# Cybersecurity Renewal & Competitor Lead Finder (`mrkvasilev/cybersecurity-renewal-lead-finder`) Actor

Find evidence-backed ESET and Fortinet public-sector renewal opportunities in Czechia. Get buyer, incumbent reseller, product, contract value, buying window, confidence, evidence, and official source URL for ATTACK or DEFEND sales workflows.

- **URL**: https://apify.com/mrkvasilev/cybersecurity-renewal-lead-finder.md
- **Developed by:** [Krasimir Vasilev](https://apify.com/mrkvasilev) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $490.00 / 1,000 verified opportunities

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Cybersecurity Renewal & Competitor Lead Finder

Turn Czech public-sector contract data into **actionable cybersecurity renewal and competitor-account signals**.

This Actor scans official Czech Contract Registry open-data records and looks for evidence that an ESET or Fortinet account may be approaching its next buying cycle. Instead of returning a raw procurement database, it returns structured **ATTACK** or **DEFEND** opportunities with the incumbent supplier, product, contract value, licence count when available, evidence, source contract, and a conservative expected buying window.

The Actor is designed for cybersecurity resellers, MSPs, distributors, vendor channel teams, account managers, and sales operations teams that want a focused list of accounts worth reviewing.

> This Actor is not affiliated with the Czech Contract Registry, ESET, Fortinet, or any reseller. A buying-window signal is not a guarantee that a future procurement or renewal will occur.

### What you get

Each returned opportunity can include:

- **ATTACK / DEFEND action** — target a competitor-held account or protect your own installed base
- **Confidence level** based on the evidence available in the public record
- Public-sector buyer
- Cybersecurity vendor and normalized product family
- Licence / seat count when stated in the registry subject
- Incumbent reseller or supplier
- Contract value and VAT context when available
- Explicit contract term or service-end date when available
- Expected buying-window range
- Evidence and reason codes used to create the signal
- Direct source contract URL for verification

The current live version focuses on **ESET and Fortinet** opportunities in Czech public-sector contracts.

### How the signal works

The Actor streams official Czech Contract Registry monthly XML open-data dumps and applies deterministic extraction and quality checks. High-confidence opportunities require strong timing evidence such as an explicit one-year licence/support term or an explicit service-end date.

The output deliberately uses a **buying window rather than a fake exact prediction date**. For example, a one-year security licence signed in September may create a summer-to-autumn buying window for the following year, giving a reseller time to qualify the account before the likely renewal cycle.

Every live result keeps its source URL so users can independently verify the evidence.

### ATTACK mode

Use ATTACK mode to find accounts currently supplied by other resellers.

Example input:

```json
{
  "scanMonthsBack": 1,
  "mode": "attack",
  "vendors": ["ESET", "Fortinet"],
  "reseller": "",
  "horizonMonths": 18,
  "minConfidence": "HIGH",
  "limit": 20
}
```

Typical use cases:

- Find ESET public-sector accounts approaching their next buying cycle
- Find Fortinet renewal opportunities where another supplier is incumbent
- Build a focused account list for channel sales teams
- Monitor fresh public cybersecurity licence/support purchases for future renewal timing

### DEFEND mode

Use DEFEND mode to find contracts where your reseller name is the incumbent supplier.

```json
{
  "scanMonthsBack": 3,
  "mode": "defend",
  "vendors": ["ESET", "Fortinet"],
  "reseller": "Your Company Name",
  "horizonMonths": 18,
  "minConfidence": "HIGH",
  "limit": 20
}
```

This can act as an external public-data cross-check for renewal planning. Supplier matching is currently text-based, so use the company name as it normally appears in Czech public contracts.

### Confidence levels

**HIGH** — strong timing evidence exists, such as an explicit one-year term or explicit service-end date.

**MEDIUM** — there is renewal language and recurring-product evidence, but the exact term is weaker or inferred.

**WATCH** — the contract looks commercially relevant, but timing evidence is not strong enough for a high-confidence sales action.

For initial prospecting, `HIGH` is the recommended setting.

### Output example

```json
{
  "action": "ATTACK",
  "confidence": "HIGH",
  "buyer": "Město Týn nad Vltavou",
  "vendor": "ESET",
  "product": "ESET PROTECT Enterprise",
  "seats": 130,
  "incumbent": "UNISMINI - služby, spol. s r.o.",
  "contractValue": 124155,
  "currency": "CZK",
  "termMonths": 12,
  "windowStart": "2027-07-10",
  "windowEnd": "2027-10-23",
  "sourceUrl": "https://smlouvy.gov.cz/smlouva/39430557",
  "dataStatus": "AUTO_QA_PASSED"
}
```

### Data quality and limitations

The Actor intentionally favors precision over volume. Automatic QA rejects ambiguous suppliers and weak high-confidence signals, and results are deduplicated before delivery.

Public metadata is not always complete. Seat counts, exact service periods, or product editions may be absent from some contracts. The expected buying window is an evidence-based commercial signal, not a statement that a tender, renewal, or supplier change is certain to happen.

The current live MVP scans up to three monthly registry dumps per run and supports ESET and Fortinet. Additional cybersecurity vendors and deeper attachment-level term extraction can be added as the product matures.

### Pricing

The Actor is designed for **pay-per-event** pricing: users pay for opportunities actually delivered to the default dataset. The current event is named `verified-opportunity`. The exact active event price is shown by Apify before a paid run.

### Privacy and source data

The Actor focuses on legal entities, public buyers, suppliers, products, values, terms, and contract metadata. It does not intentionally enrich or sell personal contact data.

Source records come from the official Czech Contract Registry public open-data feed, and every delivered opportunity includes a source contract URL for traceability.

# Actor input Schema

## `scanMonthsBack` (type: `integer`):

How many monthly registry XML dumps to scan, including the current month. One month is fastest; three months provides broader coverage.

## `mode` (type: `string`):

ATTACK finds competitor-held accounts. DEFEND finds accounts held by the reseller you specify.

## `vendors` (type: `array`):

The live version currently recognizes ESET and Fortinet contracts. Keep the default values unless you intentionally want to filter to one vendor.

## `reseller` (type: `string`):

Required in DEFEND mode. In ATTACK mode, optionally enter your company name to exclude accounts you already hold.

## `horizonMonths` (type: `integer`):

Only return buying windows that overlap this many months from today.

## `minConfidence` (type: `string`):

HIGH is recommended for prospecting because it requires stronger timing evidence.

## `limit` (type: `integer`):

Maximum number of opportunities to deliver after filtering, quality checks, and deduplication.

## Actor input object example

```json
{
  "scanMonthsBack": 1,
  "mode": "attack",
  "vendors": [
    "ESET",
    "Fortinet"
  ],
  "reseller": "",
  "horizonMonths": 18,
  "minConfidence": "HIGH",
  "limit": 20
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("mrkvasilev/cybersecurity-renewal-lead-finder").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("mrkvasilev/cybersecurity-renewal-lead-finder").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call mrkvasilev/cybersecurity-renewal-lead-finder --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mrkvasilev/cybersecurity-renewal-lead-finder"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/dKblNqvPlG0IW3h4i/builds/ysEMPRBesyM0hQJtE/openapi.json