Sales Enablement

Deal Playbook
Close Faster, Close Bigger

Deal registration mechanics, PAN co-selling best practices, slippage prevention, and scoping checklists for every solution area.

Deal Registration

Register Early, Protect Your Deal

Deal registration provides margin protection and deal protection for the partner who uncovers the opportunity first.

Why Register Early

  • Deal protection: Registered partner gets priority positioning on the opportunity — one partner per opportunity rule.
  • Margin enhancement: Registered deals receive enhanced partner margins beyond standard discount levels.
  • PAN sales alignment: Registration triggers PAN Account Manager engagement and SE resource allocation to your deal.
  • Competitive defense: If another partner tries to register the same opportunity, your registration takes precedence.
  • Register BEFORE the first meeting. This is the single most important timing decision in the deal lifecycle.

Common Rejection Reasons

  • Duplicate registration: Another partner already registered this opportunity. Check with your PAN AM before investing time.
  • Incomplete information: Missing customer legal entity name, decision maker, or estimated deal value. Fill every field.
  • Wrong account: The customer account in CRM doesn't match the legal entity purchasing. Verify parent/subsidiary relationships.
  • Existing opportunity: PAN already has an active opportunity with this customer for this solution. Align with the AM.
  • Late registration: Registering after the customer is already engaged with PAN direct or another partner.

90-Day Registration Timeline

Phase 1: 90 Days Registration → Installed Evaluation
Phase 2: +90 Days Evaluation → Close
  • Initial period: 90 days from registration to reach installed evaluation (POC, trial, or formal eval).
  • Extension period: Additional 90 days from evaluation to close the deal.
  • Extensions available: If you need more time, request an extension through the Partner Portal before expiration.
  • Important: You cannot discuss the deal registration program with customers. This is a partner-PAN program only.

Registration Best Practices

  • Register before the first customer meeting. Don't wait until you've qualified the deal — register the moment you identify the opportunity.
  • Use the correct legal entity. Not the parent company unless they're the purchaser. Verify with the customer's procurement team.
  • Verify the account in PAN CRM. Work with your PAN AM to confirm the customer account exists and is mapped correctly in Salesforce.
  • Include a decision maker. Registration requires a named contact at the customer. Get the CISO, VP, or director's name — not just "IT Department."
  • Be specific about the opportunity. "Security platform" is too vague. Specify "XSIAM replacement of Splunk SIEM" or "Prisma SASE for 5,000 remote users."
  • One partner per opportunity. If another partner is already registered, collaborate through PAN AM rather than competing on the same deal.
  • Track your timeline. Set calendar reminders at 60 days and 80 days to ensure you're moving toward evaluation before the 90-day window closes.

Co-Selling

Working with PAN Sales

Know the key roles, engagement model, and fiscal calendar to align with PAN sales motion.

Account Manager (AM)

Your primary PAN contact. Owns the customer relationship and quota. Engage the AM first on every deal. They control resource allocation, pricing approvals, and executive engagement. Build a quarterly rhythm with your AM — don't just reach out when you need something.

Systems Engineer (SE)

Technical counterpart to the AM. Runs POCs, demos, and technical deep-dives. Request a PAN SE when the customer needs product-specific validation that your SE can't deliver. For XSIAM and AIRS deals, PAN SE involvement is usually required for the eval.

Channel Solutions Partner (CSP)

Your partner program contact. Handles deal registration issues, program questions, and escalations. The CSP is your advocate inside PAN. Keep them informed on deal progress — they can unlock resources and approvals you can't access directly.

Business Development Rep (BDR)

Lead generation and early qualification. BDRs can surface opportunities to you and vice versa. Sharing intel on customer initiatives, budget cycles, and competitive situations builds a mutually beneficial relationship.

Co-Selling Best Practices

  • Engage Partner Architects early: Reach out to your Palo Partner Architects at the start of the deal process — not after you're stuck. They can help with solution design, competitive positioning, licensing strategy (ELA/ESA/CDSS), and technical validation. Getting them involved early prevents deal slippage and misquoted BOMs.
  • Lead with your value: PAN wants partners who bring customer relationships, industry expertise, and services wrap. Don't just pass leads — co-sell by owning the customer relationship.
  • Prepare joint account plans: For strategic accounts, build a joint plan with the PAN AM covering which solutions to lead with, competitive positioning, and timeline to close.
  • When to lead with your SE: If your SE has product certification and the deal is a straightforward refresh/expansion, lead the technical. Bring PAN SE for complex evaluations, competitive bake-offs, and new product areas (XSIAM, AIRS, Identity).
  • When to request PAN SE: For POCs involving XSIAM, Cortex Cloud, or AIRS. For competitive evaluations against CrowdStrike or Microsoft. For customer-requested reference architecture sessions.
  • Share intelligence both ways: Tell the AM what competitors are in the deal, what the customer's budget cycle looks like, and who the decision makers are. The AM will share pricing flexibility, product roadmap timing, and executive engagement options.
  • Respect the fiscal calendar: PAN reps are most motivated to close at quarter-end and especially fiscal year-end (July 31). Align your deal timing to maximize PAN's willingness to offer aggressive pricing and concessions.

Quote Review Process

Understanding the quote flow is critical. Quotes pass through multiple hands before reaching the client — each step is an opportunity to catch errors and optimize the deal.

1
PAN Sales Creates the Quote

The PAN Account Manager / SE builds the quote in PAN's quoting system based on the scoped solution. This includes hardware, subscriptions (CDSS), support SKUs, and any enterprise agreements (ELA/ESA).

2
Distributor Sends Quote to Partner

The quote flows through your authorized distributor (disti), who applies partner pricing and sends the formatted quote to you. The disti does not typically validate solution accuracy — that's your job.

3
Partner Reviews for Accuracy

This is the most critical step. Before sending anything to the client, carefully review the quote for:

  • Deal Registration: Confirm your deal reg is reflected in the pricing and margin protection is applied.
  • Vendor Services: Check if any PAN professional services are included. If you deliver services yourself, make sure PAN vendor services aren't on the quote competing with your practice.
  • ELA (Enterprise License Agreement): If ELA is included, partners generally want ELA — it bundles the five core CDSSs (ATP, WildFire, URL Filtering, DNS Security, GlobalProtect) into one agreement. This simplifies licensing and is typically a win for the partner and customer.
  • ESA (Enterprise Support Agreement): If ESA is included, partners typically do not want ESA on the quote — because ESA means PAN delivers support directly. Most partners prefer to deliver support themselves through Partner-Enabled Premium Support (backline support). Selling your own support wrap is higher-margin and strengthens your customer relationship. Flag ESA line items and request they be replaced with partner-delivered support SKUs.
  • Subscription accuracy: Verify every CDSS subscription matches what was scoped. Missing a subscription (e.g., IoT Security, AI Access Security) creates change orders post-sale.
  • Term alignment: Confirm all subscriptions, support, and hardware are co-termed to the same end date.
4
Questions? Reach Out Before Sending

If anything looks off — wrong SKUs, unexpected line items, pricing questions, or ELA/ESA confusion — reach out to your PAN SE and/or Partner Architect before forwarding to the client. It's far easier to fix a quote before the client sees it than to issue corrections after.

5
Send Quote to Client

Once validated, send the quote to the client with a cover summary highlighting the solution, value, and any commercial incentives (quarter-end pricing, co-term savings, etc.).

Client Has Questions? Repeat the Review

If the client comes back with questions, change requests, or needs a revised scope — go back through Steps 1–4. PAN revises the quote, disti sends the update, you review again for accuracy. Don't forward a revised quote without re-validating every line item — changes in one area can cascade to pricing, support terms, and entitlements.

ELA vs ESA — Partner Rule of Thumb:

ELA = Yes, partners want this. Bundles CDSS subscriptions into one agreement — simplifies licensing, good for customer and partner. ESA = Usually no for partners. ESA bundles PAN-delivered support — most partners prefer to deliver support themselves for higher margins and deeper customer relationships. If you see ESA on a quote, flag it and discuss with your SE or Partner Architect.

PAN Fiscal Year Calendar (Aug 1 – Jul 31)

Q1

Aug – Oct

New year — build pipeline

Q2

Nov – Jan

Mid-year push

Q3

Feb – Apr

Acceleration quarter

Q4

May – Jul

★ Fiscal year end — maximum deal velocity

Timing matters:

PAN reps have the most pricing flexibility and executive support at Q4 (May-Jul). If your deal can close in this window, you'll get the best terms. Conversely, Q1 deals often face slower approvals as new quotas and territories are being set. Plan your deal timeline around PAN's fiscal calendar, not just your customer's budget cycle.

Slippage Prevention

Why Deals Slip — And How to Save Them

The 8 most common reasons PAN deals slip, with warning signs and recovery tactics for each.

#1

No Executive Sponsor

The deal is driven by mid-level champions who can't get budget approval. Without a CISO or CIO sponsor, deals stall at procurement.

Warning: No C-level meetings after initial discovery. Champion keeps saying "I need to check with my boss."

Fix: Ask PAN AM to arrange an executive-to-executive session. Prepare a business case document the champion can present upward. Map the buying committee early.

#2

Competing Projects

The customer's budget gets redirected to a different initiative — cloud migration, ERP upgrade, or a breach-response purchase. Your deal gets deprioritized.

Warning: Meetings keep getting rescheduled. Budget timelines keep shifting. Champion mentions "other priorities."

Fix: Align your deal to the competing project. If it's cloud migration → lead with Cortex Cloud. If it's a breach → lead with XSIAM incident response capabilities. Make PAN part of the priority, not competing with it.

#3

POC Creep

The proof of concept expands beyond the original scope, adding use cases, data sources, and evaluation criteria that delay the close.

Warning: POC scope document keeps growing. New stakeholders join with new requirements. Timeline extends past 30 days.

Fix: Set a hard POC scope and success criteria BEFORE the eval starts. Include a "time-boxed" clause. If new requirements surface, acknowledge them and agree to address them post-purchase.

#4

Microsoft Bundling

Microsoft ELA renewal includes "free" Sentinel/Defender, and procurement pushes to consolidate on Microsoft to save money. Your deal gets challenged on cost.

Warning: Customer mentions "E5 already includes this." Procurement asks for a cost comparison vs "free" Microsoft security.

Fix: Calculate the real Sentinel cost at scale (see compete.html). Show multi-cloud blind spots. Position PAN as the security platform that protects the Microsoft environment better than Microsoft protects itself.

#5

Procurement Bottleneck

Technical evaluation is done, but procurement adds 4-8 weeks for legal review, contract negotiation, and approval cycles.

Warning: Technical team says "we're ready" but procurement hasn't started. No master agreement in place.

Fix: Engage procurement in parallel with the tech eval — not after. Check if the customer has an existing PAN master agreement. Use PAN CSP to expedite standard terms. Start legal redlines early.

#6

Champion Changes Role

Your internal champion gets promoted, leaves the company, or changes teams. The new person doesn't have the same urgency or relationship.

Warning: Champion stops responding. LinkedIn shows a role change. Meetings get reassigned to someone you haven't met.

Fix: Always have 2-3 contacts at the customer, not just one champion. Build the business case in writing so it survives personnel changes. Ask PAN AM to engage the replacement proactively.

#7

Analysis Paralysis

The customer evaluates 4-5 vendors simultaneously and can't make a decision. RFP scoring takes months. No clear winner emerges because the criteria keep changing.

Warning: Customer is running parallel POCs with 3+ vendors. Decision date keeps moving. New evaluation criteria appear mid-process.

Fix: Help the customer define success criteria before the eval. Position PAN as the platform that eliminates multi-vendor evaluation fatigue — one vendor for network + SASE + SOC + cloud. Offer a "pilot-to-production" deal structure.

#8

Contract Renewal Misalignment

The customer's existing security contracts don't expire for 12-18 months. There's no urgency to buy now because the current tools are "good enough" until renewal.

Warning: "We love the product but our Splunk/Zscaler/CrowdStrike contract doesn't end until next year."

Fix: Offer co-term deals that align with the existing contract expiration. Propose a "land and expand" — start with a new use case not covered by the existing contract, then expand at renewal. PAN offers ramp-up pricing structures for this exact scenario.

Scoping

Solution Scoping Checklists

Gather this information early to size the deal correctly and avoid surprises during quoting.

Daily log ingestion volume (GB/day) — current and projected 2-year growth
Number of managed endpoints (Windows, macOS, Linux, mobile)
Data sources to ingest — list each: firewalls, cloud trails, EDR, identity, email, SaaS apps
Current SIEM vendor and contract expiration date
Current SOAR vendor (if any) and number of active playbooks
Number of SOC analysts and tiers (L1/L2/L3)
Data retention requirements (hot/warm/cold, compliance mandates)
Region/data residency requirements (US, EU, other)
Add-on modules needed: ASM, TIM, Forensics, ITDR, Advanced Email Security
License tier: Cortex NG SIEM, XSIAM Enterprise, or XSIAM Enterprise Plus
Number of remote/hybrid users requiring Prisma Access
Number of contractors/BYOD users needing browser-only access
Number of branch locations requiring SD-WAN
Current WAN architecture (MPLS, broadband, both) and bandwidth per site
Current VPN solution and concurrent session capacity
Private applications that need ZTNA (number, hosting location)
DLP requirements — data types, compliance frameworks (PCI, HIPAA, etc.)
CASB requirements — sanctioned vs unsanctioned SaaS apps to monitor
Performance-sensitive SaaS apps (video, collaboration, ERP)
Prisma Access Browser deployment scope (contractor count, use cases)
Required throughput (App-ID with all services enabled)
Port density — 1G, 10G, 25G, 40G, 100G interface requirements
HA requirements (active/passive, active/active, clustering)
Current firewall vendor, model, and support expiration dates
Number of locations (DC, campus, branch) and model per location
TLS decryption requirements — percentage of encrypted traffic, compliance constraints
Security subscriptions needed: ATP, WildFire, URL Filter, DNS Security, IoT, DLP, CASB
Management preference: SCM, Panorama, or hybrid
Virtual/container requirements: VM-Series (cloud), CN-Series (K8s)
OT/Industrial requirements: K2-Series, IoT Security subscription
Number of cloud accounts/subscriptions/projects (AWS, Azure, GCP)
Total cloud workloads (VMs, containers, serverless functions)
Kubernetes clusters — number, distribution (EKS, GKE, AKS, OpenShift)
Current CNAPP/CSPM vendor and contract expiration
Agent vs agentless preference per workload type
Code security requirements: SAST, SCA, IaC scanning, ASPM
CDR requirements — does the SOC need cloud detection alerts?
Compliance frameworks: SOC 2, PCI, HIPAA, FedRAMP, CIS Benchmarks
DevOps toolchain: CI/CD platform, container registry, IaC tools
Multi-cloud vs single-cloud — which clouds and what percentage of workloads
Total identity count — human users, service accounts, machine identities
Current PAM tool and contract expiration date
Number of privileged accounts under management today
Identity governance tooling — current vendor (SailPoint, Saviynt, etc.)
Secrets management approach — vault, environment variables, hardcoded?
AI/agentic identity requirements — number of AI agents with system access
Compliance requirements: SOX, PCI, HIPAA — privilege access audit needs
Integration requirements: SIEM/SOC feed, directory services (AD, Entra, Okta)
Just-in-time vs standing privilege current state
Machine identity certificate management scope