Predictika · Compliance services quotes

An AI sales agent's compliance quote, checked before it goes out

An AI sales agent prepares a quote for SecurityMetrics: PCI Compliance for Small Business with the self-assessment questionnaire (SAQ) that fits how the merchant takes cards, Guided HIPAA, Shopping Cart Monitor, Pulse, penetration testing and mobile app testing, with the scan IP addresses, card-data machines and training seats the merchant needs. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the packages, SAQ rules and dependencies SecurityMetrics describes publicly and returns a verdict, every reason, a line-item quote and the figures it computed.

Scope: SecurityMetrics PCI Compliance for Small Business, Guided HIPAA, Shopping Cart Monitor, Pulse, penetration testing and mobile app testing quotes: SAQ type by processing method, merchant level, scan IP addresses, PANscan machines, training seats, payment paths, term and the stated total. See everything this validator covers

This validator models compliance services quotes for SecurityMetrics as described on the SecurityMetrics product pages, not just the scenarios shown below.

  • Packages and prices — PCI Compliance for Small Business (starts at $399 a year with one scanned IP address, the online SAQ, PANscan on one machine and one training seat), Guided HIPAA Basic ($1,499), Plus ($2,499) and Pro ($4,999) with 1, 3 and 5 scanned IP addresses and 3, 15 and 25 training seats, SecurityMetrics Pulse (starts at $2,499 a year), Shopping Cart Monitor Basic, Plus and Pro, penetration testing (usually $15,000 to $30,000) and mobile app testing. SecurityMetrics publishes the starting prices above; every other price on this page is illustrative.
  • SAQ rules — the SAQ type follows how the merchant takes cards: SAQ A for a fully outsourced checkout page, SAQ A-EP for a payment page of its own, SAQ B for imprint machines and dial-up terminals, SAQ B-IP for standalone IP terminals, SAQ C-VT for a web-based virtual terminal, SAQ C for a payment application connected to the internet, SAQ P2PE for a validated P2PE solution, and SAQ D for merchants that store card data. Level 1 merchants validate with an on-site audit, not an SAQ plan.
  • Dependencies — external scans for the SAQ types that need them, scanned IP addresses covering the merchant's internet-facing addresses, PANscan machines, training seats for the staff, Shopping Cart Monitor for a merchant that serves its own payment page, payment paths per monitor tier, Pulse sensors, and a penetration test that starts from the vulnerability scan.
  • Approvals — Level 2 and 3 merchants on the small-business plan, a PCI audit or forensic investigation (both quoted individually), a penetration test above the usual range, an SAQ that includes the penetration test requirement with none quoted, multi-year terms and very large scan counts go to a person.

Any SecurityMetrics quote that touches these packages and rules is in scope — not only the scenarios pictured here. Not covered: SAQ types beyond the eight listed, internal vulnerability scans, HITRUST and CMMC services, PCI policy templates, acquirer and ISO programs, negotiated discounts, taxes and the price of audits and forensic work. Published starting prices were read in October 2026 and may change.

The AI sales agentBuilds the SecurityMetrics compliance quote from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

6 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
An SAQ type that must follow how the merchant takes cardsOnly with workarounds
Each processing method has its own SAQ, with D as the catch-all for merchants that store card data; matching the two takes a validation rule per pair and fields the rep may leave empty.		The processing method and the SAQ type are fields of the quote and are compared on every call.
Scans, machines and training seats covered by a mix of packagesOnly with care
Each package includes its own IP addresses and seats, Pulse covers more addresses, and extras add to the total; the covered counts have to be summed or compared across whichever packages were chosen and checked against what the merchant needs.		Coverage is computed from the packages chosen and compared with the merchant's counts on every call.
A penetration test that has to start from the scanOnly with care
The test may cover only the IP addresses the vulnerability scans cover, and its price moves with the number of IP addresses and web applications; the rule reads the scan coverage and the test scope together.		The test scope, the scan coverage and the test price are checked together and the price is compared with the usual range.
A stated total that moves with every package and add-onOnly with workarounds
Prices come from the package, the extras, the sensors, the payment paths and the test scope, so the stated total must be compared by hand or with a custom check.		The prices are applied from the choices and the total is compared with the stated figure in the same pass.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1The SAQ type does not fit how the merchant takes cards; each processing method has its own SAQ (for example SAQ A for a fully outsourced checkout page, SAQ B-IP for a standalone IP terminal, SAQ P2PE for a validated P2PE terminal), and a merchant that stores card data uses SAQ D.
2This SAQ type includes the annual penetration test requirement but the quote has no penetration test; a person should confirm the merchant has it arranged elsewhere.
3The quote has the PCI small-business plan but the business does not take payment cards.
4The merchant is Level 1; Level 1 merchants validate with an on-site PCI DSS audit by a Qualified Security Assessor, not the small-business self-assessment plan.
5The merchant is Level 1 and takes cards but the quote has no PCI DSS audit.
6The quote includes a PCI DSS audit, which SecurityMetrics prices from a range calculator and a scoping call, so a person should confirm the price.
7The merchant is Level 2 and the small-business plan is built for Level 4 merchants; the merchant processor decides what Level 2 and 3 merchants may use, so a person should confirm.
8The merchant is Level 3 and the small-business plan is built for Level 4 merchants; the merchant processor decides what Level 2 and 3 merchants may use, so a person should confirm.
9This SAQ type requires quarterly external vulnerability scans but the quote lists no internet-facing IP addresses to scan.
10The merchant has 4 internet-facing IP addresses to scan but the quote covers only 3.
11The merchant has 6 internet-facing IP addresses to scan but the quote covers only 5.
12The quote covers 26 IP addresses; scanning at this size is quoted individually, so a person should confirm.
13The merchant has 4 machines to search for card data but the quote covers only 3.
14The merchant has 2 payment paths to monitor but the quote supports only 1.
15The quote adds extra payment paths to Shopping Cart Monitor Basic; the payment path add-on is offered on Plus and Pro.
16The merchant has 4 payment paths to monitor but the quote supports only 3.
17The merchant serves its own payment page, which falls under PCI DSS requirements 6.4.3 and 11.6.1 for payment page scripts, but the quote has no Shopping Cart Monitor.
18The quote has Shopping Cart Monitor but the merchant does not take payments on a website; the monitor protects e-commerce payment pages.
194 staff need security training but the quote covers only 3 training seats.
2026 staff need security training but the quote covers only 25 training seats.
2117 staff need security training but the quote covers only 16 training seats.
22The quote has a Guided HIPAA plan but the business does not handle protected health information.
23The quote has SecurityMetrics Pulse but no Pulse sensor; Pulse collects its scan, firewall and endpoint data through sensors.
24The quote has 2 Pulse sensors but not the Pulse service.
25The quote has a penetration test but names no IP addresses and no web applications to test.
26The penetration test covers 2 IP addresses but the vulnerability scans cover only 1; testers start from the vulnerability scan.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Online store, own payment page: A Level 4 online store that serves its own payment page

    
The agent's request. Please quote SecurityMetrics for a Level 4 merchant that serves its own payment page, for a 1-year term. Include PCI Compliance for Small Business with SAQ A. The merchant has 4 internet-facing IP addresses to scan. It has 6 staff members to train. Include SecurityMetrics Pulse. The quote states a total of $6,198.00 for 1 year. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • SAQ type does not fit how cards are taken. The SAQ type does not fit how the merchant takes cards; each processing method has its own SAQ (for example SAQ A for a fully outsourced checkout page, SAQ B-IP for a standalone IP terminal, SAQ P2PE for a validated P2PE terminal), and a merchant that stores card data uses SAQ D.
    • 
      
  • Own payment page without Shopping Cart Monitor. The merchant serves its own payment page, which falls under PCI DSS requirements 6.4.3 and 11.6.1 for payment page scripts, but the quote has no Shopping Cart Monitor.
    • 
      
  • More staff than training seats. 6 staff need security training but the quote covers only 1 training seats.
    • 
      
  • Pulse without a sensor. The quote has SecurityMetrics Pulse but no Pulse sensor; Pulse collects its scan, firewall and endpoint data through sensors.
    • 
      
  • Stated total does not match. The quote states a total of $6,198.00 for the term; the quote prices give $2,898.00.
    • 
    

    
2. Online store, own payment page: The agent resubmits after fixing the errors

    
The agent's request. Please quote SecurityMetrics for a Level 4 merchant that serves its own payment page, for a 1-year term. Include PCI Compliance for Small Business with SAQ A-EP. The merchant has 4 internet-facing IP addresses to scan. It has 6 staff members to train, with 5 extra training seats added. Include Shopping Cart Monitor Plus for 2 payment paths, with 1 extra payment path added. Include SecurityMetrics Pulse with 1 sensor. The quote states a total of $6,198.00 for 1 year. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • SAQ calls for a penetration test but none is quoted. This SAQ type includes the annual penetration test requirement but the quote has no penetration test; a person should confirm the merchant has it arranged elsewhere.
    • 
      
  • Quote summary. Annual charge of $6,198.00 and a term total of $6,198.00.
    • 
    

    
3. Online store, own payment page: The agent resubmits after fixing the errors

    
The agent's request. Please quote SecurityMetrics for a Level 4 merchant that serves its own payment page, for a 1-year term. Include PCI Compliance for Small Business with SAQ A-EP. The merchant has 4 internet-facing IP addresses to scan. It has 6 staff members to train, with 5 extra training seats added. Include Shopping Cart Monitor Plus for 2 payment paths, with 1 extra payment path added. Include SecurityMetrics Pulse with 1 sensor. Include a penetration test of 4 IP addresses and 1 web application. The quote states a total of $24,398.00 for 1 year. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Annual charge of $24,398.00 and a term total of $24,398.00.
    • 
    

    
4. Dental practice, HIPAA and PCI: A Level 4 dental practice quote with Guided HIPAA Basic and a mobile app

    
The agent's request. Please quote SecurityMetrics for a Level 4 merchant that takes cards on standalone IP terminals, for a 1-year term. Include PCI Compliance for Small Business with SAQ A. Include Guided HIPAA Basic for a practice that handles patient data. The merchant has 3 internet-facing IP addresses to scan. It has 12 staff members to train. Include mobile app testing for 1 app. The quote states a total of $1,898.00 for 1 year. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • SAQ type does not fit how cards are taken. The SAQ type does not fit how the merchant takes cards; each processing method has its own SAQ (for example SAQ A for a fully outsourced checkout page, SAQ B-IP for a standalone IP terminal, SAQ P2PE for a validated P2PE terminal), and a merchant that stores card data uses SAQ D.
    • 
      
  • More IP addresses than the scans cover. The merchant has 3 internet-facing IP addresses to scan but the quote covers only 1.
    • 
      
  • More staff than training seats. 12 staff need security training but the quote covers only 4 training seats.
    • 
      
  • Stated total does not match. The quote states a total of $1,898.00 for the term; the quote prices give $4,398.00.
    • 
    

    
5. Dental practice, HIPAA and PCI: The agent resubmits after fixing the errors

    
The agent's request. Please quote SecurityMetrics for a Level 4 merchant that takes cards on standalone IP terminals, for a 1-year term. Include PCI Compliance for Small Business with SAQ B-IP. Include Guided HIPAA Plus for a practice that handles patient data. The merchant has 3 internet-facing IP addresses to scan. It has 12 staff members to train. Include mobile app testing for 1 app. The quote states a total of $5,398.00 for 1 year. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Annual charge of $5,398.00 and a term total of $5,398.00.
    • 
    

    
6. Level 1 fuel retailer: A Level 1 fuel retailer on the small-business plan with a forensic investigation

    
The agent's request. Please quote SecurityMetrics for a Level 1 merchant that takes cards through a payment application connected to the internet, for a 3-year term. Include PCI Compliance for Small Business with SAQ C. The merchant has 12 internet-facing IP addresses to scan. It has 8 machines to search for card data. It has 1 staff member to train. Include a forensic investigation. The quote states a total of $399.00 for 3 years. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Level 1 merchant on the small-business plan. The merchant is Level 1; Level 1 merchants validate with an on-site PCI DSS audit by a Qualified Security Assessor, not the small-business self-assessment plan.
    • 
      
  • Level 1 merchant without a PCI audit. The merchant is Level 1 and takes cards but the quote has no PCI DSS audit.
    • 
      
  • More IP addresses than the scans cover. The merchant has 12 internet-facing IP addresses to scan but the quote covers only 1.
    • 
      
  • More machines than PANscan covers. The merchant has 8 machines to search for card data but the quote covers only 1.
    • 
      
  • Stated total does not match. The quote states a total of $399.00 for the term; the quote prices give $1,197.00.
    • 
      
  • Forensic investigation is quoted individually. The quote includes a forensic investigation, which is scoped and quoted individually, so a person should confirm.
    • 
      
  • Term longer than one year. The quote has a term of 3 years and prices are annual; a person should confirm the multi-year price.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a quote for SecurityMetrics: PCI Compliance for Small Business with the self-assessment questionnaire (SAQ) that fits how the merchant takes cards, Guided HIPAA, Shopping Cart Monitor, and more. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the packages, SAQ rules and dependencies SecurityMetrics describes publicly and returns a verdict, every reason, a line-item quote and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote SecurityMetrics for a Level 4 merchant that serves its own payment page, for a 1-year term. Include PCI Compliance for Small Business with SAQ A. The rest of the request is on screen. The quote states a total of $6,198.00 for 1 year.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with five findings, all in one answer. The SAQ type does not fit how the merchant takes cards; each processing method has its own SAQ (for example SAQ A for a fully outsourced checkout page, SAQ B-IP for a standalone IP terminal, SAQ P2PE for a validated P2PE terminal), and a merchant that stores card data uses SAQ D. The merchant serves its own payment page, which falls under PCI DSS requirements 6.4.3 and 11.6.1 for payment page scripts, but the quote has no Shopping Cart Monitor. 6 staff need security training but the quote covers only 1 training seats. The other two are on screen.
    6. 
      
  6. The validator returned five blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other and against the stated total.
    7. 
      
  7. What this shows: for an SAQ type that must follow how the merchant takes cards, a rules-based CPQ can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the SAQ type to SAQ A-EP. It sets the extra training seats to 5, the Shopping Cart Monitor to plus and the payment paths to monitor to 2. Two more changes are on screen.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. Not blocked, but held for a person.
    12. 
      
  12. The validator also returns the line-item quote. It starts with PCI Compliance for Small Business and SecurityMetrics Pulse (1 sensor included); the other three lines are on screen.
    13. 
      
  13. The five blocking findings are cleared; one approval remains for a person: SAQ calls for a penetration test but none is quoted.
    14. 
      
  14. The agent resubmits once more.
    15. 
      
  15. The revised request. It changes the stated total to $24,398.00. It sets the penetration test IP addresses to 4 and the penetration test web applications to 1.
    16. 
      
  16. It calls the validator once more.
    17. 
      
  17. This time the validator clears it.
    18. 
      
  18. The validator also returns the line-item quote. It starts with PCI Compliance for Small Business and SecurityMetrics Pulse (1 sensor included); the other six lines are on screen.
    19. 
      
  19. The earlier finding is cleared, and the validator's total, $24,398.00, matches the quote.
    20. 
      
  20. Five problems caught in one call, fixed in two passes, and a clean $24,398.00 quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    21.