Opportunities
Cleo already knows what’s broken in your clients’ security programs. Now it tells you what that’s worth.
Portfolio intelligence that turns compliance findings into a revenue pipeline.
Book a Demo → Start FreeIncluded with the RealCISO Consultant license
Every consulting firm has the same blind spot
The data that would tell you where your next $200K of work is sitting is trapped inside individual client engagements, in the heads of individual consultants. The pattern is always the same.
The report that ended the conversation
A consultant finishes a NIST CSF assessment, delivers the report, moves on to the next client. Eleven of the gaps in that report were sellable remediation projects. Nobody scoped a single one.
The offering nobody built
You have 40 clients. Twenty-two of them have no incident response plan. That is a productized service offering hiding in plain sight — but nobody could see the pattern, because nobody can see across the book.
The forecast that was a guess
Renewal season arrives and the practice lead is estimating expansion revenue from memory and gut feel, instead of forecasting it from evidence the firm already collected.
Consultants aren’t bad at selling. They’re bad at seeing — because the platform they deliver work in was never built to surface opportunity. Assessment tools optimize for the deliverable. Nobody optimizes for what happens after it.
Meanwhile, your client isn’t buying compliance. They’re buying problems solved. Your gap list is a problem list. Your problem list is a service catalog nobody wrote down.
What Opportunities does
A portfolio-level intelligence layer inside RealCISO. It continuously reads your entire book of business and surfaces ranked, revenue-sized service opportunities — answering the question a practice lead has never been able to answer:
“Given everything my platform knows about all my clients, where is my next dollar of revenue — and what do I say to get it?”
Every opportunity is a card
Three pieces of information. Three actions. That’s the whole interaction.
Opportunity
Incident Response Program Build — Meridian Health
Title
The offering, named in language your client would recognize — not a control ID.
Notional revenue
A dollar range derived from your rate card and the scope of the underlying gap. Your pricing, not a benchmark.
The pitch
Two or three sentences you can use verbatim: the specific finding, the business consequence, the proposed engagement.
Where the signal comes from
Two inputs, combined. Neither is enough on its own — and the combination is what makes the output consultant-grade instead of generic.
Input 1
Your platform data
Already structured, already there. Cleo reads it continuously across every client environment you manage.
- Unresolved gaps and control failures
- L1–L5 maturity scores — clients stalled below a threshold, or trending down quarter over quarter
- Framework coverage signals — a HIPAA client adding a payments line, a SOC 2 client chasing federal prospects
- Evidence expiration and staleness at portfolio scale
- Overdue Planner tasks and stalled remediation
- TPRM: vendor concentration and overdue vendor assessments
- Assessment recency — clients drifting past their review cycle
- Cross-client patterns — the same gap in 15 clients isn’t 15 opportunities, it’s one productized offering
Input 2
Your business
Configured once, in minutes. This is what stops Opportunities from recommending work you don’t sell at prices you don’t charge.
- Service catalog — what your firm actually sells. Policy development, IR tabletops, CMMC readiness, fractional CISO retainers, audit prep. Your list.
- Rate card — blended hourly, fixed-fee packages, or retainer bands.
- Delivery capacity (optional) — so you don’t get shown $2M of work a six-person team can’t staff.
Don’t sell IR tabletops? You will never be shown an IR tabletop opportunity.
Set it up once
Opportunities stays locked until you’ve added your service catalog and rate card. That’s deliberate. We will not invent a number and put it in front of you — a revenue figure that’s wrong on first contact is worse than no figure at all.
Start from a template
Begin with a starter catalog of common vCISO and MSP offerings and edit it down to what you actually sell. Ten minutes, not an afternoon.
Add your rates
Blended hourly, fixed-fee packages, retainer bands — however you price. Sizing uses your numbers and nobody else’s.
Opportunities unlocks
Cleo runs against your full book and returns a ranked, sized list. It refreshes as assessments, evidence, and maturity scores change — you never rerun anything.
Two views
One engine, two apertures — the whole firm, or a single account.
Primary
Firm level
The practice lead’s dashboard. Total identified opportunity across the entire book, ranked and filterable by client, service line, framework, or consultant.
This is a pipeline view for a business that has never had one — and the rollup number is the one that changes how you run the firm:
“You have identified, evidenced service opportunity sitting inside the clients you already have.”
Per account
Client level
Inside any client record, the opportunities specific to that account — ranked, sized, and each one traceable back to the finding that produced it.
Open it before a QBR or a renewal conversation and walk in with three evidenced recommendations instead of a status update.
Every opportunity links to the control, gap, or maturity score behind it. You can always show the client your work.
What this looks like in practice
Illustrative scenarios. Dollar figures are examples — your figures come from your own rate card.
The pattern nobody could see (Cross-client)
A 40-client vCISO practice opens the firm-level view. The top item isn’t a single client — it’s a pattern: “22 clients have no documented incident response plan. Packaged as a fixed-fee IR Program Build, this represents a productizable offering across your book.”
The firm builds the offering once, prices it once, and sells it 22 times. Delivery cost per client drops with every repetition.
Why this works: only a platform that sees every client through the same control taxonomy can find this.
The renewal that became an expansion (Client level)
A consultant has a QBR with a manufacturing client in three days. She opens Opportunities on that account and finds four items ranked by revenue and readiness — including a CMMC Level 2 readiness engagement flagged because the client’s new defense contract triggered a framework they aren’t assessed against.
She adds two to the client record, uses Cleo’s pitch language as her starting point, and walks into the QBR with a proposal instead of a recap.
Why this works: the finding, the business consequence, and the pitch arrive together.
The stall that was worth money (Maturity trajectory)
A client has sat at L2 on Detect for three consecutive revisions. No new gaps opened — nothing looks broken on a pass/fail view. But the trend line is flat, and flat is a story: the client bought monitoring tooling and never operationalized it.
Opportunities surfaces a Detection Engineering & Use Case Development engagement, sized from the firm’s rate card, with the three-revision maturity history attached as the evidence.
Why this works: binary status tools can’t see a stall. Maturity trajectory can.
Why no other platform does this
Three things have to be true at the same time. RealCISO is the only platform in this market where all three are.
1. True multi-tenancy with a shared taxonomy
Controls, risks, and maturity levels have to mean the same thing in every client organization, or cross-client comparison is meaningless. Single-company platforms can’t do it at all. Partial multi-tenancy can’t do it reliably. Without this there is no portfolio view — only forty separate views.
2. L1–L5 maturity tracked over time
Binary pass/fail cannot distinguish “gap” from “stalled at L2 for three quarters” — and the second one is the sellable story. Other tools give you status. RealCISO gives you trajectory, which is what a client actually needs to hear and what an engagement actually fixes.
3. Cleo’s context awareness
Cleo already knows the environment, the framework, the answers, and the evidence. Opportunity generation isn’t a new data problem — it’s a new lens on data Cleo reads every day. A general-purpose AI bolted onto a compliance tool has none of that context, and no amount of prompting replaces it.
You stay in control
Cleo surfaces. You decide. Nothing reaches a client without a human accepting it first.
Nothing is auto-sent
Opportunities are internal. No client is ever contacted, notified, or shown anything by this feature. Accepting an opportunity attaches it to an engagement or a client record inside RealCISO — that’s all.
Dismiss teaches the ranking
Dismiss anything that doesn’t fit and tell us why — wrong service, wrong client, wrong timing, already sold. The ranking adapts to how your firm actually works.
Same privacy controls as Cleo
Your data stays in your instance. And like every other Cleo capability, Opportunities can be turned off entirely from settings if you don’t want it.
Every number is traceable
Each opportunity links back to the control, gap, evidence, or maturity trend that produced it. Nothing is a black box, and nothing is unfounded in front of a client.
Common questions
“Won’t this turn my consultants into salespeople?”
Every opportunity is grounded in a real, documented gap in that client’s program. You’re not upselling — you’re telling a client what you found and what it would take to fix. That’s the job. Anything that doesn’t fit gets dismissed.
“The revenue numbers will be wrong.”
They’re derived from your rate card and your service catalog — not from industry averages or someone else’s pricing. They’re notional scoping estimates, not quotes. You scope and price the work; Opportunities tells you the work is there.
“We already know our clients’ gaps.”
You know this quarter’s engagement. You don’t know that 22 of your 40 clients share the same gap, that six clients have evidence expiring inside 30 days, or which accounts have been flat on maturity for three revisions. That’s not a memory problem — no one can hold a whole book in their head.
“Is AI deciding what to sell my clients?”
No. Cleo surfaces candidates from data you already own; you decide what’s real. Nothing reaches a client without you accepting it, every recommendation traces back to a specific finding, and the whole feature can be disabled.
“Does this connect to our CRM?”
Opportunities lives entirely inside RealCISO today. Accepted opportunities attach to engagements and client records in the platform, which keeps the full loop — finding to engagement to outcome — in one place.
Expansion revenue from clients you already have
Every opportunity Cleo surfaces is revenue inside your existing book — no acquisition cost, no new logo to win, no marketing spend. Work you were already entitled to and simply couldn’t see.
A tool that saves your consultants time gets compared against other tools on price. A platform that demonstrably grew your book gets compared against nothing.
See what’s hiding in your book
Opportunities is included with the RealCISO Consultant license. Bring your client list — we’ll show you what it’s worth.
Book a Demo → Start Free