How KeyValue led Cyber Sierra’s AI transformation, from first prompt to AI analysts in production
KeyValue turned an established compliance platform into an AI-first product, with AI analysts that audit evidence, answer security questionnaires and search every record — built to the standard auditors and regulators expect.
- Client website
- cybersierra.co
- Geography
- Singapore · United States
- Industry
- Compliance & cybersecurity software
- KeyValue’s role
- AI engineering partner, from research to production
- Customers served
- Banks, insurers, government agencies and multinationals
- Standards
- ISO 27001, SOC 2 and other security and financial regulations
Make compliance work AI-first, without lowering the bar
Founded in Singapore in 2020, Cyber Sierra helps banks, insurers and other regulated organisations prove they follow security and compliance rules — known as governance, risk and compliance (GRC). Every rule (a “control”) must be backed by proof (the “evidence”), and someone has to check it. The goal was to have AI analysts do that checking, with people approving every decision.
Weeks of manual review
A single ISO 27001 certification covers 93 controls, each with documents someone must read and sign off by hand.
Repeated questionnaire work
Enterprise buyers send hundreds of questions whose answers already exist in approved evidence.
Samples, not coverage
Teams review a sample, and gaps surface at the next audit — after the certificate is already signed.
An AI engineering team, side by side with the product
KeyValue’s AI engineering team works alongside Cyber Sierra’s developers on the platform’s AI features, from research and prototypes through to production. A new AI agent typically reaches its first release about six weeks after the first commit.
Research & prototypes
Proving what AI can do before it reaches customers
AI analysts
Audit, answering, search and dashboard capabilities
Data & search
Document understanding and unified search
Quality & trust
Evaluation, monitoring and audit trail
Platform & cloud
Integration and enterprise-grade delivery
From research to production
- 01
Late 2024
Research and prototypes
- 02
Early 2025
First AI features built into the product
- ✓
Today
AI analysts across the platform
“The hard part was never getting a model to answer. It was getting one to abstain, to repeat itself exactly, to cite only what it used, and to stop safely when something is missing.”KeyValue AI engineering team
Four AI capabilities, one shared document library
Every capability draws from the compliance team’s existing documents, ensuring answers are backed by approved evidence and expired documents are excluded.
Evidence Auditor
Reviews the evidence behind each control and explains whether it meets the requirement — with the justification, the gap, and a recommendation.
Due Diligence Analyst
Drafts answers to security questionnaires from approved evidence, with a confidence score and sources on every answer — returned in the customer’s original file.
Semantic Search
Finds information across compliance records using plain language — combining keyword precision with semantic understanding of the compliance domain.
Dashboard Builder
Turns a plain-English question into a chart over the customer’s own compliance data — and says so when the data can’t support a metric.
The AI reads and reasons, a person makes the call, and every step is recorded.
- 01
Evidence & questions
Policies, reports, questionnaires
- 02
AI analyst
Reads, reasons, cites or declines
- 03
Human review
Approve, edit or override
- ✓
Cited decision
Logged for the auditor
Built for how compliance teams actually work
Verdict per evidence file
Not one blended answer per control.
Cited justifications
Naming the documents and dates used.
Gap & remediation advice
On anything short of compliant.
Questionnaires in, same file out
Spreadsheet, document or PDF.
Plain-English dashboards
Read-only, on that customer’s data.
Flags what it can’t support
For a person to review.
Making AI decisions hold up in an audit
The hard part is making AI decisions consistent, explainable and safe to rely on.
Consistent, defensible decisions
AI interprets the evidence; clear rules make the final call, so similar evidence gets similar answers — with a justification an auditor can check.
No two audits look the same
A modular design gives each type of audit the right checks, and new capabilities can be added without a rebuild.
Real contradictions, not false alarms
Genuine conflicts between documents are separated from simple differences in wording, and uncertain cases go to a person.
Secure, offline deployments
The platform, AI included, can run in locked-down environments with no internet access — shipped behind a single CLI for a non-engineer to run.
Built on a modern, cloud-native AI stack
AI
- OpenAI
- Claude Sonnet & Opus
- Gemini
- LangGraph
- LangChain
- Qdrant
- Semantic & keyword search · reranking
- Document parsing & OCR
Product
- React
- TypeScript
- Python
Cloud
- Azure
- AWS
Quality
- AI evaluation · RAGAS
- LLM tracing · Langfuse
- Monitoring
- Audit trail
Built with Claude
AI analysts built to support security teams at every stage of an investigation.
Claude powers how KeyValue builds them.
Claude Code
Our engineers use Claude Code day to day, and report higher-quality output and fewer review cycles.
Understanding the data
Claude helps our team document and make sense of complex data models underneath the compliance platform.
Results for Cyber Sierra and its customers
Semi-annual access review across 12 countries*
To answer a 150-question security questionnaire*
Within 12 months at a Fortune 500 insurer*
IMDA AI governance framework contributor (2026); available on AWS & Azure Marketplace
* Figures published by Cyber Sierra on cybersierra.co.
Inspired by this
success story?
Build your AI product with us.
