Two cybersecurity firms can read the same public-sector notice and reach opposite conclusions. That is not inconsistency. It is what happens when the opportunity is evaluated against two different companies.

Search systems tend to begin with the record: title, agency, keywords, classification, place of performance, deadline. Kellette begins with a second object that is equally important: the company profile.

We call that profile company profile.

company profile is not a marketing description

A company website may say the firm delivers “end-to-end cybersecurity solutions.” That language can be useful for positioning, but it is too broad for rigorous qualification.

company profile should contain confirmed operating facts, not aspirational copy. If the firm performs penetration testing but does not operate a managed security service, those should be represented differently. If the team wants federal work but not state and local work, the profile should say so. If a certification or clearance is not confirmed, the system should not infer it from the company’s market presence.

The profile exists to make opportunity reasoning specific.

The better the company context, the less the system has to guess about fit.

The five layers of a useful profile

1. Confirmed capabilities. What services does the company actually deliver today? Examples might include penetration testing, vulnerability assessment, managed detection and response, GRC, CMMC advisory, cloud security, IAM, incident response, vCISO services, AppSec or digital forensics.

The important word is confirmed. A capability should not appear simply because it is adjacent to something the firm does.

2. Market preferences. Which public-sector markets does the company want to pursue? Federal, state and local, education, or a combination? Are there agencies or mission areas the firm prioritizes?

3. Commercial shape. What engagement sizes make sense? What delivery models are preferred? How much response runway does the team need before a deadline? These constraints help distinguish an interesting record from a workable pursuit.

4. Known qualifications. Which contract vehicles, certifications, clearances, socioeconomic designations or other relevant qualifications are confirmed? This layer should be factual and versioned.

5. Exclusions. What should the system remove automatically? The ability to state “do not show us this kind of work” is as important as the ability to state what the company wants.

Unknown should remain unknown

AI systems are often rewarded for producing an answer. Opportunity intelligence sometimes becomes more trustworthy by refusing to complete a missing fact.

If a solicitation references a qualification and the company profile does not confirm that qualification, the correct state is not “eligible” or “ineligible.” The correct state is unknown, verify before pursuit.

This is a small design choice with large consequences. It prevents the system from turning absence of information into a confident business conclusion.

The profile should change over time

A cybersecurity company is not static. Services expand. Team size changes. New vehicles are added. Geographic preferences shift. A company that once rejected managed services work may later build that capability.

company profile therefore needs history. When a profile changes, the system should preserve the earlier version rather than overwrite the past without context.

Versioning allows a future reviewer to understand why an opportunity was recommended or rejected at a specific moment. It also creates a cleaner foundation for learning from feedback because the feedback can be tied to the profile that generated the recommendation.

Feedback should sharpen the profile, not silently rewrite it

If a user repeatedly dismisses a class of opportunities, that behavior is useful. It may reveal a missing preference or exclusion. But behavior should not automatically become a confirmed company fact.

A stronger system can say: Your team has dismissed several opportunities with this delivery model. Do you want to add it as an exclusion?

That preserves a critical boundary between observed behavior and explicit profile truth.

company profile changes the unit of analysis

Without company context, an opportunity is judged against a category. “Is this cybersecurity?”

With company profile, the question becomes operational. “Does this scope align with this company’s confirmed capabilities, preferences and constraints, and what remains unknown?”

That is a more demanding question, but it is also the question a small firm actually needs answered.

Kellette’s product direction follows from that premise. company profile is not a profile page added around the edges of search. It is part of the reasoning substrate. It defines the company against which every future signal is interpreted.