Predictika · Firewall license quotes

An AI sales agent's firewall license quote, checked before it goes out

An AI sales agent prepares a license quote for a Sophos firewall with its bundle or individual subscriptions, support level, high availability and virtual core count. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of Sophos's published licensing rules and returns a verdict, every reason and the figures it computed.

Scope: Sophos Firewall (SFOS) license quotes: bundles, individual subscriptions, support, high availability and virtual cores. See everything this validator covers

This validator models license quotes for Sophos Firewall as described in the public Sophos documentation, not just the scenarios shown below.

  • Package and subscriptions — the Xstream Protection Bundle (Network, Web, Zero-Day and Central Orchestration, with Enhanced Plus support and Sophos Central management), the Standard Protection Bundle (Network, Web and Enhanced support) or individual subscriptions, and the features each one unlocks: intrusion prevention, web security, sandboxing, SD-WAN orchestration, email protection, the web application firewall and MDR.
  • Support and management — telephone, chat and case support need a bundle or an Enhanced or Enhanced Plus subscription; Sophos Central management needs a paid subscription; the number of subscriptions the quote states must match the package and additions.
  • High availability and virtual firewalls — a license on every active firewall; matching license types and expiry dates in an active-active pair (a gap over three days is blocked, a gap of one to three days needs a person); support levels for advance hardware replacement in active-passive and active-active pairs; virtual CPU cores within the licensed cores; terms longer than one year and subscriptions already in the bundle go to a person.

Any quote for Sophos Firewall that touches these rules is in scope — not only the scenarios pictured here. Not covered: prices (Sophos publishes no price list in these documents, so this validator produces no price build-up or line-item quote), hardware appliance model SKUs, virtual core tier SKUs, other Sophos products, and regional availability.

The AI sales agentBuilds the license quote from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Features that need a particular subscriptionOnly with care
A product rule per feature and subscription. It works, but every new subscription or bundle changes the rules to maintain.		Every package, subscription and requirement is in one request and every pairing is checked together.
Pairs of firewalls that must matchOnly with workarounds
License types, expiry dates and counts live on different lines, so the rules need cross-line comparisons that interact with each other.		Both firewalls are in one request, so a mismatch is found whichever order the choices arrive in.
Support needed for replacement and for phone helpOnly with care
Each requirement depends on the pair type and on the support level on a different line; each needs its own rule.		The support level is compared with every requirement on every call.
A stated subscription count that must matchOnly with care
A stated figure is a free-entry field; a rule can compare it with a computed count, but someone has to write and maintain it.		The stated count travels with the quote and is compared with the computed count on every call.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1Intrusion prevention (IPS) needs the Network Protection subscription, which is neither in the package nor added on the quote.
2Web security and application control need the Web Protection subscription, which is neither in the package nor added on the quote.
3Sandboxing file analysis needs Zero-Day Protection, which is neither in the package nor added on the quote.
4SD-WAN VPN orchestration needs Central Orchestration, which is neither in the package nor added on the quote.
5Anti-spam and email malware protection need the Email Protection subscription, which neither bundle includes and the quote does not add.
6The web application firewall needs the Webserver Protection subscription, which neither bundle includes and the quote does not add.
7MDR, NDR Essentials and third-party threat feeds are part of the Xstream Appliance Bundle; the quote has a different package.
8Sophos Central firewall management needs a paid subscription, a bundle or a support license; the base license alone is not enough.
9Telephone, chat and case support need a bundle or an Enhanced or Enhanced Plus support subscription; the quote has none.
10The quote licenses 1 firewall(s); this deployment needs licenses on 2 active firewall(s).
11In an active-active pair both firewalls must have the same license types.
12The two firewalls license expiry dates differ by 2 days; load balancing stops while the licenses differ, so a person should confirm the renewal plan.
13The two firewalls license expiry dates differ by 5 days; after three days of mismatched licenses an active-active pair is disabled.
14Advance hardware replacement for both firewalls of an active-passive pair needs Enhanced Plus Support on the primary firewall.
15Advance hardware replacement for an active-active pair needs Enhanced or Enhanced Plus Support on both firewalls; the quote has no support subscription.
16The virtual firewall would use 8 CPU cores but the license allows 4.
17A term of 3 years is an irregular term; terms longer than one year go through a Sophos partner.
18A subscription on the quote is already included in the selected bundle; a person should confirm it is not a duplicate.
19The quote states 5 subscriptions per firewall; the package and additions add up to 6.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Packages and features: A Standard bundle quote where the customer needs sandboxing and MDR

    
The agent's request. Please quote a hardware Sophos firewall with the Standard Protection Bundle, in a standalone setup. The customer needs intrusion prevention, web security, sandboxing, MDR. The quote licenses 1 firewall(s). It states 3 subscriptions per firewall. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Sandboxing needs Zero-Day Protection. Sandboxing file analysis needs Zero-Day Protection, which is neither in the package nor added on the quote.
    • 
      
  • MDR and NDR need the Xstream bundle. MDR, NDR Essentials and third-party threat feeds are part of the Xstream Appliance Bundle; the quote has a different package.
    • 
    

    
2. Packages and features: The agent resubmits after fixing the errors

    
The agent's request. Please quote a hardware Sophos firewall with the Xstream Protection Bundle, in a standalone setup. The customer needs intrusion prevention, web security, sandboxing, MDR. The quote licenses 1 firewall(s). It states 6 subscriptions per firewall. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. 6 subscription(s) per firewall; 1 firewall(s) licensed.
    • 
    

    
3. High availability: An active-active pair with one license, different license types and a 10-day expiry gap

    
The agent's request. Please quote a hardware Sophos firewall with the Standard Protection Bundle, in an active-active pair. The customer needs advance hardware replacement. The quote licenses 1 firewall(s), with different license types, with an expiry gap of 10 days. It states 3 subscriptions per firewall. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Not enough licensed firewalls. The quote licenses 1 firewall(s); this deployment needs licenses on 2 active firewall(s).
    • 
      
  • Active-active pair needs identical licenses. In an active-active pair both firewalls must have the same license types.
    • 
      
  • License expiry gap disables the active-active pair. The two firewalls license expiry dates differ by 10 days; after three days of mismatched licenses an active-active pair is disabled.
    • 
    

    
4. High availability: The agent resubmits after fixing the errors

    
The agent's request. Please quote a hardware Sophos firewall with the Standard Protection Bundle, in an active-active pair. The customer needs advance hardware replacement. The quote licenses 2 firewall(s), with matching license types, with an expiry gap of 2 days. It states 3 subscriptions per firewall. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • License expiry gap in an active-active pair. The two firewalls license expiry dates differ by 2 days; load balancing stops while the licenses differ, so a person should confirm the renewal plan.
    • 
      
  • Quote summary. 3 subscription(s) per firewall; 2 firewall(s) licensed.
    • 
    

    
5. High availability: The agent resubmits after fixing the errors

    
The agent's request. Please quote a hardware Sophos firewall with the Standard Protection Bundle, in an active-active pair. The customer needs advance hardware replacement. The quote licenses 2 firewall(s), with matching license types, with an expiry gap of 0 days. It states 3 subscriptions per firewall. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. 3 subscription(s) per firewall; 2 firewall(s) licensed.
    • 
    

    
6. Virtual firewalls: A virtual firewall with individual subscriptions, no support and too few cores

    
The agent's request. Please quote a virtual Sophos firewall with individual subscriptions and no support subscription, in a standalone setup, plus Network Protection, Web Protection. The customer needs Sophos Central management, telephone support. The quote licenses 1 firewall(s) and 4 licensed cores for 8 cores in use. It states 2 subscriptions per firewall. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Support team access needs a support subscription. Telephone, chat and case support need a bundle or an Enhanced or Enhanced Plus support subscription; the quote has none.
    • 
      
  • Virtual firewall uses more cores than licensed. The virtual firewall would use 8 CPU cores but the license allows 4.
    • 
    

    
7. Virtual firewalls: The agent resubmits after fixing the errors

    
The agent's request. Please quote a virtual Sophos firewall with the Xstream Protection Bundle, in a standalone setup. The customer needs Sophos Central management, telephone support. The quote licenses 1 firewall(s) and 8 licensed cores for 8 cores in use. It states 6 subscriptions per firewall. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. 6 subscription(s) per firewall; 1 firewall(s) licensed.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a license quote for a Sophos firewall with its bundle or individual subscriptions, support level, high availability and virtual core count. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of Sophos's published licensing rules and returns a verdict, every reason and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote a hardware Sophos firewall with the Standard Protection Bundle, in an active-active pair. The customer needs advance hardware replacement. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with three findings, all in one answer. The quote licenses 1 firewall(s); this deployment needs licenses on 2 active firewall(s). In an active-active pair both firewalls must have the same license types. The two firewalls license expiry dates differ by 10 days; after three days of mismatched licenses an active-active pair is disabled.
    6. 
      
  6. The validator returned three blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other.
    7. 
      
  7. What this shows: for pairs of firewalls that must match, a rules-based CPQ can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the firewalls licensed to 2, the licenses match in the pair to yes and the expiry gap to 2 days.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. Not blocked, but held for a person.
    12. 
      
  12. The three blocking findings are cleared; one approval remains for a person: license expiry gap in an active-active pair.
    13. 
      
  13. The agent resubmits once more.
    14. 
      
  14. The revised request. It changes the expiry gap to 0 days.
    15. 
      
  15. It calls the validator once more.
    16. 
      
  16. This time the validator clears it.
    17. 
      
  17. The earlier finding is cleared.
    18. 
      
  18. Three problems caught in one call, fixed in two passes, and a clean quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    19.