Predictika · Cyber GRC subscription and services quotes

An AI sales agent's cyber GRC quote, checked before it goes out

An AI sales agent prepares a quote for a cyber governance, risk and compliance platform: the compliance framework, deployment, optional AI capability, support and cybersecurity services, and the term. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the offering and returns a verdict, every reason and the figures it computed.

Scope: Cyber GRC quotes in the style of Telos Xacta: framework content, deployment, Xacta.ai, support, cybersecurity services and term. See everything this validator covers

This validator models quotes for a cyber GRC automation platform built from the Xacta and cybersecurity services names in Telos Corporation's annual report, not just the scenarios shown below.

  • Platform — Xacta frameworks (NIST Risk Management Framework, the Cybersecurity Risk Management Construct for DoW IT, NIST Cybersecurity Framework, FedRAMP and CMMC), cloud, on-premises or hybrid deployment, Xacta.ai, and support (standard and premium*). FedRAMP needs the cloud or a hybrid deployment, CMMC is for defense contractors, the DoW construct is for federal customers and Xacta.ai needs the cloud.
  • Services — RMF consulting, security assessment, penetration testing and digital forensics, with service days computed per system from the impact level; the quote's stated service days are compared with the computed days.
  • Term and approvals — terms of one to five years (over three years go to a person), very large deployments, high-impact systems without an assessment and Xacta.ai for a federal customer go to a person. Premium support* is illustrative; Telos does not publish editions, rules or prices, so every rule and service day figure is typical for this kind of product, not published by Telos.

Any Xacta-style quote that touches these rules is in scope — not only the scenarios pictured here. Not covered: prices (this validator produces no price build-up or line-item quote), Telos AMHS, TSA PreCheck enrollment, IDVetting, Aviation Channeling Services, ONYX, secure networks services and engineering and operations services. Items marked with an asterisk (*) are illustrative. Telos has not published, approved or used these rules; all customers and systems are fictional.

The AI sales agentBuilds the GRC quote from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Frameworks that fit only some customers and deploymentsOnly with care
FedRAMP needs the cloud, CMMC is for contractors and the DoW construct for federal customers; each is a rule across the framework, deployment and customer lines that has to be written and kept in step.		Framework, deployment and customer are in one request and the pairings are checked together.
An AI add-on that depends on the deploymentOnly with care
A dependency from an add-on on one line to the deployment on another; it works, but every new add-on needs its own rule.		The add-on and the deployment are in one request and the dependency is checked with everything else.
Service days that must match the services chosenOnly with workarounds
Days depend on the impact level, the services picked and the number of systems; a stated figure is a free-entry field, so the sum and the comparison need their own maintained logic.		Service days are computed on every call and compared with the figure the quote states.
Thresholds that send a quote to a personOnly with workarounds
Term, size, impact and AI approvals depend on several lines at once, so they usually live in a separate approval process and are easy to miss.		Each threshold is evaluated on the quote and returned as a finding with the rest.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as a step is saved, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1The quote covers 0 systems; a Xacta quote needs at least one system.
2Subscription terms run from 1 to 5 years; the quote has 0 years.
3A 5-year term needs deal desk approval.
4Subscription terms run from 1 to 5 years; the quote has 6 years.
5A 6-year term needs deal desk approval.
6FedRAMP authorizes cloud services; an on-premises deployment cannot carry the FedRAMP content.
7CMMC applies to defense contractors, which are commercial customers; it is not sold to federal or state and local agencies.
8The Cybersecurity Risk Management Construct for Department of War IT is for federal customers.
9Xacta.ai runs in the cloud; it needs the cloud or hybrid deployment, not on-premises only.
10Xacta.ai for a federal customer needs a security and data-handling review before it is quoted.
11Premium support is sold from 5 systems; the quote has 4 systems.
12The quote states 500 service days, but the services on it add up to 320 days.
13The quote states 100 service days, but the services on it add up to 320 days.
14250 systems is a very large deployment; solution architecture reviews the sizing.
15High-impact systems normally include a security assessment; the quote has none, so a person must confirm the customer provides its own.
16A 4-year term needs deal desk approval.
17Subscription terms run from 1 to 5 years; the quote has 7 years.
18Premium support is sold from 5 systems; the quote has 3 systems.
19The quote states 10 service days, but the services on it add up to 48 days.
20A 7-year term needs deal desk approval.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Defense contractor: A defense contractor quote with the DoW construct, on premises with Xacta.ai

    
The agent's request. Please quote a 2-year Xacta subscription for a commercial customer: the Cybersecurity Risk Management Construct for DoW IT content for 12 moderate-impact systems on an on-premises deployment, standard support, with Xacta.ai, plus RMF consulting. The quote states 96 service days. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • DoW construct for a commercial customer. The Cybersecurity Risk Management Construct for Department of War IT is for federal customers.
    • 
      
  • Xacta.ai on an on-premises deployment. Xacta.ai runs in the cloud; it needs the cloud or hybrid deployment, not on-premises only.
    • 
    

    
2. Defense contractor: The agent resubmits after fixing the errors

    
The agent's request. Please quote a 2-year Xacta subscription for a commercial customer: CMMC content for 12 moderate-impact systems on a hybrid deployment, standard support, with Xacta.ai, plus RMF consulting. The quote states 96 service days. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 12 systems, 96 service days.
    • 
    

    
3. Agency RMF program: An agency program for 40 high-impact systems with a six-year term and a wrong service-day figure

    
The agent's request. Please quote a 6-year Xacta subscription for a federal agency customer: the NIST Risk Management Framework content for 40 high-impact systems on a cloud deployment, standard support, plus RMF consulting. The quote states 300 service days. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Term outside 1 to 5 years. Subscription terms run from 1 to 5 years; the quote has 6 years.
    • 
      
  • Stated service days differ from the quote. The quote states 300 service days, but the services on it add up to 480 days.
    • 
      
  • Term over three years. A 6-year term needs deal desk approval.
    • 
      
  • High-impact systems without an assessment. High-impact systems normally include a security assessment; the quote has none, so a person must confirm the customer provides its own.
    • 
    

    
4. Agency RMF program: The agent resubmits after fixing the errors

    
The agent's request. Please quote a 4-year Xacta subscription for a federal agency customer: the NIST Risk Management Framework content for 40 high-impact systems on a cloud deployment, standard support, plus RMF consulting. The quote states 480 service days. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Term over three years. A 4-year term needs deal desk approval.
    • 
      
  • High-impact systems without an assessment. High-impact systems normally include a security assessment; the quote has none, so a person must confirm the customer provides its own.
    • 
      
  • Order summary. 40 systems, 480 service days.
    • 
    

    
5. Agency RMF program: The agent resubmits after fixing the errors

    
The agent's request. Please quote a 3-year Xacta subscription for a federal agency customer: the NIST Risk Management Framework content for 40 high-impact systems on a cloud deployment, standard support, plus RMF consulting and security assessment. The quote states 960 service days. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 40 systems, 960 service days.
    • 
    

    
6. Cloud provider FedRAMP: A cloud provider FedRAMP quote on premises with premium support on 3 systems

    
The agent's request. Please quote a 2-year Xacta subscription for a commercial customer: FedRAMP content for 3 moderate-impact systems on an on-premises deployment, premium support, plus RMF consulting, security assessment and penetration testing. The quote states 63 service days. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • FedRAMP on an on-premises deployment. FedRAMP authorizes cloud services; an on-premises deployment cannot carry the FedRAMP content.
    • 
      
  • Premium support on a very small deal. Premium support is sold from 5 systems; the quote has 3 systems.
    • 
    

    
7. Cloud provider FedRAMP: The agent resubmits after fixing the errors

    
The agent's request. Please quote a 2-year Xacta subscription for a commercial customer: FedRAMP content for 6 moderate-impact systems on a cloud deployment, premium support, plus RMF consulting, security assessment and penetration testing. The quote states 126 service days. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 6 systems, 126 service days.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a quote for a cyber governance, risk and compliance platform: the compliance framework, deployment, optional AI capability, and more. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the offering and returns a verdict, every reason and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote a 6-year Xacta subscription for a federal agency customer: the NIST Risk Management Framework content for 40 high-impact systems on a cloud deployment, standard support, plus RMF consulting. The quote states 300 service days. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with two findings and two approvals, all in one answer. Subscription terms run from 1 to 5 years; the quote has 6 years. The quote states 300 service days, but the services on it add up to 480 days.
    6. 
      
  6. The validator returned two blocking findings and two approvals in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other.
    7. 
      
  7. What this shows: for service days that must match the services chosen, a rules-based CPQ can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the term to 4 years and the stated service days to 480.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. Not blocked, but held for a person.
    12. 
      
  12. The two blocking findings are cleared; two approvals remain for a person: term over three years and high-impact systems without an assessment.
    13. 
      
  13. The agent resubmits once more.
    14. 
      
  14. The revised request. It changes the term to 3 years, the services to rmf consulting, security assessment and the stated service days to 960.
    15. 
      
  15. It calls the validator once more.
    16. 
      
  16. This time the validator clears it.
    17. 
      
  17. Both earlier findings are cleared, and the validator's figure matches the quote.
    18. 
      
  18. Four problems caught in one call, fixed in two passes, and a clean quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    19.