Tickbox

A small supplier wins a deal with a larger customer and gets sent a security questionnaire. Two hundred rows, phrased for an organisation with a security team, sent to one that has a director and an accountant.

They can pay a consultant several thousand pounds, guess, or stall. Most stall, and the deal slows down over paperwork rather than over anything anyone actually cares about.

Tickbox drafts answers from what the business already has: its policies, its previous questionnaires, its actual setup. Then a person reviews them.

The bit that matters

Drafts, not answers. The output is explicitly something to review, and the interface is built to be argued with rather than accepted. That is not modesty about the model, it is the correct shape for the problem: these are statements the business is making to a customer about its own security posture, and it has to stand behind them.

An assistant that produced confident, plausible, unverified answers to a security questionnaire would be worse than the spreadsheet. It would be a machine for generating claims you cannot support, in exactly the setting where being caught out is expensive.

Retrieval over generation. The useful answer is usually already written down somewhere in the business, in the wrong words. Vectorize handles finding it; the model's job is mostly rephrasing into the question's terms and flagging where nothing was found rather than inventing something that sounds right.

Status

Live at usetickbox.com and still being worked on. The self-serve pricing question is not settled: the people who need it most are exactly the people who will not pay consultancy rates, which is the whole premise and also the hard part.