In preparation for PAM and after, it would be useful to have a report that shows processes that run with elevated privileges. I assume that PAM functionality might be a separate line item. Being able to report on what processes on a device are being executed as admin would give our account managers data when discussing removing user admin rights from machines. Not only would this allow us to create a PAM policy for the client ahead of turning anything on, it would help convince clients to spend the money to deploy these tools in the first place.