-alert or per-training charges. Net 30 payment. Annual price increase capped at the greater of CPI or 5%, with 90 days' notice (Schedule-specific cap, tighter than Master §3.5's 60-day/no-cap default — controls per Master §3.5 carve-out for stated Schedule caps). Non-renewal objection window: 30 days from increase notice.
3. Term & Termination. 12-month Initial Term (or Order Form term), auto-renews annually (60 days' non-renewal notice). Vendor termination for cause: uncured 30-day material breach, 15-day payment cure, MSA/SLA breach, or legal directive. Client termination for cause: uncured 30-day breach, SLA-failure per incorporated SLA, or 15+ consecutive-day service-equivalence failure. Post-termination: access ceases immediately; model retraining on Client data ceases and Client data purged from Addon systems within 30 days (subject to §6 de-identified-data retention). No refund except for Vendor cause.
4. Service Levels. Incorporated 3VS SLA governs; Addon-specific commitments: 99.5% monthly model availability; alert-processing latency 24 hrs standard / 4 hrs for high-priority alerts meeting ingestion spec. Support covers integration troubleshooting, model-behavior explanation, standard tuning — excludes custom retraining. SLA remedy: service credits per incorporated SLA; cumulative quarterly credits exceeding 25% of monthly fee = Client termination right without penalty.
5. Client Responsibilities. Configure/maintain correct SIEM/EDR/IAM/network integration and API credentialing; provide complete baseline data during 14–30 day onboarding; maintain accurate system/user inventory. Weekly review of findings and feedback on false positives/negatives required; Client acknowledges elevated false-positive/negative rate during 30–60 day initial training. Client consents to de-identified aggregate data use for global model improvement (opt-out available by category, 30-day implementation). Prohibited: reverse-engineering models/weights, non-security resale of outputs, disabling data-collection mechanisms, manipulating input data, platform disruption.
6. Data Handling. Categories: Client Operational Data (security events/logs/telemetry), De-identified Model Training Data (aggregated, statistically masked per NIST SP 800-122), Addon Output Data (findings/scores/correlations). Confidentiality per NDA; access limited to need-to-know personnel/subprocessors. De-identified data, once processed, is retained indefinitely and outside confidentiality restrictions unless Client requests category exclusion (30-day implementation, may reduce novel-threat detection). Post-termination: Client Operational Data deleted/de-identified within 90 days; de-identified data retained indefinitely absent deletion request (180-day removal effort). GDPR: Vendor is processor under incorporated DPA; Client obtains consents. Subprocessor changes: 30-day notice, objection right triggers termination without penalty.
7. Third-Party Components. Open-source ML libraries/infrastructure (TensorFlow, scikit-learn, PyTorch, Spark, Kubernetes) under respective OSS licenses; SBOM available. Models reference third-party threat-intel/vulnerability data (NVD, MITRE ATT&CK) independently of raw source licensing — Client requires no separate license. Vendor patches third-party CVEs within 30 days (10 business days if CVSS ≥8.0). Third-party infrastructure outage = force majeure, not SLA breach, subject to incorporated SLA notification obligations. Model updates: 60 days' advance notice of material changes; backward API/output compatibility maintained for one renewal term.
8. Warranties. Limited warranty: professional performance, functional conformance to documentation, infrastructure maintenance, non-infringement. Performance claims are explicitly aspirational, not guaranteed — actual results depend on Client environment/data quality. No warranty that all threats will be detected; ML output is probabilistic and may be unpredictable in edge cases/adversarial input. No warranty of third-party threat-intel accuracy. Disclaims all other warranties per Master §8.3; is not a substitute for foundational security controls (firewalls, IAM, endpoint protection).
9. Liability & Indemnification. Per-incident cap: greater of (fees paid in trailing 12 months) or $1,000 (Schedule-specific floor, $1,000 minimum even during free trial). Carve-outs per Master §7.3. Vendor indemnifies IP-infringement claims with cure options (continued-use rights, non-infringing modification, or termination + pro-rata refund). Client indemnifies for Operational Data infringement, Acceptable Use violations, unauthorized third-party integration. §4's service-credit remedy is exclusive for performance/availability failures (excluding confidentiality/IP/indemnification claims). Mutual mitigation duty.
10. Precedence. This Schedule's own stated ranking places itself above SLA/NDA for Addon-specific matters (source language: "This Schedule > MSA > SLA > NDA") — flagged as an outlier inconsistent with Master §2's fixed ladder (MSA > Master Terms > SLA > NDA > Schedule); Master Terms governs per Master §2's reconciliation. Extends the vCISO work-authorization engagement; does not replace broader platform commitments. Amendment: 60 days' notice (excluding pricing, governed by §2). Assignment restricted; Vendor may assign to affiliate/successor with 30 days' notice.
