5,000+
Controls
19
Frameworks
13
GRC Modules
67
Auto-Remediations
85+
Trackable Apps
14
ATT&CK Techniques
This guide is organized three ways: discovery questions to ask before the demo, a universal demo baseline every prospect sees, and persona-specific flows that highlight what matters most to each buyer type. Mix and match based on what you learn in discovery.
Use the Comparison tab in the MSP portal during demos to instantly show how two or more client orgs stack up — it's a conversation-stopper for service providers.
Discovery Questions
Ask these in the first 5–10 minutes. Their answers tell you which persona flow to follow and which features to lead with.
Environment Questions
- Are you primarily Microsoft 365 or do you have other environments?
- How many users and managed endpoints do you have?
- Do you use Microsoft Defender for Endpoint or Intune?
- On-premise servers, or cloud-only?
Compliance Questions
- Which frameworks do you report against? (CIS, NIST, SOC 2, HIPAA, PCI, DISA?)
- Do you have an upcoming audit or certification effort?
- How are you currently tracking compliance? (spreadsheets, GRC tool, nothing?)
- Who is the ultimate consumer of compliance reports? (CISO, auditor, board?)
Pain Questions
- What does your current audit prep process look like?
- How much time does your team spend on compliance per month?
- Have you had audit findings you wish you'd caught earlier?
- Are you managing multiple clients or just one org?
Buying Questions
- What does success look like 6 months after deploying?
- Is there an existing tool you're looking to replace?
- Who else is involved in this decision?
- What's your timeline?
If they say "spreadsheets" or "manual audits" — that's your opening. Lead with the Dashboard and the automated scan results. If they say "we're preparing for a SOC 2 audit" — jump straight to the Compliance Officer flow.
Universal Demo Flow
Every prospect should see this baseline regardless of persona. Total time: ~15 min
1
Dashboard — "Here's your posture at a glance"
Open the Dashboard. Show the framework compliance score cards, the trend chart, and the risk distribution ring. Point out the Compliance Drift banner if controls regressed since the last scan.
"Instead of pulling spreadsheets every week, this is live. The moment a configuration drifts out of compliance, it surfaces here."
2
Controls — "5,000+ controls, mapped once, used everywhere"
Navigate to Controls (V2). Show the domain chips. Filter by a framework they mentioned in discovery. Click a failing control — show the audit steps, remediation guidance, MITRE ATT&CK badge, and risk score badge.
"Every control tells you what failed, why it matters, which ATT&CK technique it defends against, and exactly how to fix it."
3
Scans — "This runs automatically, not manually"
Show the Scans page. Explain that M365 cloud scans run on a weekly Azure Automation schedule (no agent needed for cloud). Show the scan detail — pass/fail/override counts. Show scan grouping by type.
"Your team doesn't log in to run this. It runs on a schedule, uploads results, and you come back to a report."
4
Remediation — "One click to fix, not one week to plan"
Find a failing control that has a remediation script. Click ⚡ Remediate. Show the confirmation modal with parameter fields. Explain the 67 pre-built scripts covering Entra ID, Exchange Online, SharePoint, Defender, Power BI, and Purview.
"67 controls can be remediated with a single click. The runbook runs in Azure Automation, writes back status, and the control flips to Pass on the next scan."
5
Reports — "Audit-ready in minutes"
Navigate to Reports. Generate an Executive Summary report. Show the framework breakdown, top failing controls, and the clean professional formatting. Mention PDF export with org branding.
"This is what you hand to your auditor, your CISO, or your board. It takes about 30 seconds to generate."
After the universal flow, pivot to the persona-specific section based on what you learned in discovery. You have ~25 minutes left in a typical 45-minute demo slot.
Persona-Specific Demo Flows
Click a card below to jump to that persona's tailored demo path.
🛡️
IT Security / CISO
Threat visibility, continuous monitoring, MITRE mapping, risk posture
📋
Compliance Officer
Audit readiness, evidence, multi-framework overlap, policy library
🏢
MSP / Service Provider
Multi-tenant, white-label, client comparison, MSP portal
🏛️
Federal / Government
DISA STIGs, CISA SCuBA, BOD 25-01, strict endpoint control
🏥
Healthcare
HIPAA controls, risk assessments, security training, exception workflows
🏦
Financial Services
PCI DSS, SOC 2, audit management, data classification, risk register
🛡️
IT Security Manager / CISO
Pain: "I need to know what's exposed right now, not after the next audit cycle."
Pain Points to Validate
- No real-time visibility into control drift
- CVE lists with no prioritization context
- Security and compliance teams operating in silos
- Can't tie compliance gaps to actual threats
Key Questions to Ask
- How do you know today if a security configuration changed?
- What's your process for prioritizing CVEs?
- Do you know which endpoints have CISA KEV vulnerabilities?
- How do you map your controls to adversary techniques?
Demo Flow ~20 min
1
Endpoint Security Dashboard
Navigate to Security → Endpoint Security. Show the CVE severity breakdown, the CISA KEV alert banner (ransomware-linked exploited vulnerabilities), EPSS exploit probability scores, and EOL software detection.
"Every CVE on your network, cross-referenced against CISA's known exploited vulnerabilities list. The ones with active ransomware campaigns are flagged red."
2
Device Fleet — drill into one device
Navigate to Devices. Click a device. Show the MDE health status, risk score, top CVEs with EPSS scores, installed software with EOL badges, and Intune compliance status — all in one panel.
"One click from the device list. Health status from Defender, CVEs ranked by exploitation likelihood, software inventory, Intune posture — all without leaving the platform."
3
MITRE ATT&CK Mapping on Controls
Go to a failing control. Show the MITRE technique badge (e.g., T1078 Valid Accounts, T1110 Brute Force). Navigate to the Dashboard and show the ATT&CK coverage section — defended vs. gap techniques.
"Compliance isn't just a checkbox. Fixing MFA gaps defends T1078. Fixing audit logging defends T1070. We connect the dots between your compliance work and the threats you're actually facing."
4
Risk Register
Navigate to GRC → Risk Register. Show the heat map, an example risk with ALE calculation, and the linkage to controls. Show a risk in "Mitigate" treatment with associated controls that address it.
"Every risk is quantified with ALE scoring and tied to specific controls. When a control fails, the associated risk moves on the heat map automatically."
5
Remediation + Compliance Drift
Show the Compliance Drift banner on the dashboard. Click a drifted control. Show the remediation script available and the ⚡ button. Walk through what happens when it's triggered (Azure Automation, audit log, status updates).
"You're alerted the moment something drifts. You can fix it with one click. The audit trail is automatic."
Key close: "You're getting MDE-level visibility, CISA KEV prioritization, EPSS scores, MITRE mapping, and one-click remediation — all in one platform. What does your current setup give you for this?"
📋
Compliance Officer
Pain: "Audit prep consumes weeks of my team's time, and we're still not confident in our evidence."
Pain Points to Validate
- Same evidence gathered multiple times for overlapping frameworks
- No centralized system for exceptions and waivers
- Policy documents scattered and out of date
- Auditors ask for evidence that takes days to assemble
Key Questions to Ask
- Which frameworks are you currently reporting against?
- How do you handle exceptions — are they documented formally?
- When was the last time your policies were reviewed?
- How long does it take to respond to an auditor evidence request?
Demo Flow ~20 min
1
Multi-Framework Controls — "Map once, satisfy everywhere"
Open a control and show the framework mapping panel — CIS, NIST 800-53, ISO 27001, SOC 2, PCI DSS all mapped to the same control. Show that fixing one control satisfies requirements across multiple frameworks simultaneously.
"Your team evaluates this control once. TATER maps the result to every framework you're reporting against. No duplicate work."
2
Exception & Waiver Management
Navigate to GRC → Exceptions. Show an approved exception with business justification, compensating controls, and expiry date. Show the approval chain (OrgAdmin → CISO → Risk Committee). Show that expired exceptions are flagged automatically.
"Every exception is documented, approved through your chain of command, and automatically flagged for renewal. No more informal exceptions living in email threads."
3
Policy Template Library
Navigate to Policies. Click "From Template." Show the 11 policy templates (InfoSec, Incident Response, Access Control, HIPAA/Privacy, Vendor Management, etc.). Fill in a few variables and show the generated policy with preview. Show PDF export with org branding.
"Professional, audit-ready policy documents in 5 minutes. They're variable-driven — change your company name once and it propagates everywhere."
4
Audit Management
Navigate to GRC → Audits. Show an audit engagement with scope, findings, evidence collection requests, and status tracking. Show the audit calendar with upcoming engagements.
"Your auditor requests evidence. You assign it to the control owner directly in TATER. They upload it. You close the finding. No email chains, no lost attachments."
5
Executive Report + Regulatory Changes
Generate a report and show the framework-specific compliance percentages, failing control list, and override summary. Then show GRC → Regulatory Changes — the feed of framework updates with impact assessments and gap analysis.
"When NIST releases an update, TATER flags which of your controls are affected and what new requirements need evidence. You know before your auditor does."
Key close: "Your next audit prep cycle goes from weeks to days. And when the auditor asks for evidence, you generate the report in 30 seconds. What would that be worth to your team?"
🏢
Managed Service Provider (MSP)
Pain: "I'm managing compliance for 15 clients but every one of them is a separate spreadsheet."
Pain Points to Validate
- Switching between client portals wastes hours per week
- No standardized way to compare client posture
- Clients want branded reports, not generic ones
- Custom compliance requirements vary per client
Key Questions to Ask
- How many client orgs are you managing today?
- Do clients have different framework requirements?
- Are you currently white-labeling any compliance reports?
- How do you alert clients when their posture changes?
Demo Flow ~20 min
1
MSP Portal — Comparison Tab (lead with this)
Navigate to MSP Dashboard → Comparison tab. Show multiple client orgs side by side with framework compliance scores, control counts, drift indicators, and risk scores. Point out how quickly you can identify which clients need attention.
"This is your morning view. 15 clients, one screen. The red ones need attention today. You don't need to log in to each org separately to know where you stand."
2
Client Grid — volume management
Switch to the Client Grid tab. Show org cards with compliance percentages, open issues, and last scan date. Show how you click into any client org without re-authenticating.
"One login. Any client. Full access to their dashboard, controls, and reports — all while their data stays completely isolated from every other client."
3
White-Label Branding
Navigate to Settings → Branding. Show the logo upload, company name, accent color picker, and tagline fields. Show that reports, the Trust Center, and the public policy library all inherit the org's branding.
"Your clients see your logo, your colors. They get a branded compliance portal. You get a scalable platform underneath."
4
Custom Frameworks — MSP-specific requirements
Navigate to GRC → Custom Frameworks. Show the framework builder — drag-and-drop domains, custom controls with threshold logic. Show JSON export. Explain: build once, distribute to all relevant client orgs.
"If your MSP has a standard baseline you apply to every client — CIS hardening + your own requirements — build it once and distribute it across your entire book of business."
5
Role-Based Access for Client Staff
Navigate to Organizations. Show the member list with roles: OrgAdmin, Auditor, Viewer. Explain the ServiceProvider role — cross-org access without full SuperAdmin privileges. Show how permissions limit what each client user can see or modify.
"Your junior analysts get Viewer access. Your senior engineers get OrgAdmin. Client-side staff can log in to see their own dashboards without touching yours."
Key close: "You manage compliance for [N] clients. Today that's [N] separate workflows. With TATER, it's one dashboard, one process, one set of reports — all branded as yours. Contact Sales for MSP pricing — the first few clients you onboard typically pay for the platform."
🏛️
Federal / Government IT
Pain: "We're required to comply with DISA STIGs, CISA SCuBA, and BOD 25-01 — and we can't automate any of it."
Pain Points to Validate
- DISA STIGs require manual V&V against hundreds of controls
- CISA SCuBA M365 baselines are time-consuming to evaluate
- BOD 25-01 requires CISA KEV remediation within 3 weeks
- Compliance documentation must meet audit standards
Key Questions to Ask
- Do you have M365 in your environment?
- Are you currently being assessed against SCuBA baselines?
- How are you tracking BOD 25-01 KEV remediation SLAs?
- Is your ATO documentation up to date?
Demo Flow ~20 min
1
CISA SCuBA Controls — automated M365 baseline evaluation
Filter Controls by CISA SCuBA authority. Show the SCuBA-specific controls for Entra ID, Exchange Online, SharePoint, Teams, Defender, and Power Platform. Show pass/fail/skip results from the last automated scan. Explain why Teams Cs* controls are SKIP (delegated auth limitation — shows transparency).
"The CISA SCuBA baselines are the hardest to evaluate manually. We automate that evaluation on a weekly schedule via Azure Automation. Your SCuBA posture is always current."
2
CISA KEV — BOD 25-01 tracking
Navigate to Endpoint Security → CISA KEV tab. Show the full KEV catalog with ransomware campaign flags, due dates based on 3-week BOD 25-01 window, and which devices are affected. Show the SLA timer for each KEV.
"BOD 25-01 gives you 3 weeks to patch known exploited vulnerabilities. TATER tracks every KEV on every device and tells you how many days you have left."
3
DISA STIG Controls
Filter Controls by DISA authority. Show the STIG IDs (e.g., V-220000 format). Show the severity (CAT I/II/III) mapping to risk scores. Show the audit procedure and STIG-specific remediation steps.
"Every DISA STIG control includes the Finding ID, severity category, audit procedure, and remediation steps. You're not referencing a PDF manually — it's all here."
4
Endpoint Scanning Agent
Navigate to Settings → Agent. Show the MSI installer, silent deploy command with `/quiet` flag, and Intune deployment option. Show the auto-update mechanism (SHA256 hash verification). Show scan results from an endpoint agent scan.
"The agent deploys via Intune or GPO in silent mode. It runs STIG checks locally on the endpoint and uploads results to the platform. You get fleet-wide STIG compliance automatically."
5
Audit Trail + SIEM Integration
Navigate to Audit Log. Show the searchable audit trail of all activity (who changed what, when). Then navigate to Settings → SIEM — show syslog (CEF format, RFC 5424) and webhook (HMAC-signed) options.
"Every action in TATER is logged. And if you have a SIEM, we forward those events in CEF format. Your SOC sees compliance events alongside security events."
Key close: "DISA STIGs, CISA SCuBA, BOD 25-01, CISA KEV SLAs — you're managing all of these manually today. TATER automates all of it. What's the cost of missing a BOD 25-01 deadline vs. the cost of this platform?"
🏥
Healthcare Organization
Pain: "HIPAA audit prep is a nightmare, and we don't have a consistent risk assessment process."
Pain Points to Validate
- Annual HIPAA risk analysis is manual and inconsistent
- Security awareness training completion is hard to track
- Data classification and PHI handling policies are outdated
- Business Associate Agreements and vendor risk not tracked
Key Questions to Ask
- When was your last formal HIPAA risk analysis performed?
- How do you track security training completion for your staff?
- How are you managing vendor/BA risk assessments?
- Have you had any OCR audits or breach notifications?
Demo Flow ~20 min
1
HIPAA Controls + CIS Mapping
Filter controls by HIPAA framework. Show that HIPAA safeguard requirements are mapped to CIS controls and NIST 800-53. Highlight Administrative, Physical, and Technical safeguards. Show that passing a CIS control can satisfy a HIPAA requirement.
"A single scan evaluates HIPAA, CIS, and NIST simultaneously. Your annual risk analysis is backed by continuous automated evidence, not a once-a-year manual exercise."
2
Risk Register — HIPAA Risk Analysis
Navigate to GRC → Risk Register. Show risks categorized as PHI-related. Show the ALE calculation (likelihood × impact). Show treatment plans (accept, mitigate, transfer). Show how this documents the HIPAA-required risk analysis.
"The HIPAA Security Rule requires a formal risk analysis. This is it — documented, repeatable, and auditable. Your risk analysis is no longer a one-time effort."
3
Security Awareness Training
Navigate to GRC → Training. Show a training campaign with completion percentages by department. Show overdue alerts. Show phishing simulation results import. Explain that training reports are audit evidence for HIPAA, SOC 2, and ISO 27001.
"HIPAA requires documented training. You can show any auditor exactly who completed training, when, and what the completion rate was — department by department."
4
Data Classification & PHI Tracking
Navigate to GRC → Data Classification. Show data assets tagged with classification (Public, Internal, Confidential, Restricted). Show data flows mapped between systems. Show PIA workflow for new initiatives handling PHI.
"Where does your PHI live? Which systems process it? Which third parties touch it? This gives you a living data map — not a static spreadsheet from 2019."
5
Policy Library — HIPAA-ready policies
Navigate to Policies. Show the Incident Response, Data Protection & Privacy, and Acceptable Use templates. Generate a Data Classification policy with org variables filled in. Show PDF export with logo and cover page.
"HIPAA requires documented policies. These 11 templates cover every policy an OCR auditor expects to see — written to your organization, ready to sign off on."
Key close: "An OCR audit asks for your risk analysis, your training records, your incident response policy, and evidence your controls are working. Today that takes weeks to assemble. With TATER, it's a 30-second report."
🏦
Financial Services
Pain: "SOC 2 and PCI DSS overlap significantly but we're managing them as separate programs."
Pain Points to Validate
- PCI QSA and SOC 2 auditors both want evidence — gathered twice
- Compensating controls need formal documentation
- Financial transaction system changes require change management
- Continuous monitoring required for SOC 2 trust principles
Key Questions to Ask
- Are you in-scope for PCI DSS? What SAQ level?
- Do you pursue SOC 2 Type II? Which trust principles?
- How do you manage compensating controls for PCI?
- Do you have a formal change management process?
Demo Flow ~20 min
1
PCI DSS + SOC 2 Cross-Mapping — "One evidence set, two frameworks"
Open a control relevant to access management (e.g., MFA). Show that it maps to PCI DSS Req 8 and SOC 2 CC6. Show that passing this control contributes to both framework compliance scores simultaneously.
"Your QSA and your SOC 2 auditor both want evidence of MFA. You gather it once in TATER. Both compliance scores update. Two audits, one effort."
2
Exception Management — Compensating Controls
Navigate to GRC → Exceptions. Show a PCI compensating control exception — the formal justification, compensating measure, approval chain, and expiry. Show how this is automatically included in the compliance report for auditors.
"PCI requires compensating controls to be formally documented and approved. Every exception in TATER is an auditable record with a documented rationale."
3
Control Testing — Continuous Monitoring for SOC 2
Navigate to GRC → Control Testing. Show a weekly test schedule for access controls. Show a test with pass/fail criteria, historical trend chart, and automatic gap detection feeding into the remediation workflow.
"SOC 2 Type II covers a 12-month period. Your auditor wants to see that controls were operating continuously. Test records here become that evidence — automatically."
4
Audit Management — QSA & SOC 2 Engagements
Navigate to GRC → Audits. Show a planned audit engagement with scope (PCI DSS Req 1-12), assigned auditors, target date, and open findings. Show evidence collection requests assigned to specific control owners.
"You manage your QSA engagement here. Findings, evidence requests, open/closed status — all tracked. No more inbox chaos when the auditor sends a 200-row evidence request."
5
SIEM Integration + Audit Log
Navigate to Settings → SIEM. Show the syslog CEF configuration (RFC 5424). Show the HMAC-signed webhook option. Navigate to the Audit Log and show the full searchable activity trail with user, action, timestamp, and delta.
"Every login, every change, every scan — in your SIEM within seconds. For PCI DSS Req 10 log monitoring, this is native."
Key close: "You're running two audit programs today — PCI and SOC 2 — at roughly twice the cost and twice the effort. TATER combines them into one continuous program. The evidence satisfies both auditors. What's the combined cost of your current audit prep?"
Feature Quick Reference
Use this table when a prospect asks "does it do X?" during a call.
| Feature | Where to Find It | Key Stat / Detail |
|---|---|---|
| Compliance Controls | Controls (V2) | 5,000+ controls, 19 frameworks, domain chips, MITRE badges |
| Automated Cloud Scans | Scans | Weekly Azure Automation schedule, no agent needed for M365 |
| Automated Remediation | Controls → ⚡ Remediate | 67 pre-built scripts; Entra, EXO, SPO, Defender, Power BI, Purview |
| Endpoint Scanning Agent | Settings → Agent / Security | MSI installer, Intune-deployable, Windows 10/11, Server 2019/2022/2025 |
| MDE Integration | Security → Endpoint Security | Device inventory, CVE tracking, EPSS scores, software inventory, EOL detection |
| CISA KEV | Security → Endpoint Security → KEV tab | Full 1,500+ entry catalog, ransomware campaign flags, BOD 25-01 SLAs |
| MITRE ATT&CK | Control detail panel | 14 techniques mapped via keyword engine; coverage dashboard on Dashboard |
| Risk Register + Heat Map | GRC → Risk Register | 5×5 heat map, ALE scoring, treatment plans, risk-to-control linkage |
| Audit Management | GRC → Audits | Planning, findings, evidence collection, calendar |
| Exception Management | GRC → Exceptions | Approval chains, compensating controls, auto-expiry |
| Policy Library | Policies | 11 templates, variable engine, PDF export with org branding |
| Regulatory Changes | GRC → Regulatory Changes | Framework update feed, impact assessment, gap analysis |
| BCP/DR Planning | GRC → BCP/DR | Plan library, BIA module, RTO/RPO tracking, exercise records |
| Data Classification | GRC → Data Classification | Asset inventory, data flow mapping, PIA workflow, retention policies |
| Security Training | GRC → Training | Campaign management, completion tracking, phishing sim import |
| Control Testing | GRC → Control Testing | Scheduled tests, pass/fail criteria, trend charts, gap detection |
| Custom Frameworks | GRC → Custom Frameworks | Builder, JSON import/export, cross-mapping to standard frameworks |
| MSP Portal | MSP Dashboard | Comparison tab (multi-client side-by-side), Client Grid, Alerts |
| White-Label Branding | Settings → Branding | Logo, company name, accent colors, dark/light mode, per-org |
| Public Trust Center | Trust Center | Public-facing compliance posture, embeddable widget available |
| Reports | Reports | Executive summary, detailed, framework-specific, CSV/Excel export |
| SIEM Integration | Settings → SIEM | Syslog (CEF, RFC 5424), webhook (HMAC-signed) |
| Audit Log | Audit Log | Full activity trail, searchable by user/entity/action/date |
| Feature Permissions | Settings → Features | 34 configurable features, 5 preset profiles, custom user groups |
| Trackable Software | Security → Endpoint Security → Software | 85+ tracked apps with EOL detection via endoflife.date |
| Compliance Drift | Dashboard (banner) | Real-time detection of Pass→Fail regressions between scans |
| Overrides / Risk Accept | Overrides | Justification, expiry, approval; shown as Override status in controls |
| People / Contacts | People | Compliance stakeholders, control ownership assignments, Entra ID search |
Common Objections & Responses
"We already have a GRC tool."
Most GRC tools require manual evidence gathering. TATER automates M365 scanning via Azure Automation — your configuration evidence is collected automatically, not manually entered. And with 67 one-click remediations, you're not just tracking failures, you're fixing them. What does your current tool do when a control fails?
"We're already using Microsoft Secure Score / Defender for Cloud."
Secure Score is great for prioritization, but it doesn't map to CIS, NIST, ISO 27001, SOC 2, PCI DSS, or HIPAA — the frameworks your auditors care about. TATER maps every control to the compliance frameworks your business is measured against, and generates audit-ready reports. Think of it as compliance evidence on top of Secure Score's findings.
"This seems expensive."
Pricing is based on user count — contact Sales for a quote for your org size. For context, TATER typically costs roughly an hour of a compliance consultant's time per month. How many hours does your team spend on audit prep per quarter? If we cut that by 70%, which is what our customers see, the ROI is clear in the first audit cycle. And there are no contracts — month to month.
"We don't have the bandwidth to implement this."
Setup is typically same-day. You connect your M365 tenant via an Entra ID app registration — our runbook wizard walks you through it step by step. The first scan runs automatically. You're looking at a compliance dashboard within hours, not weeks.
"We're Google Workspace / AWS / Linux only."
TATER is purpose-built for Microsoft 365 and Windows endpoints. If M365 is any part of your environment — even just email and Teams — we cover it comprehensively. If you're looking for multi-cloud GRC, we'd rather be honest about our scope than oversell.
"Can we see a proof of concept before buying?"
Absolutely. We can connect to your M365 tenant and run a live scan against your actual environment in the first session. You'll see your real compliance posture — not sample data — within the same call. That's the best proof of concept we can offer.
"What about data security? Where does our scan data live?"
All data is stored in Azure Cosmos DB, partitioned by your tenant ID. Scans run in your own Azure Automation Account — the runbook authenticates to your M365 tenant with a certificate stored in your Key Vault. No credentials are stored in TATER. Your data never co-mingles with another tenant's.
"We're not ready to buy yet — can we just evaluate?"
We don't have a self-serve trial — TATER requires an Azure app registration, Automation Account, and runbook setup to run its first scan, and handing someone a half-configured environment isn't useful to anyone. Instead, offer a guided setup session: we configure everything together in a 2–3 hour call, run the first scan against their actual tenant, and they leave with real compliance results. That's a better evaluation than any sandbox. When they're ready to move forward, it's month-to-month from there.
Closing & Next Steps
Demo Wrap-Up Checklist
- Confirmed their primary compliance framework(s)
- Showed at least one scan result (real or sample data)
- Demonstrated remediation script execution
- Showed the feature(s) most relevant to their role/pain
- Quoted accurate pricing for their user count
- Confirmed next steps (guided setup session, proposal)
Pricing Quick Reference
Essential — Contact Sales
- Up to 250 users
- All features included
- 2 OrgAdmins
- Standard support
Business — Contact Sales
- 251–500 users
- All features included
- 4 OrgAdmins
- Standard support
- Quarterly business reviews
Enterprise / MSP — Custom
- 500+ users or multi-org MSP
- Unlimited OrgAdmins
- White-label branding, SSO/SCIM, SLA
- Dedicated implementation engineer
- Custom integrations
Always emphasize: No contracts. No framework limits. All features at every tier. Month-to-month. This is a key differentiator vs. legacy GRC tools that charge per framework or require 3-year commitments.
Next Steps After the Demo
1
Schedule a Guided Setup Session
Offer a 2–3 hour setup call: Entra ID app registration, Automation Account, runbook deployment, and first scan — all done together. They leave with real compliance results from their actual tenant, not sample data.
2
Send the Product Brief + Pricing Guide
Share
TATER-Product-Brief.md and the pricing guide. Customize pricing section to their user count before sending.3
Identify the Technical Champion
Ask who would run the Entra ID app registration and set up the runbooks. That person needs to be in the next call. They're your technical champion — keep them engaged.
4
Propose a Trial Start Date
Give them a specific date. "Can we get a trial running by [specific date]?" reduces ambiguity and sets a timeline that creates urgency without pressure.
Contact: sales@tatersecurity.com | www.tatersecurity.com | app.tatersecurity.com
TATER — Threat Analysis Targeting Enterprise Resources | Confidential — For Authorized Sales Personnel Only | Last updated 2026-03-31