Conveyor Inc., a platform that automates security and compliance review responses for customers, announced Tuesday that it has raised $12.5 million in a Series A funding round led by Cervin Ventures.

The company’s aim is to use artificial intelligence large language models to automate reviews so that businesses can get on with their day-to-day work.

Conveyor Chief Executive Chas Ballew said in the announcement that a gap exists between providers and customers because security questionnaires are long, complex and difficult to and fill out. He explained that users have described it as the “worst job in (cyber)security,” especially for large customers that want to know as much as possible about whom they’re working with.

“As more of the economy goes online, we’re seeing companies in all kinds of old-fashioned industries get questioned about their security posture,” said Ballew. “We see law firms getting questions from their large corporate clients about their IT and security practices. We see manufacturers getting asked about their exposure to ransomware and business continuity disruptions.”

Review documents are fundamental for any business relationship and filling them out is absolutely necessary to understand the risks of bringing a new vendor on board. And a large security review document can include questions such as “How do you encrypt your data,” “When was your last security breach,” “How long did it take you to detect the breach” and so on.

A single review can take days, or even weeks, to complete by hand. And that is just for information security. There are other industries that have stricter regulations including government and healthcare that require even deeper vetting.

Ballew argues that LLMs are the missing link to assist vendors with automating this task by using the existing data within their systems to answer the questions. LLMs, which are the same technology that underlies OpenAI LP’s popular chatbot ChatGPT, are capable of ingesting large amounts of textual data and responding in a humanlike manner. This makes it possible for the LLM to read questions in a questionnaire and answer them in a reasonably humanlike manner.

The LLM is then capable of drawing on vendor knowledge to automate answers for the questionnaires, which allows them to upload the completed version quickly. All they have to do is run the software and review the answers for accuracy. The system is capable of exporting to a large number of formats and systems, including Salesforce.

‍‍“As a customer, it means a future where evaluating a vendor’s security and compliance posture (even in depth) is as effortless as tapping your phone at checkout,” said Ballew.

Of course, LLMs can have their own accuracy issues, including producing misinformation and suffering from hallucinations. In the Conveyor system, if the LLM isn’t confident about one of its responses, or if it isn’t relevant to the vendor in question, it flags it for human review so that it can be sent along to a qualified person. As a result, it keeps a “human in the loop” before it’s sent along.

Ballew said the company has achieved what he believes is an almost 96% automation of answers, which sounds quite impressive, but a high bar to reach. He did not reveal any details, however, on how the system decides its confidence level or reaches that high an automation score.

Image: Conveyor