Predictika · Privileged access, endpoint privilege and cloud access quotes

An AI sales agent's Sectona quote, checked before it goes out

An AI sales agent prepares a quote for the Sectona Security Platform: Privileged Access Management with its modules, Endpoint Privilege Management and Cloud Access Management, on a SaaS, Self-Managed, Private Cloud or PAM as a Service deployment, with support services. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the products, their minimums and how the modules depend on each other and on the deployment, and returns a verdict, every reason, a line-item quote and the figures it computed.

Scope: Sectona Privileged Access Management (vault, Session Manager, Just-In-Time access, Privilege Elevation, Remote Access, Secrets Management, Discovery, Governance), Endpoint Privilege Management and Cloud Access Management: minimums, module dependencies, deployment options, platform support, support services, the term and the stated total. See everything this validator covers

This validator models Sectona Security Platform quotes, not just the scenarios shown below. The product names, the four deployment options, the Professional and Managed support services, the operating systems that Endpoint Privilege Management supports, the database types behind the direct database proxy and the AWS focus of Cloud Access Management come from Sectona's public website; Sectona publishes no prices or licensing quantities, so the prices, minimums and dependency rules are illustrations set to be typical for a privileged access platform.

  • Privileged Access Management — privileged users and managed assets, with the Session Manager, Just-In-Time access, Privilege Elevation, Remote Access, Secrets Management, Discovery and Onboarding, Access Governance, the direct inline database proxy, hardware security module integration and the satellite break-glass vault.
  • Endpoint Privilege Management and Cloud Access Management — endpoints on Windows 10 x64, Windows 11 and macOS 13 and 14; cloud users and AWS accounts.
  • Deployment and services — SaaS, Self-Managed, Private Cloud or PAM as a Service, high-availability clusters and geo-replication, Professional or Managed Support, the Customer Success Program and the Certified User Program.
  • Checks — minimums, modules that need another module, features that the deployment option rules out or already includes, endpoints and accounts the products do not cover, a term of 1 to 5 years and the stated total. Terms over 3 years, more than 500 privileged users and more than 10,000 supported endpoints go to a person.

Any Sectona quote that touches these products and rules is in scope — not only the scenarios pictured here. Not covered: professional services and implementation, training beyond the Certified User Program, taxes and negotiated discounts. Prices, minimums, the licensing quantities and the approval thresholds are illustrative, not Sectona's.

The AI sales agentBuilds the Sectona quote from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Modules that depend on other modulesOnly with care
Just-In-Time access needs the Session Manager, Privilege Elevation needs Just-In-Time access, Remote Access needs the Session Manager and Governance needs Discovery; each dependency is a separate product rule to write, keep and test.		The modules are in one request and every dependency is checked on every call.
Features the deployment rules out or already includesOnly with workarounds
Hardware security module integration and a break-glass vault are not offered on SaaS, and SaaS already includes high availability, so a rep who copies a Private Cloud quote can sell, or bill twice for, what the deployment cannot take; each needs a rule against the deployment choice.		The deployment option is checked against every module and add-on, and the double charge comes back as a finding.
Counts that must be split by what the product supportsOnly with workarounds
Endpoint Privilege Management supports a short list of operating systems and the database proxy a short list of database types; a rule can only see a count of endpoints or databases, so the unsupported share has to be modeled and compared with the total.		The supported and unsupported counts are separate fields, and both the block and the billable count follow from them.
A minimum that applies after the unsupported share is removedOnly with workarounds
The 100-endpoint minimum applies to the endpoints that can be licensed, not to the number typed in; the rule has to compute the supported count first and then compare it.		The supported count is computed and the minimum is checked against it in the same pass.
A stated total that must equal the list-price totalOnly with workarounds
The stated figure is free text; a rule can compare it with a computed total only after every user, asset, module, endpoint, account, deployment add-on and service has been priced and summed over the term.		The total is computed and compared in the same pass as the other rules.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1Privileged Access Management is quoted for 24 privileged users; it is sold for at least 25.
2Privileged Access Management is quoted with 99 managed assets; it is sold with at least 100.
3Just-In-Time access is quoted without the Session Manager that records the time-bound sessions.
4Privilege Elevation is quoted without Just-In-Time access, which grants the time-bound elevation.
5Remote Access is quoted without the Session Manager that controls and records the sessions.
6Access Governance is quoted without Discovery and Onboarding, which supplies the accounts to certify.
7Secrets Management is quoted for 9 applications; it is sold for at least 10.
8The quote has Privileged Access Management assets, modules or secrets but no privileged users.
9Hardware security module integration is quoted with the SaaS deployment; it needs a Self-Managed, Private Cloud or PAM as a Service deployment.
10A satellite break-glass vault is quoted with the SaaS deployment; it needs a Self-Managed, Private Cloud or PAM as a Service deployment.
11The direct inline database proxy is quoted for 30 databases of other types; it supports MySQL, MSSQL and MariaDB.
12The quote charges for a high-availability cluster with the SaaS deployment, which already includes it.
13Geo-replication is quoted without a high-availability cluster.
14Endpoint Privilege Management is quoted for 99 supported endpoints; it is sold for at least 100.
15100 endpoints run an operating system that Endpoint Privilege Management does not list as supported (Windows 10 x64, Windows 11, macOS 13 and 14).
16The quote has 10,001 supported endpoints; above 10,000 a person should confirm the rollout plan.
17Cloud Access Management needs both cloud users and AWS accounts, and the quote has only one of them.
18Cloud Access Management is quoted for 4 accounts on clouds other than AWS; Sectona describes it for AWS accounts.
19The PAM as a Service deployment is quoted without Managed Support.
20The quote has no support tier; every quote includes Professional or Managed Support.
21The quote has 501 privileged users; above 500 a person should confirm the deployment sizing.
22The quote has no Privileged Access Management users, Endpoint Privilege Management endpoints or Cloud Access Management users.
23The quote has a term of 0 years; terms run from 1 to 5 years.
24The quote has a term of 4 years; terms over 3 years need a person to confirm price protection.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Northgate Financial Group, enterprise-wide privileged access: A quote for a bank: Privileged Access, Endpoint Privilege and Cloud Access Management across the group, with the SaaS deployment and Managed Support

    
The agent's request. Please quote Sectona for a 3-year term on the SaaS deployment, with Privileged Access Management for 350 privileged users and 6,200 managed assets with the Session Manager, Just-In-Time access, Privilege Elevation, Remote Access, Discovery and Onboarding and Access Governance, Secrets Management for 240 applications, the direct inline database proxy, including 45 Oracle databases, hardware security module integration, a satellite break-glass vault, a high-availability cluster, geo-replication, Endpoint Privilege Management for 9,000 endpoints, including 420 servers and older machines, Cloud Access Management for 120 cloud users across 38 AWS accounts and 6 Azure accounts, Managed Support, the Customer Success Program and the Certified User Program. The quote states a total of $4,779,750.00 for 3 years. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • HSM integration is not available on SaaS. Hardware security module integration is quoted with the SaaS deployment; it needs a Self-Managed, Private Cloud or PAM as a Service deployment.
    • 
      
  • Break-glass vault is not available on SaaS. A satellite break-glass vault is quoted with the SaaS deployment; it needs a Self-Managed, Private Cloud or PAM as a Service deployment.
    • 
      
  • Database proxy is limited to three database types. The direct inline database proxy is quoted for 45 databases of other types; it supports MySQL, MSSQL and MariaDB.
    • 
      
  • SaaS already includes high availability. The quote charges for a high-availability cluster with the SaaS deployment, which already includes it.
    • 
      
  • Endpoints on unsupported systems. 420 endpoints run an operating system that Endpoint Privilege Management does not list as supported (Windows 10 x64, Windows 11, macOS 13 and 14).
    • 
      
  • Cloud Access Management covers AWS. Cloud Access Management is quoted for 6 accounts on clouds other than AWS; Sectona describes it for AWS accounts.
    • 
      
  • Stated total does not match. The quote states a total of $4,779,750.00 for the term; the list prices give $4,591,710.00.
    • 
    

    
2. Northgate Financial Group, enterprise-wide privileged access: The agent resubmits after fixing the errors

    
The agent's request. Please quote Sectona for a 3-year term on a Private Cloud deployment, with Privileged Access Management for 350 privileged users and 6,200 managed assets with the Session Manager, Just-In-Time access, Privilege Elevation, Remote Access, Discovery and Onboarding and Access Governance, Secrets Management for 240 applications, the direct inline database proxy, hardware security module integration, a satellite break-glass vault, a high-availability cluster, geo-replication, Endpoint Privilege Management for 8,580 endpoints, Cloud Access Management for 120 cloud users across 38 AWS accounts, Managed Support, the Customer Success Program and the Certified User Program. The quote states a total of $4,711,710.00 for 3 years. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Annual charge of $1,570,570.00 and a term total of $4,711,710.00 at list prices.
    • 
    

    
3. Cedarline Health, hospital privileged access: A quote for a hospital system: Self-Managed Privileged Access, Endpoint Privilege and Cloud Access Management

    
The agent's request. Please quote Sectona for a 4-year term on a Self-Managed deployment, with Privileged Access Management for 120 privileged users and 1,500 managed assets with the Session Manager, Just-In-Time access and Access Governance, Secrets Management for 30 applications, the direct inline database proxy, including 28 Oracle databases, a high-availability cluster, Endpoint Privilege Management for 4,200 endpoints, including 150 servers and older machines, Cloud Access Management for 30 cloud users across 12 AWS accounts and 3 Azure accounts, Professional Support and the Customer Success Program. The quote states a total of $2,156,800.00 for 4 years. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Governance needs Discovery. Access Governance is quoted without Discovery and Onboarding, which supplies the accounts to certify.
    • 
      
  • Database proxy is limited to three database types. The direct inline database proxy is quoted for 28 databases of other types; it supports MySQL, MSSQL and MariaDB.
    • 
      
  • Endpoints on unsupported systems. 150 endpoints run an operating system that Endpoint Privilege Management does not list as supported (Windows 10 x64, Windows 11, macOS 13 and 14).
    • 
      
  • Cloud Access Management covers AWS. Cloud Access Management is quoted for 3 accounts on clouds other than AWS; Sectona describes it for AWS accounts.
    • 
      
  • Stated total does not match. The quote states a total of $2,156,800.00 for the term; the list prices give $2,124,400.00.
    • 
      
  • Term longer than 3 years. The quote has a term of 4 years; terms over 3 years need a person to confirm price protection.
    • 
    

    
4. Cedarline Health, hospital privileged access: The agent resubmits after fixing the errors

    
The agent's request. Please quote Sectona for a 4-year term on a Self-Managed deployment, with Privileged Access Management for 120 privileged users and 1,500 managed assets with the Session Manager, Just-In-Time access, Discovery and Onboarding and Access Governance, Secrets Management for 30 applications, the direct inline database proxy, a high-availability cluster, Endpoint Privilege Management for 4,050 endpoints, Cloud Access Management for 30 cloud users across 12 AWS accounts, Professional Support and the Customer Success Program. The quote states a total of $2,196,400.00 for 4 years. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Term longer than 3 years. The quote has a term of 4 years; terms over 3 years need a person to confirm price protection.
    • 
      
  • Quote summary. Annual charge of $549,100.00 and a term total of $2,196,400.00 at list prices.
    • 
    

    
5. Cedarline Health, hospital privileged access: The agent resubmits after fixing the errors

    
The agent's request. Please quote Sectona for a 3-year term on a Self-Managed deployment, with Privileged Access Management for 120 privileged users and 1,500 managed assets with the Session Manager, Just-In-Time access, Discovery and Onboarding and Access Governance, Secrets Management for 30 applications, the direct inline database proxy, a high-availability cluster, Endpoint Privilege Management for 4,050 endpoints, Cloud Access Management for 30 cloud users across 12 AWS accounts, Professional Support and the Customer Success Program. The quote states a total of $1,647,300.00 for 3 years. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Annual charge of $549,100.00 and a term total of $1,647,300.00 at list prices.
    • 
    

    
6. Ironvale Manufacturing, PAM as a Service: A quote for a manufacturer: PAM as a Service with Endpoint Privilege and Cloud Access Management

    
The agent's request. Please quote Sectona for a 3-year term on the PAM as a Service deployment, with Privileged Access Management for 60 privileged users and 900 managed assets with the Session Manager and Just-In-Time access, Secrets Management for 6 applications, Endpoint Privilege Management for 120 endpoints, including 30 servers and older machines, Cloud Access Management for 15 cloud users across 4 AWS accounts and Professional Support. The quote states a total of $533,940.00 for 3 years. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Secrets Management below the minimum. Secrets Management is quoted for 6 applications; it is sold for at least 10.
    • 
      
  • Endpoints below the minimum. Endpoint Privilege Management is quoted for 90 supported endpoints; it is sold for at least 100.
    • 
      
  • Endpoints on unsupported systems. 30 endpoints run an operating system that Endpoint Privilege Management does not list as supported (Windows 10 x64, Windows 11, macOS 13 and 14).
    • 
      
  • PAM as a Service needs Managed Support. The PAM as a Service deployment is quoted without Managed Support.
    • 
      
  • Stated total does not match. The quote states a total of $533,940.00 for the term; the list prices give $529,080.00.
    • 
    

    
7. Ironvale Manufacturing, PAM as a Service: The agent resubmits after fixing the errors

    
The agent's request. Please quote Sectona for a 3-year term on the PAM as a Service deployment, with Privileged Access Management for 60 privileged users and 900 managed assets with the Session Manager and Just-In-Time access, Secrets Management for 12 applications, Endpoint Privilege Management for 130 endpoints, Cloud Access Management for 15 cloud users across 4 AWS accounts and Managed Support. The quote states a total of $726,360.00 for 3 years. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Annual charge of $242,120.00 and a term total of $726,360.00 at list prices.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a quote for the Sectona Security Platform: Privileged Access Management with its modules, Endpoint Privilege Management and Cloud Access Management, on a SaaS, and more. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the products, their minimums and how the modules depend on each other and on the deployment, and returns a verdict, every reason, a line-item quote and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote Sectona for a 3-year term on the SaaS deployment, with Privileged Access Management for 350 privileged users and 6,200 managed assets with the Session Manager. The quote states a total of $4,779,750.00 for 3 years. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with seven findings, all in one answer. Hardware security module integration is quoted with the SaaS deployment; it needs a Self-Managed, Private Cloud or PAM as a Service deployment. A satellite break-glass vault is quoted with the SaaS deployment; it needs a Self-Managed, Private Cloud or PAM as a Service deployment. The direct inline database proxy is quoted for 45 databases of other types; it supports MySQL, MSSQL and MariaDB. The other four are on screen.
    6. 
      
  6. The validator returned seven blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other and against the stated total.
    7. 
      
  7. What this shows: for features the deployment rules out or already includes, a rules-based CPQ can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the deployment to Private Cloud, the endpoints to 8,580 and the stated total to $4,711,710.00. It removes the Oracle databases through the proxy, servers and older machines among them and Azure accounts.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. The validator also returns the line-item quote. It starts with Privileged user and Managed asset; the other eighteen lines are on screen.
    13. 
      
  13. All seven earlier findings are cleared, and the validator's total, $4,711,710.00, matches the quote.
    14. 
      
  14. Seven problems caught in one call, fixed in one pass, and a clean $4,711,710.00 quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    15.