From days to minutes: a cybersecurity compliance platform, built from scratch

Evaluating a supplier’s cybersecurity posture means processing dozens of documents against multiple regulatory frameworks, consistently and at scale. Exacorp built a SaaS platform to make this possible. Rational AI designed the application and provided the AI engine running inside it.

The Client

Exacorp is a Milan-based SaaS startup in the cybersecurity governance and compliance market. Its platform enables enterprise organizations to assess and monitor the cybersecurity maturity of their supplier chains across ICT, OT, and NIS domains — covering NIS2, ISO 27001, DORA, and NIST CSF. Suppliers upload their documentation through a dedicated interface; the platform generates a Maturity Score, identifies compliance Gaps, and recommends remediation Actions.

The Problem

A single supplier assessment involves between 50 and 100 unstructured documents. Manual processing meant days of analyst work per assessment — slow, inconsistent across assessors, and impossible to scale. Exacorp also needed a purpose-built multi-role application: no existing product covered the combination of client organization access, supplier upload workflows, and an admin layer for Exacorp’s team to validate, intervene, and manage assessments directly. Everything had to be built from scratch, with AI embedded at the core from day one.

The Solution

Rational AI delivered the project in a single engagement between November 2025 and March 2026, covering both custom software development and AI integration.

The application serves three user types with dedicated access layers: client organizations monitoring their supplier network, suppliers uploading assessment documentation, and the Exacorp admin team — which can validate AI-generated outputs, intervene on any assessment, and impersonate accounts to provide direct operational support.

The AI layer — built on Rational Knowledge and Rational Core, integrated via API and deployed on cloud infrastructure — handles automatic ingestion of multi-format supplier documents, semantic indexing, and evaluation against regulatory control frameworks using Graph RAG. Unlike standard retrieval approaches, Graph RAG maps relationships between controls, document evidence, and compliance gaps, making every output traceable to its source.

The result: assessments that previously required days of analyst work are completed in minutes, across all supported frameworks simultaneously. Human analysts retain final review authority throughout.