Privileged Access Management (PAM) Selling to the CISO — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **Privileged Access Management (PAM) Selling to the CISO** is a 60-minute training for AEs, SEs, and channel managers running $200K–$2.5M ACV cycles against incumbents like **CyberArk**, **BeyondTrust**, **Delinea** (Thycotic + Centrify), **Microsoft Privileged Identity Management**, **HashiCorp Boundary + Vault**, **Saviynt**, **One Identity Safeguard**, **Wallix**, and **Britive**. The session teaches sellers to qualify against the **three-buyer reality (CISO, IAM Architect, Cyber-Insurance Broker)**, run a structured discovery on **just-in-time-access and session-recording economics**, demo against the customer's actual privileged-account inventory, and trap-set the multi-year renewal at month 18. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why PAM Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. PAM deals are **insurance-driven** — the cyber-insurance broker now insists on PAM before binding most ransomware-heavy industries. The CISO funds it; the IAM Architect picks it; the broker enforces it.

Set the frame on the whiteboard.

- **Three buyers, one driver.** The CISO funds; the IAM Architect picks; the cyber-insurance broker enforces. **Coalition's 2026 binding data** shows PAM as a top-3 required control for mid-market manufacturing and healthcare.
- **Just-in-time (JIT) access is the new default.** Standing privileged access is dead. **CyberArk's** and **HashiCorp Boundary's** customers run JIT for 80%+ of admin sessions.
- **Session recording is the audit-defensibility wedge.** Regulators (OCC, FCA, MAS) increasingly request session-recording evidence on privileged sessions during examinations.

End the segment with **Mark Roberge's** rule: *"Sell the audit defensibility, not the password vault."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your current privileged-access inventory — admin accounts, service accounts, secrets in code repos."
> 2. **JIT baseline (10 min):** "What percentage of admin sessions today use just-in-time elevation vs. Standing privileges? Best-in-class is **80%+ JIT**."
> 3. **Session-recording coverage (10 min):** "What percentage of privileged sessions are recorded today? Regulators expect **100% on Tier-1 systems**."
> 4. **Secrets sprawl (10 min):** "Where do secrets live today — code repos, CI/CD, config files, password managers? Best-in-class consolidates into **HashiCorp Vault** or **CyberArk Conjur**."
> 5. **MFA coverage on privileged (8 min):** "What percentage of privileged accounts have phishing-resistant MFA today? Cyber-insurance carriers require **100%**."
> 6. **Service-account hygiene (7 min):** "How many service accounts exist, and what percentage have been rotated in the last 90 days?"
> 7. **Renewal posture (5 min):** "When is your current PAM contract up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CISO + IAM Architect + Broker?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[JIT + Session Recording 20 min]
    E --> F[Secrets Sprawl + MFA Coverage 18 min]
    F --> G[Service Account + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[POC Kicked Off Within 14 Days]
    I --> J[Joint IAM Architect Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **Sandbox-only POCs.** **30-day POCs.** **Single-account-type POCs** (failing to cover human, service, and machine accounts together).

**Wins to coach.** **Real privileged-account inventory ingested.** Walk through **CyberArk's and BeyondTrust's published POC agendas** — both require the customer to send the full privileged-account inventory before the POC. **JIT-elevation flow demonstrated live.** Show the JIT request-approve-elevate-record-deprovision cycle on the customer's environment. **Session-recording playback delivered.** Hand the CISO a recorded session for a real admin task with annotation timestamps.

End with **Andy Paul's** rule: *"Show the customer their standing privileges deleted, not your vault expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **CyberArk**, **BeyondTrust**, and **Delinea** in eight out of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The JIT-coverage wedge.** Ask: *"What percentage of your incumbent's deployment uses JIT vs. Standing privileges? Best-in-class is **80%+ JIT**."*

**Counter-move 2 — The cloud-native wedge.** Ask: *"Does your incumbent natively integrate with AWS IAM, Azure AD PIM, and Google Cloud Workload Identity? **HashiCorp Boundary** and **Britive** lead here."*

**Counter-move 3 — The cyber-insurance wedge.** Ask the broker: *"Is t

Privileged Access Management (PAM) Selling to the CISO — 60-Min Training

Direct Answer

Section 1 — Why PAM Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

Privileged Access Management (PAM) Selling to the CISO — 60-Min Training

Direct Answer

Section 1 — Why PAM Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

What does the score mean?