Cleo already knows what's broken in your clients' programs. Now it tells you what that's worth.
Portfolio intelligence that turns compliance findings into a pipeline: ranked, sized service opportunities across your whole book, each with the figures behind it and a pitch you can use verbatim. Included with the Consultant License.
Book a Demo Start Free
4.8/5 across 223 reviews on SourceForge · #1 vCISO platform on G2, Summer 2026
Every consulting firm has the same problem
The data that would tell you where your next $200K of work is sitting is trapped inside individual engagements — and individual consultants' heads.
The report that ended the conversation
A consultant finishes a NIST CSF assessment, delivers the report, moves on. Eleven of the gaps in that report were sellable remediation projects. Nobody scoped a single one.
The offering nobody built
You have 40 clients. Twenty-two have no incident response plan. That is a productized offering hiding in plain sight — invisible because nobody can see across the book.
The forecast that was a guess
Renewal season arrives and the practice lead estimates expansion revenue from memory instead of forecasting it from evidence the firm already collected.
A pipeline view for a business that never had one
A portfolio-level intelligence layer inside RealCISO that continuously reads every client you manage and surfaces work worth proposing.
Remediation project
A client has a severe gap with no engagement scoped against it.
Audit readiness
A client has an audit approaching that its posture isn't ready for.
Evidence automation
A client is collecting evidence by hand that a connected integration could collect for them.
Framework expansion
A client's profile suggests a framework it hasn't adopted — the HIPAA client adding a payments line, the SOC 2 client chasing federal work.
Risk exposure
The assessment shows a risk scenario — ransomware, supply-chain compromise — with risks needing attention. Raised only once at least 80% of the scenario's questions are answered.
Portfolio pattern
The same gap appears across several clients at once. That isn't 15 opportunities; it's one productized offering.
Four pieces of information. Three actions.
Incident Response Program Build — Meridian Health
The figures: no documented incident response plan; scored L1 on Respond across the last two revisions; cyber insurance renewal in November.
The pitch (Cleo): Meridian has no documented incident response plan and has scored L1 on Respond across two consecutive assessment revisions — a finding their carrier will ask about at renewal. Propose a 6-week IR Program Build: plan development, severity taxonomy, roles and escalation paths, and a tabletop exercise to validate it.
Pursuing · Dismiss · Create engagement
Severity and effort
Each card carries how serious the gap is and how much work closing it takes, so the ranking reflects both.
The figures behind it
Every number links back to the control, test, risk, evidence type, framework, audit or insight it came from. You can always show the client your work.
A pitch from Cleo
Two or three sentences you can use verbatim: the specific finding, the business consequence, the proposed engagement.
One-step engagement
Create an engagement contract from the card in one step. Mark it Pursuing while you work it, or Dismiss with a reason — the ranking adapts.
Data you already have, read continuously
Your platform data
Failing automated tests, Cleo Insights, stale and expiring evidence, maturity against framework goals, upcoming audits, risk scenarios from the assessment, overdue Planner tasks, vendor concentration — across every client environment you manage.
Your existing engagements
Opportunities are checked against the engagements already in place, so work you are already delivering is never raised again.
Your business
Your service catalog and rate card, configured once, so you are never shown work you don't sell at prices you don't charge.
The whole firm, or a single account
Firm level
The practice lead's dashboard: total identified opportunity across the book, ranked and filterable by client, service line, framework or consultant. Open opportunities are a KPI on the Portfolio dashboard.
Client level
Inside any client record, an Opportunities tab with that account's items — ranked, sized and traceable. Open it before a QBR and walk in with three evidenced recommendations instead of a status update.
Cleo surfaces. You decide.
Nothing is auto-sent
Opportunities are internal. No client is contacted, notified or shown anything by this feature.
Dismiss teaches the ranking
Wrong service, wrong client, wrong timing, already sold — tell it why and the ranking adapts to how your firm works.
Same privacy controls as Cleo
Uses your Cleo Insights entitlement and AI credits; clients are not charged. Can be turned off entirely in settings.
Refreshes itself
Opportunities update automatically as client data changes, or on demand from the page. You never rerun anything.
Three things have to be true at once
True multi-tenancy with a shared taxonomy
Controls, risks and maturity levels mean the same thing in every client organization, or cross-client comparison is meaningless. Single-company platforms can't do it at all.
L1–L5 maturity tracked over time
Pass/fail cannot distinguish "gap" from "stalled at L2 for three quarters" — and the second one is the sellable story.
Cleo's context
Cleo already knows the environment, the framework, the answers and the evidence. Opportunity generation is a new lens on data it reads every day.
Opportunities FAQ
Won't this turn my consultants into salespeople?
Every opportunity is grounded in a real, documented gap in that client's program — a failing test, stale evidence, a maturity stall, an audit approaching. You are not upselling; you are telling a client what you found and what it would take to fix. Anything that doesn't fit gets dismissed, and the ranking learns from it.
Where do the numbers come from?
From your own service catalog and rate card — not industry averages or someone else's pricing. Each opportunity shows its severity, the effort involved, the figures behind it and a written pitch from Cleo, and every figure links back to the controls, tests, risks, evidence, frameworks, audits or insights that produced it. They are scoping estimates, not quotes.
What kinds of opportunities does it raise?
Six: remediation projects (a severe gap with no engagement scoped against it), audit readiness (an audit approaching that posture isn't ready for), evidence automation (evidence collected by hand that an integration could collect), framework expansion (a profile that suggests a framework the client hasn't adopted), risk exposure (a risk scenario such as ransomware with risks needing attention — raised only once at least 80% of the scenario's questions are answered), and portfolio patterns (the same gap across several clients).
Does it raise work we're already doing?
No. Opportunities are checked against the engagements you already have in place, so a gap that is already being worked on isn't raised again.
Is anything sent to my clients?
Never. Opportunities are internal. Marking one Pursuing or creating an engagement from it attaches it to the client record inside RealCISO — that's all. Nothing reaches a client without a person accepting it first, and the whole feature can be turned off.
Who pays for the AI behind it?
Opportunities use your organization's Cleo Insights entitlement and AI credits. Your clients are not charged. It is included with the Consultant License.
Go deeper on any capability
Opportunities is Cleo applied to your whole book.
See what's hiding in your book
Opportunities is included with the Consultant License. Bring your client list — we'll show you what it's worth.
Book a Demo Start Free