Skip to content
Case Study Cybersecurity Consultancy

Revolutionizing Compliance Document Reviews with Machine Learning

In six weeks, HatchWorks AI built a prototype machine learning service that predicts the compliance status of a document and points to the exact text behind its verdict: 80% accuracy on test data, against a 50% benchmark set by stakeholders.

ClientA leading cybersecurity consultancy
EngagementSix-week strategic initiative
ProductPrototype ML service for compliance status prediction
StandardPCI-DSS
Digitalizing compliance document review with machine learning for a cybersecurity consultancy
HatchWorks Team Product Strategist, Senior Machine Learning Engineer, Senior Data Engineer
Overview

A six-week prototype to take the manual work out of compliance review

HatchWorks was engaged by a leading cybersecurity consultancy on a six-week strategic initiative to develop a prototype machine learning service. This service, leveraging the client's data, was designed to predict the compliance status of a document.

Once fully realized, this service promises to significantly reduce the time consultants invest in manually assessing customer compliance documents.

The Challenge

A vast team of consultants, reading documents by hand

The manual review of customer compliance documentation was a significant bottleneck. Employing a vast team of consultants for this seemingly straightforward task was resource-intensive and fraught with inconsistencies and subjective interpretations.

Given their lack of in-house machine learning capabilities, the client sought HatchWorks' expertise.

Before and after: manual compliance document review compared with machine learning-assisted review
Before and after: manual review by consultants versus ML-assisted assessment

Where the manual process broke down

  1. 01

    Streamlining workflows for consistency

    Reviews varied from consultant to consultant, with subjective interpretations of the same requirements.

  2. 02

    Upholding quality standards

    Keeping every assessment to the same bar was hard when the work was repetitive and resource-intensive.

  3. 03

    Keeping consultants engaged

    Skilled consultants spent their time on a seemingly straightforward task instead of higher-value work.

The Process

Six weeks to validate feasibility

  1. 01

    Training data from past projects

    The client provided structured datasets from past projects to train the ML model. The data was cleansed and structured for model training.

  2. 02

    PCI-DSS requirements as queries

    Compliance requirements, specifically from the PCI-DSS standard, were ingested and transformed into optimized queries.

  3. 03

    Embedding retrieval, fine-tuned decision

    These queries enabled an embedding model to sift through vast documentation, extracting relevant contexts. Each context was processed by a fine-tuned language model, which determined compliance based on historical data.

  4. 04

    Collaborative validation

    Collaborative virtual sessions with client stakeholders ensured data quality, model accuracy, and alignment throughout.

How a document gets assessed

Two models, one verdict: the embedding model finds the passages that matter, the fine-tuned language model decides whether they meet the requirement.

Step 01Inputs
Customer compliance documentThe documentation consultants previously read end to end by hand.
PCI-DSS requirementsIngested and transformed into optimized queries.
Step 02Retrieve
Embedding modelSifts through vast documentation and extracts the contexts relevant to each query.
Step 03Decide
Fine-tuned language modelDetermines compliance for each context based on historical data from past projects.
Step 04Verdict
Compliance status with text referencesThe model pinpoints the specific passages behind its assessment, so a consultant can verify instead of re-read.
The Outcome

Feasibility validated, with the benchmark cleared by 30 points

By the project's end, the language model showcased its capability to assess compliance documentation, pinpointing specific text references. Achieving this within six weeks underscored the potential of the approach.

The model reached 80% accuracy against test data, surpassing the initial 50% benchmark set by stakeholders. The prototype validated feasibility and highlighted areas for future improvement, especially with more data.

Accuracy on test dataPrototype after six weeks
Compliance status predictionModel vs benchmark
ML model80% Benchmark50%

The 50% benchmark was the initial target set by client stakeholders before the engagement.

A vast team of consultants reading every compliance document by hand

Inconsistent results and subjective interpretations across reviewers

No in-house machine learning capability to change the approach

Key Stats

The prototype, in numbers

80%

model accuracy against test data

50%

initial benchmark set by stakeholders, surpassed

6weeks

from kickoff to a working prototype

Technologies Used

The approach

Models
Embedding model for context retrievalFine-tuned language model
Data
Structured datasets from past projectsData cleansing and structuringPCI-DSS requirements as optimized queries
Client Quote

In their words

“It has been a pleasure working with HatchWorks for almost two years now. They work seamlessly with my team, have overlapping time zones for efficient Agile development, and have a governance model to ensure success. HatchWorks has become our partner for several successful ongoing projects. I like their US-based Headquarters, and quality delivery teams working in Latin America. I plan to continue working with HatchWorks for our mutual journey and partnership.”
Chief Technology OfficerCybersecurity Consultancy
Context

About the work

HatchWorks AI turns AI into ROI by automating key business processes, transforming data, deploying intelligent agents, and shipping AI-powered products that deliver measurable results. Its proprietary Generative-Driven Development methodology is a repeatable path from idea to production, blending AI, agents, and engineering to ship faster with less risk.

Have a manual review process worth automating?

See how HatchWorks AI validates machine learning ideas in weeks, using your own data.