Professional services · Global SAP security firm (Australian practice)
2 days to 2 hours: AI-driven security assessments for a global SAP security firm
A security maturity assessment method captured as a playbook-driven AI workflow, from interviews and million-row log extracts to a populated recommendations report. Version 1.0 delivered in 23 days, cutting analysis time by close to 90%.
The challenge
Our client is a global SAP security firm with an Australian practice. One of its core services is an SAP security maturity assessment: consultants interview the client's team, extract and analyse SAP security and user access logs, then complete a recommendations and best-practice document. • Time: analysing the data for a single assessment took about 2 FTE days. • Volume: each engagement brings hours of interview recordings, a stack of documents and large log extracts to read, cross-check and summarise. • Consistency: the best-practice method had to be applied the same way every time, whichever consultant ran it. • Confidentiality: security and access logs are among a client's most sensitive data, so public AI tools were not an option.
Our solution
The firm wanted proof on a real engagement, not a requirements document. We delivered a paid, fixed-price MVP in roughly 20 business days: work started on 13 November 2025 and version 1.0 was released on 6 December 2025. • A playbook that drives delivery: each engagement gets its own secure workspace, driven by a task-list playbook that guides the consultant step by step. • Interviews: audio and video recordings transcribed with timestamps, including descriptions of on-screen content. • Documents: PDF, Word, PowerPoint, Excel and CSV files read, including scanned pages. • Logs: security and user access extracts of up to a million rows per sheet analysed with read-only queries. • Repeatable analysis: each pipeline runs defined steps (analyse, summarise, extract, compare, classify) so the same inputs get the same treatment every time. • A guided conversation that never invents data: where information is missing, the agent asks the consultant for it, one or two items at a time. • The report, populated: the agent fills the firm's Word recommendations template and saves it to the workspace, ready for review. • Governance built in: client data isolated, hosted in Australia, choice of commercial or self-hosted models, and every AI action logged for audit.
The results
• Data analysis per assessment down from about 2 FTE days (15 to 16 hours) to about 2 hours: close to 90% less time. • The same playbook and pipelines on every engagement, instead of depending on the individual consultant. • Missing information requested by the agent as the work progresses, not discovered during write-up. • Recommendations document populated from the firm's template rather than written up by hand. • Every AI action logged, replacing a manual audit trail. • Consultants spend less time processing data and more on interviews, interpretation and advice. What's next: the firm is rolling the platform out for wider testing across its consultants. What was built here has since grown into ConsultancyOS, the operating system for consulting firms built on the AIOX Run platform.