Starting Point: Your Credential Reality

• How many privileged credentials do you currently track in your formal inventory? Options: <50, 50-200, 201-1000, >1000, We do not have a formal inventory
• Walk me through the last privileged-account discovery you ran, what it found, and any surprises.
• Who is the single owner of your privileged-credential inventory, and how often does that owner reconcile it? Options: Security team, IAM/Identity team, Platform/DevOps, Application teams, No single owner, Other
• Which classes of credentials are most likely to be missing from your inventory? Options: Service accounts in CI/CD pipelines, Kubernetes or container service accounts, Credentials embedded in scripts or IaC, Shared local admin passwords, Cloud root keys or long-lived API keys, Other
• In a typical week, how often are shared administrative credentials checked out by people or automation? Options: Multiple times per day, Daily, Weekly, Less often, Unknown

Where Things Break: Audit Triggers and Pain

• What single audit finding or incident would make your leadership demand immediate fixes to privileged access? Options: Shared admin passwords in spreadsheets, Unrotated service account used in a breach post-mortem, Lack of session recording for privileged access, Failed cyber insurance control, Other
• When that kind of finding happened previously, who was held accountable and what actions followed?
• How many service accounts or automation credentials failed rotation in the past 12 months? Options: None that we know, 1-5, 6-20, 21-100, More than 100, Unknown
• What breaks downstream when a credential rotation fails—CI/CD pipelines, scheduled jobs, or customer-facing services? Options: CI/CD pipelines, Scheduled jobs/cron, Production services, Backups and replication, Monitoring and alerting, Multiple of the above
• Tell the story of the most recent incident where a privileged credential caused downtime or a security gap—what happened and how long did recovery take?

Hidden Inventory: Discovery Depth and Surprises

• If your discovery scan found two to three times more credentials than listed, what would that imply about your current controls? Options: Undercounted risks and immediate remediation required, Process gaps but manageable with project work, We would need a multi-team cleanup project, It would trigger an audit or insurance escalation, Unsure
• How do you currently locate credentials embedded in container manifests, IaC templates, or scripted automation? Options: Automated secret scanning in repos, Manual code reviews or pull-request checks, Rely on developers to flag them, We do not scan these artifacts, Other
• Who on your team can map a service account's full dependency chain across systems? Options: Platform/DevOps engineers, Application owners, Central security or IAM, No one can fully map it today, Other
• What tooling or logs would we need access to for a thorough discovery scan, for example cloud audit logs, container registries, or CI/CD traces? Options: Cloud audit logs, Container orchestration control plane, CI/CD system access, Source code repositories, Existing secrets management systems, Other
• If discovery identifies critical credentials you cannot immediately vault, which interim mitigations would be acceptable to your team? Options: Emergency rotation windows, Temporary increased monitoring and alerting, Allowlisting by IP or time windows, Staged vaulting after testing, No interim mitigations acceptable

The Other Paths You're Weighing and What Would Keep You With Them

• What would have to be true about your current approach for you to keep it rather than bring in an external privileged-access solution? Options: Rotation already automated and reliable, Session forensics already accepted by auditors, Costs to change outweigh benefits, Internal team can deliver required scope and timeline, Other
• Which alternatives have you actively evaluated or are planning to evaluate? Options: Incumbent vendor PAM, Homegrown rotation scripts, Cloud-provider native secrets manager, Endpoint agent-based PAM, No alternatives evaluated yet, Other
• Who internally has proposed a do-it-yourself route and what resource commitment did they estimate? Options: Security team, DevOps, SRE, Application teams, No internal proposal, Other
• What single metric about your current solution would have to be beaten by the pilot to keep decision makers from switching? Options: Mean time to rotate (MTTR), Rotation failure rate, Audit acceptance of session logs, Total cost of ownership, Time to remediate compromised credential
• How much executive sponsorship and budget would it take to sign a new vendor within 30 days if the pilot proves the numbers? Options: Already committed, budget approved, Sponsor identified, budget pending, Sponsor possible, budget needs approval, No sponsor identified or budget, Unsure

Concrete Constraints: Readiness, Integrations, and Gates

• Which integration or compliance gap could stop this project before it starts? Options: Missing API access to target systems, No owner for secrets in source repos, Regulatory approvals pending, Insufficient headcount for the pilot, Network segmentation or change approvals required, Other
• Which specific systems must we integrate with during the pilot, for example cloud providers, on-prem directories, CI/CD, or container orchestration? Options: Cloud provider IAM, On-prem Active Directory or LDAP, CI/CD pipelines, Container orchestration (Kubernetes), Source code repositories, Third-party SaaS systems, Other
• Who owns the APIs or service accounts the seller would need to read or rotate credentials, and can they grant access within two weeks? Options: Security/IAM, Platform/DevOps, Application team, Third-party vendor, No owner identified yet
• Do you have a maintenance window policy or change control process that would prevent rotation during business hours? Options: Yes, strict windows only, Flexible with approvals, Ad-hoc approvals required, No formal process
• Please select the number of engineers who can commit at least four hours per week to support pilot activities such as discovery, testing, and remediation. Options: 0, 1-2, 3-5, 6-10, More than 10, Unsure
• Are there contractual or regulatory controls that restrict storing or rotating certain credentials in a third-party vault? Options: Yes, several restrictions, Some restrictions requiring review, No restrictions, Unsure

Pilot Scope That Will Win the Audit

• If the pilot only vaulted 50 credentials, what criteria must those 50 meet to convince your auditor and leadership? Options: Highest criticality and business impact, Service accounts tied to production, Credentials cited in past incidents, Cross-domain critical infrastructure, Other
• Which credential criticality tiers do you use today and how are they defined? Options: High/Medium/Low by business impact, Classified by automation impact, Ranked by blast radius, No formal tiers today, Other
• What acceptance criteria will the pilot need to meet for you to greenlight wider rollout, for example rotation success rate, absence of outages, or auditor sign-off? Options: Rotation success >= 95% without outages, Session recordings meet auditor requirements, Discovery uncovers acceptable number of unknowns, All of the above, Other
• Who must sign the pilot acceptance certificate for the buyer side—security, operations, service owners, or audit? Options: CISO or security leader, Director of IT/Operations, Service owners, Internal audit, Multiple of the above
• If the pilot meets its goals, what would accelerate procurement to complete within 30 days? Options: Pre-approved budget and contract templates, Executive sponsor commitment, Technical success and auditor endorsement, Nothing will accelerate it, Other

Operational Detail: Day-One Readiness and Safeguards

• Name the operational gate that would force you to pause the rollout on day one. Options: Unexpected service dependencies discovered, Change control denial, No rollback plan in place, Insufficient backups or failover, Key owner unavailable, Other
• Which rollback mechanisms do you currently have for credentials that fail rotation, manual rollback, staged redeploy, or full restore? Options: Manual credential restore documented, Automated rollback in orchestration, Staged rollout with monitoring and canary, No rollback mechanisms documented, Other
• Who will be the named owner for day-to-day pilot operations on your side? Options: Platform/DevOps lead, Security engineer, SRE manager, Application owner, No owner assigned yet
• Can your teams permit a non-production schedule of credential rotation tests within a 30-day pilot window? Options: Yes, with defined windows, Yes, but severely limited, Not without formal change approvals, No
• Which logs or artifacts must we retain from session recording to satisfy your audit—keystroke-level recording, video, metadata, or summarized transcripts? Options: Keystroke-level or session video, Detailed metadata and command logs, Summarized transcripts, All of the above, Other

Final Gate: Costs, Timeline, and Decision Triggers

• If the pilot proves rotation and forensic capture, what would stop procurement from buying this solution now? Options: Budget constraints, Legal or contract concerns, Vendor compliance or risk issues, No internal process to onboard a new vendor, Nothing, we would proceed
• What timeline do you require from pilot completion to enterprise rollout? Options: Immediate (0-30 days), 30-90 days, 3-6 months, 6-12 months, Depends on pilot outcomes
• Who must be engaged in pricing and commercial discussion to sign a contract? Options: Procurement, Legal, CISO or security leadership, IT operations finance, All of the above
• What internal change management steps are non-negotiable before enterprise rollout? Options: Communication to all privileged users and admins, Training for operators and on-call teams, Updated runbooks and playbooks, Regulatory approvals or audit reviews, Other
• Identify the single success metric that would convince your leadership to fund a full rollout. Options: Reduction in unvaulted credentials by a target percent, Zero rotation-related outages during pilot, Auditor acceptance of session logs, Faster mean time to detect and respond, Other

• Privileged Access Solution Experience

• Confirm the current state and its cost
• You confirm the stated current state and accept the quantified cost and risk that drives urgency for the pilot.
• Seller to run a privileged discovery scan across the agreed scope and deliver the findings and dependency map before the next session.
• You confirm the proposed 50-account pilot scope and the critical service-account dependencies that must be preserved during rotation.
• Map the pilot scope and high-risk workflows
• Seller to provide a pilot configuration template showing rotation policies, rollback steps, and session-retention defaults for buyer review.
• You confirm the demonstrated rotation and rollback flow will not break your automated workflows for the tested cases.
• Buyer to provide the initial list of 50 high-risk credentials and identify owners for each service account.
• Prove discovery and vaulting on a representative target
• You confirm the session recording and searchable metadata meet the auditor's needs for forensic review.
• Prove rotation, rollback, and integration safety
• Buyer to grant the read-only access or network visibility required for the discovery scan on the agreed pilot targets.
• You agree on the remaining evidence and next technical steps required to start the pilot within the desired timeline.
• Buyer to confirm acceptance criteria for the 30-day pilot, including allowable checkout latency and required audit evidence.
• Prove session recording and forensic search
• Validate UX and acceptance criteria
• Forced validation, confirm alignment

• Solution Experience: Privileged Access Workflow Walkthrough
• Solution Experience Deck
• Privileged Access Solution Brief

• meeting
• slides
• document

• Discover Privileged Credentials
• Migrate Stored Credentials from Spreadsheets and Personal Vaults
• Vault Privileged Credentials
• Vault CI/CD and Container Secrets
• Map Service-Account Dependencies
• Automate Credential Rotation
• Test Rotations for Automated Service Accounts
• Deploy Agentless Session Broker
• Record Privileged Sessions with Metadata
• Export Session Recordings and Audit Packages
• Configure Privileged Access Workflows (Checkout/RBAC)
• Enable Break-Glass Emergency Access
• Provision Secrets Management API Access
• Monitor and Alert on Credential and Session Anomalies

Discover Privileged Credentials

• Which account types do you expect discovery to find in your estate (for example: Windows domain admins, Linux root accounts, database admin users, API tokens stored in config files)? Options: Windows domain accounts, Local root/root-equivalent accounts, Database admin accounts, API tokens in config files, Other
• How many target hosts, containers, and cloud accounts should the initial discovery scan include (provide a count or range for servers, Kubernetes clusters, and cloud console accounts)? Options: Less than 100 targets, 100-1,000 targets, 1,000-10,000 targets, More than 10,000 targets
• Where are your current privileged credential inventories kept today (list spreadsheets, shared drives, personal vaults, or infrastructure as code repositories by path or location)? Options: Spreadsheets / shared drives, Personal password vaults, Configuration management database (CMDB), Source code or IaC repositories, No inventory
• Who owns the inventory refresh process for privileged accounts (name the team or role responsible for Active Directory, Kubernetes service accounts, and cloud console accounts)? Options: Security team, Platform/infra team, Application team, No single owner
• Provide the top three CI/CD repositories or pipeline identifiers to scan for embedded secrets during discovery (list repository path or pipeline ID).

Migrate Stored Credentials from Spreadsheets and Personal Vaults

• Which spreadsheets, shared drives, or personal vault collections contain admin passwords that must be migrated (provide file paths or folder names)?
• How many credential records are in-scope for migration from spreadsheets and personal vaults for the pilot (estimate count)? Options: Less than 50, 50-200, 201-1,000, More than 1,000
• Where do migrated entries require mapping to existing application/service owners (provide the list of application names or service IDs that reference these credentials)?
• Do you require automated deduplication and normalization when importing spreadsheet credentials (for example, normalize username formats or merge duplicates)? Options: Yes, full automation, Yes, with manual review, No, manual migration only
• Describe any credentials that must be excluded from migration or quarantined (for example: contractor test accounts, sandbox accounts, or privileged accounts tied to legacy hardware).

Vault Privileged Credentials

• Which target platforms should receive vault connectors in the pilot (specify by platform type and example host groups, e.g., Linux prod servers group 'prod-web', Windows domain 'corp.local')? Options: Windows servers, Linux servers, Network devices, Databases, Cloud console accounts
• How many credential types do you want vaulted during pilot (passwords, SSH keys, API tokens, certificates)? Options: Passwords, SSH keys, API tokens, X.509 certificates
• Specify the criticality tiers you assign to credentials and examples for each tier (for example: Tier 0 = domain controllers, Tier 1 = production DB admin, Tier 2 = dev service accounts).
• For which credential tiers do you require multi-approver checkout or privileged session gating? Options: Tier 0 only, Tier 0 and Tier 1, All tiers, No multi-approver required
• Confirm the pilot vaulting threshold you expect (for example: vault the 50 highest-risk credential sets discovered during the initial scan). Options: 50 highest-risk credentials, 100 highest-risk credentials, Custom

Vault CI/CD and Container Secrets

• Which CI/CD pipelines or repository paths should be scanned and captured for secrets in the pilot (list pipeline IDs or repo paths for your build system and IaC repos)?
• How many Terraform state files, Helm charts, or environment variable files do you estimate need secrets extraction in pilot (provide approximate count or repository locations)? Options: Less than 50 files, 50-200 files, 201-1,000 files, More than 1,000 files
• Do any of your pipelines perform automated credential rotation that could conflict with centralized vault rotation (for example, custom scripts that rehydrate secrets at deploy time)? Options: Yes, multiple pipelines, Yes, a small number, No, Unknown
• Which container orchestration clusters (by cluster name) must be included to detect Kubernetes service account tokens and in-cluster secrets?
• Describe any immutable or signed deployment artifacts where replacing embedded secrets is disallowed during pilot (for example, signed container images or firmware bundles).

Map Service-Account Dependencies

• Identify the automated jobs, cron tasks, and scheduled functions that run under service accounts and provide example job names or IDs.
• How many service accounts are referenced in your infrastructure as code repositories (provide an estimate or code paths where they appear)? Options: Less than 50, 50-200, 201-1,000, More than 1,000
• Which three business-critical services would fail if a given service-account credential rotated without dependency mapping (list service names or API endpoints)?
• Who is the owner for each service-account group (application team, platform team, or other) — provide team names or on-call rosters where available. Options: Application team, Platform/infra team, Security team, Other
• Which safe change windows or maintenance windows exist for updating service-account credentials for production jobs (provide windows by timezone and days)? Options: Nightly maintenance window, Weekend maintenance, Anytime with rollback plan, Custom schedule

Automate Credential Rotation

• How should rotation cadence be defined by criticality tier (for example: Tier 0 weekly, Tier 1 monthly, Tier 2 quarterly)?
• How should rotation be coordinated with dependent automation such as CI/CD jobs and scheduled tasks (pause jobs, staged rollout, or API-driven swap) for each affected pipeline? Options: Pause automation during rotation, API-driven rotate with backoff, Notify owners and rotate, Custom process
• Do you require staged verification prior to promoting rotated credentials to production (for example smoke tests or acceptance test runs)? Options: Yes, mandatory smoke tests, Optional verification, No verification required
• For SSH key rotations, what strategy do you permit on target hosts (rolling public-key replacement, agent-assisted swap, or manual key update)? Options: Rolling public-key updates, Agent-assisted swap, Manual update only
• Which service accounts must never be rotated automatically without manual sign-off (list service names or job IDs)?

Test Rotations for Automated Service Accounts

• List the automated service accounts to include in rotation tests and provide associated job or pipeline identifiers for each.
• How will you validate a successful rotation for each service account (for example: successful CI job run, authentication log entry, or end-to-end application health check)? Options: Successful job run, Authentication logs, Application health checks, Manual verification
• What success threshold will you require to consider rotation tests passing during pilot (for example: 100% of test jobs run successfully within 1 hour)? Options: 100% within 1 hour, 95% within 4 hours, Custom threshold
• Who will own remediation if a rotation causes a pipeline or job failure (provide team or on-call role)? Options: Application owner, Platform owner, Security operations, Other
• What acceptance criteria will confirm rotation tests are acceptable for pilot sign-off (what evidence will validate that rotations did not break production)?

Deploy Agentless Session Broker

• Which network segments, access gateways, or bastion host IP ranges should the agentless session broker be deployed into (provide CIDR blocks or gateway names)?
• Provide any firewall, NAT, or proxy constraints that will affect broker placement and required port whitelists (list ports and proxy hostnames).
• Do you require custom certificates or internal PKI integration for broker TLS (for example, issue certs from your internal CA)? Options: Public CA certificates, Internal PKI certificates, Cert injection required, No custom certs
• Which protocols must the broker support in pilot (select all that apply from SSH, RDP, database protocols, and API session proxying)? Options: SSH, RDP, Database protocols (e.g., MySQL, MSSQL), API session proxying
• Describe fallback access pathways and runbooks if the broker becomes unavailable during business hours (include escalation contact and rollback steps).

Record Privileged Sessions with Metadata

• Which session types must be recorded for forensic purposes in the pilot (interactive SSH, RDP, database sessions, API sessions)? Options: Interactive SSH, RDP, Database sessions, API sessions
• How long should session recordings be retained to satisfy your auditors or insurance requirements (select a retention period in days/years)? Options: 30 days, 90 days, 1 year, 3 years, Custom
• What metadata fields must be attached to each recording for traceability (for example: user identifier, asset ID, job/pipeline ID, ticket number)? Options: User ID, Asset ID, Job/Pipeline ID, Ticket/Change ID, Other
• How will you tag or classify recordings to meet specific compliance regimes you follow (for example SOC 2 control IDs, ISO 27001 clause references)?
• Which internal teams need access to session forensics and via which integration points (for example SIEM ingestion, direct portal, or ITSM ticket attachments)? Options: SIEM, Direct portal, ITSM/ticketing system, Other

Export Session Recordings and Audit Packages

• Which export formats do your auditors require for session packages (video with metadata, text transcripts, structured JSON, or signed archive)? Options: Video + metadata, Transcripts, Structured JSON, Signed archive
• How many audit packages (session recordings plus supporting evidence) do you anticipate exporting during the pilot for auditor review? Options: 1-5, 6-20, 21-50, More than 50
• What chain-of-custody or integrity checks must accompany exported packages (for example checksums, signed manifests, timestamped logs)? Options: Checksums, Signed manifests, Timestamped logs, None
• Who will be authorized to request exports and certify receipt for the auditor (provide roles such as compliance officer, audit lead, or security owner)? Options: Compliance officer, Audit lead, Security owner, Other
• What acceptance evidence will confirm exported audit packages meet your auditor's requirements (for example: auditor signs off on 5 sample sessions or issues no findings)?

Configure Privileged Access Workflows (Checkout/RBAC)

• Which RBAC roles and permissions need to be modeled in checkout workflows (for example: privileged admin, read-only operator, emergency responder)? Options: Privileged admin, Read-only operator, Emergency responder, Custom roles
• How long should time-limited checkout sessions default to for each role (provide default TTLs such as 15 minutes, 1 hour, or 8 hours)? Options: 15 minutes, 1 hour, 8 hours, Custom
• Do you require approval gating before checkout and if so is single approver or multi-approver needed for each role? Options: Single approver, Multi-approver, No approval
• Which ticketing or ITSM identifiers must be attached to checkout requests (ticket ID, change record ID, or no correlation)? Options: Ticket ID, Change record ID, No correlation, Custom
• Describe any identity provider (IdP) attributes or single sign-on mappings required to enforce role attributes during checkout (for example group claim mapping or session claims).

Enable Break-Glass Emergency Access

• Which emergency roles should exist and which accounts are authorized for break-glass use (list role names and example account IDs)?
• How long should break-glass access remain active before auto-revocation in an emergency (choose a duration)? Options: 30 minutes, 1 hour, 24 hours, Until manually revoked
• What audit trail and immediate alerts must be generated when break-glass access is invoked (for example: pager alert to security ops, audit log entry with snapshots)? Options: Immediate alert to security ops, Audit log entry only, Email notification, Other
• Who must own the post-event review and within what timeframe should the review occur (for example: security lead within 48 hours)? Options: Security lead within 48 hours, IT lead within 72 hours, Custom
• Describe your rollback or remediation procedure if break-glass access results in unintended changes (include steps and responsible roles).

• Master Services Agreement (MSA)
• Subscription Order Form
• Statement of Work (SOW)
• Pilot Acceptance Criteria
• Roles & Responsibilities (RACI)
• Success Gates & Rollout Schedule
• Service Level Agreement (SLA)
• Data Processing Agreement (DPA)
• Security & Regulatory Addendum (conditional)
• Change Order Agreement
• Pilot Close & Acceptance Certificate

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• Acceptance Gate — Pilot Outcome Decision (around day 90)
• Quarterly Operational Review (ongoing)

• Produce a short quarterly summary of metric trends and open items and distribute to stakeholder reviewers for asynchronous comment.
• Increase session-recording retention or sampling if coverage falls below the retention target specified in Risk & Requirements Discovery.
• Restate acceptance criteria and numeric targets
• Produce a documented acceptance decision with pass/fail status for each numeric criterion recorded in Risk & Requirements Discovery.
• If any criterion fails, agree remediation tasks, verification tests, and fixed resolution dates before closing the meeting.
• Confirm the incumbent wind-down status to avoid dual-system operation and adoption backslide.
• Publish the acceptance decision and the pass/fail record for each criterion, including the named signatory where required.
• Execute the remediation tasks for any failed criteria and schedule verification tests with target completion dates.
• Complete incumbent decommissioning steps or formalize read-only retention and archive procedures if decommissioning is deferred.
• Operational metrics review
• Verify that session recording coverage rate and automated service-account rotation count meet operational targets set in Risk & Requirements Discovery.
• Ensure critical open issues are on a path to closure and that the enhancement backlog is prioritized for the next quarter.
• Confirm continued decommissioning of the incumbent to prevent regression to legacy practices.
• Close or escalate any critical tickets that jeopardize rotation reliability or forensic completeness, with resolution dates recorded.
• Implement agreed configuration changes or scheduled enhancements that improve rotation success or recording coverage.
• Reconfirm pilot success criteria and owners
• Confirm deployment components (discovery, vaulting, rotation scheduling, session recording) are running without critical failures.
• Produce a short remediation list for any issues that threaten the pilot, with owners and dates recorded.
• Validate that the pilot success criteria referenced in Risk & Requirements Discovery are understood by all stakeholders.
• Remediate any failed rotation jobs and rerun dependency checks for affected service accounts.
• Collect and share three representative session recordings for auditor review to confirm recording fidelity.
• Publish an issues list with remediation due dates and the accountable owner for each item.
• Data presentation against targets
• Determine whether vaulted-and-rotated credential count and service-account rotation success rate are moving toward the targets in Risk & Requirements Discovery.
• Identify the root causes for any shortfalls and agree a remediation plan with dates leading to the acceptance gate.
• Confirm updated timeline and criteria for the acceptance gate at day 90.
• Fix identified rotation failures, run end-to-end validation, and record the successful test runs.
• Adjust rotation schedule or credential-scoping rules for any service accounts that require different timing to avoid disruption.
• Present outcome data per criterion
• Open issues and ticket burn-down
• Deployment validation
• Discovery completeness check
• Document pass/fail per criterion and capture decision
• Early adoption signals and usage patterns
• Enhancement and backlog triage
• Root-cause analysis for gaps
• Blockers and open issues
• Corrective actions and timeline to acceptance gate
• Confirm incumbent remains decommissioned
• Remediation plan for any failed criteria
• Agreement on immediate remediation actions
• Incumbent system wind-down checkpoint
• Short sync on upcoming risk events or audits