Meet the FlowAssure AI agents: vendor risk management, automated

Hannah Colley00:03

Hello everyone, and welcome to the FlowAssure product showcase. I'm Hannah, digital marketing and events specialist at FlowForma, and I'll be your host for today.

Hannah Colley00:16

Before we get started, a few tips for participating. This webinar is being recorded, and if you need any assistance you can email info@flowforma.com. Your lines are muted, but we want to make this as interactive as possible, so you can type your questions in the chat box and take part in polls, and there's a survey after the webinar.

Hannah Colley00:41

Let's meet our speakers. Niamh is head of marketing here at FlowForma. She's passionate about empowering business people to digitalize and automate at speed, and she champions the message that with the right tools, anyone can drive digital transformation.

Niamh Lordan01:04

Hi, everyone. Thanks for joining us.

Hannah Colley01:07

We also have David Shanley, solutions architect at FlowForma. He's dedicated to helping organizations realize the value of AI-powered automation by turning inefficient processes into faster, smarter workflows.

David Shanley01:25

Thanks, Hannah. Hi, everyone, and thanks for joining.

Hannah Colley01:41

We know everyone's time is precious, so this is a concise webinar. Over the next 30 minutes we'll share some information about FlowForma, discuss the challenges you may be facing, introduce FlowAssure, our vendor risk management product, and David will give you a demonstration so you can get a good feel for how it works. We'll close with a live Q&A, so send us your questions throughout.

Niamh Lordan02:21

Before we dive into the FlowAssure product, I want to take a quick moment to share a little about FlowForma. We have a lot of people on the webinar today we haven't spoken with before, so you're very welcome.

Niamh Lordan02:43

FlowForma is a leader in the digital process automation space. Organizations have used our product for over 10 years to automate and manage business processes, often quite complex ones: processes with multiple approvals by different stakeholders, evidence collection, data collection and document management, processes run by enterprises that need strict IT governance, and processes that need a thorough audit trail of who did what, when and why.

Niamh Lordan03:35

The platform is trusted by IT, business leaders and risk and compliance teams around the world, and it's used by more than 300,000 people to streamline operations and get work done smarter and faster. At FlowForma we're all about empowering organizations to take control of their processes and work on what matters most.

Niamh Lordan04:13

So why are we all on this webinar today? It's been a popular one, with registrations coming in daily. We're here because vendor risk management and assessment has reached a breaking point. When David and I were preparing, we talked a lot about the challenges we hear from our community at events and from prospects and customers.

Niamh Lordan04:52

Number one is tightening regulation. Everyone is quoting the regulations they need to comply with, cybersecurity frameworks, ISO standards and many more. Regulations are getting tighter every year, and every audit now demands real, verifiable evidence.

Niamh Lordan05:35

As a result, vendor risk workloads are exploding. David and the team regularly speak with cybersecurity professionals, and demand for assessments of new apps and new vendors is increasing. But the resources in those teams aren't increasing with demand, so there's a widening gap.

Niamh Lordan06:01

Manual reviews just can't keep up. We see two cohorts: organizations managing vendor risk assessment manually in Excel, SharePoint and email, and organizations using a legacy platform without AI where the work is still done manually. Those manual processes delay teams, slow down the onboarding of new applications, and frustrate the project managers and requesters trying to make their organizations faster and more innovative.

Niamh Lordan06:57

And the number of applications will only keep growing. Every organization, us included, is onboarding more apps than ever, and most can't scale headcount to match. What you can do is look at how AI can support your specialists. These are challenges we help customers with every day, and it's a good time to transform this area because it will keep scaling.

Niamh Lordan07:41

Without further ado, let me introduce our new product, FlowAssure, which launched last year. FlowAssure is an AI-native, enterprise-ready vendor risk assessment platform: a one-stop shop for everything related to vendor risk assessment.

Niamh Lordan08:11

As you'd expect, it's a central place to manage application and vendor information and assessments, and to create, send and manage your security questionnaires and collect the responses. What makes it different for cybersecurity teams is the AI module. It's powered by AI agents that take away the heavy lifting of interpreting evidence, assigning risk and chasing vendors and approvals.

Niamh Lordan09:23

On the left of this slide are your security questionnaires and the evidence typically collected when assessing new vendors and applications: ISO reports, vulnerability scans and SOC 2 Type II reports. Teams tell us every day that they have to review, interpret, analyze and score these documents manually. That's a lot of work, and it's prone to error and inconsistency.

Niamh Lordan10:06

With FlowAssure, AI agents do a lot of the heavy lifting. As evidence comes into FlowAssure, the agents see the documents automatically, review and analyze them, apply a risk level to each piece of evidence, and provide an overall risk score based on your organization's risk profile. You upload your risk profile when you onboard and manage it for as long as you use the product.

Niamh Lordan11:01

The agents score applications from low to high. Where an organization is happy for the agents to approve low-risk applications, that happens automatically. If a medium risk is identified, a human in the loop reviews it. If the agents find high risk, the workflow triggers a deeper risk review. And it isn't only for new vendors: FlowAssure continuously monitors applications and vendors as your risk profile evolves and as vendors add capabilities and features.

Niamh Lordan12:00

There's no point in digitalizing and using AI without a clear view of the outcomes you're trying to achieve. From customers using the product and the proofs of concept we're running, we're seeing drastic improvements. Customers have seen a reduction of more than 90% in manual effort, which is huge when you could be assessing 100 or more apps a month or a quarter.

Niamh Lordan12:50

Customers are also onboarding applications at least five times faster. Reporting is another big one: the Insights module is built into the product, and your reports run automatically in the background against your SLAs. Some customers have seen a reduction of more than 80% in the time it takes their teams to report.

Niamh Lordan13:29

Another important outcome, which we'll touch on in the demonstration, is consistency. In the traditional world, risk decisions could be prone to error or based on how individuals interpret the risk. The feedback so far is that the AI agents make very consistent risk decisions based on each organization's risk profile.

Niamh Lordan14:15

This is our agent team, which you could think of as a vendor risk AI team supporting your security team. There are four agents: Quinn, built to assess your questionnaires; Penn, our pen test agent; an ISO agent; and Sam, our SOC 2 Type II report agent. The agents are plugged into FlowAssure, so they're ready to use when you get the product.

Niamh Lordan15:03

Before we jump into the demo, Hannah is looking for a quick poll. We've talked about the challenges we hear from the community, but we'd love your input on your biggest vendor risk challenge today. Is it manual reviews, slow vendor onboarding, or missing evidence and compliance gaps?

Niamh Lordan15:40

There seems to be a clear winner, David, and it comes back to the cohorts we talked about: manual reviews are the biggest challenge. Do you want to comment on that?

David Shanley15:57

That's not surprising. Overstretched security teams have to assess multiple onboarding requests, and it's very challenging and very time-consuming to read through artifacts and supporting documentation to come to an informed decision.

Niamh Lordan16:17

That's definitely something FlowAssure can help with, and onboarding FlowAssure is straightforward, so you could see results from automating those reviews very quickly.

David Shanley16:51

This case study is about a global manufacturer with more than 3,000 employees. They onboard more than 100 vendors or applications every quarter, which is a lot. They have a security team, but it's stretched, and there are challenges around subjectivity and consistency in what each security analyst considers a risk.

David Shanley17:22

There was a lack of structure, and evidence was collected in a fragmented way: email trails, with artifacts attached to emails. Going through all that content, making informed decisions and tracking the documentation was a big challenge, and as a result their vendor risk tiering was inconsistent.

David Shanley17:47

They needed an AI agent to drive efficiency, take out the low risks, and let the team focus on medium to high risks where human intervention is needed, with an objective AI assessment of what is and isn't a risk. That's the FlowAssure approach: automating security questionnaires, gathering evidence and artifacts in one place, and providing AI-assisted evaluation, with real-time visibility across all vendors through Insights reporting.

David Shanley18:22

The outcomes are a 91% reduction in manual effort, up to five times faster onboarding of applications into the business, and consistency: an objective, reliable assessment that focuses the team on medium and high risks instead of spending time on low risks.

David Shanley18:52

Now into the demo. In this use case the organization is a financial broker. A project manager wants to onboard a SaaS platform, which has to be assessed by the security team, and there will be some back and forth between the project manager and the security team until the team can make an informed decision. Our Insights BI tool is in play too, so team leads and managers have visibility of all the stats.

David Shanley19:37

It starts on the security assessments dashboard, where the project manager requests a security assessment. They can see any forms that need their attention and all the assessments they've raised. Clicking the tile opens the first step, Request assessment. There's a security team review step after it, and a project team clarification step that can go back and forth as many times as needed.

David Shanley20:13

I fill in the project title and the application description: it's a new SaaS application for the finance division. Then I upload the artifacts: a technical architecture document and a project initiation document. The moment they're uploaded, the AI agent starts processing them.

David Shanley20:42

I assign a technical architect and choose the information classification: general, personal, confidential. Is AI used? This is a smart form, so if I change the answer to yes, I'm asked how AI will be used, for example private cloud. If I change it to in-house, I get a different set of questions. The path depends on how the user fills out the form.

David Shanley21:17

In this case, the security questionnaire is an Excel sheet the vendor filled out. A pen test report is planned but not available yet, so the security team will request it from the project manager later. When the project manager is happy, they can save and return to it, or submit it to the next step.

David Shanley21:50

The form is picked up on the security team's dashboard, and they can get email notifications as well. On the second step, I expand the document review section. AI has analyzed large technical documents in seconds and extracted what matters for risk posture, replacing hours of manual reading. I can filter and look at each document.

David Shanley22:30

For the project initiation document, I can see the identified risks. If I open the document from the link and scroll down, the risks are there in place, pulled through by AI. AI gives me a summary and a risk category of medium. For the architecture document, it found that the provider retains all of the data and can use it to train AI models, so that's been categorized as high.

David Shanley23:06

When I expand the questionnaire review, I can see that AI has interpreted every response in the Excel sheet and given a recommendation. For example, is MFA supported? The vendor answered that they haven't been able to enforce it on all accounts, and I can see how that's categorized, the recommended action, and the risk level. That's done for every line item in the questionnaire.

David Shanley23:48

There's an integrated comments thread for the back and forth with the project manager. I need a pen test uploaded, so I add that to the conversation and notify specific people. I set the outcome to security control assessment rather than approve, which adds a third step because I need the pen test from the project manager.

David Shanley24:14

When I submit, it's picked up by the project manager on the third step, with the security analyst's instructions. All the documents are already there, so I add the pen test summary, confirm it in the assessment notes, and submit. It goes back to the security team.

David Shanley25:17

In the AI document review, we now have the pen test summary. It's extracted all the findings instantly, and any medium or high severity finding triggers a high risk flag, which supports fast, consistent risk triage. One item here is a cross-tenant authorization issue, and if I open the pen test and scroll down, you'll see where it was picked up, with the appropriate risk rating.

David Shanley25:57

In this case I'm happy to approve and accept a certain level of risk. There's an audit log in place, too, showing who did what and when. When I click submit, the process closes out, and an email can notify the project manager that the request has been successfully onboarded.

David Shanley26:29

Insights is our AI-driven BI tool, with built-in analytics, dashboards and an AI data assistant. You can instantly surface bottlenecks and delays and get accurate, real-time operational insight.

David Shanley27:03

Here's a sample set of charts. If I click the assessment status for security team review, it drills down to those four instances, and I can open each form. I can do the same for new in-house development applications. It's very useful for getting visibility of form content, and it's easy to apply service level agreements and spot completion bottlenecks.

David Shanley27:44

You can also have a tabular view with the FlowAssure audit log, the clarification thread and the assessment details for each form instance, and filter it, for example to completed assessments. These are clean, intuitive charts out of the box, easy to set up, and there's a whole suite of them. The results you can expect: a 91% reduction in manual effort, five times faster vendor approvals, and an 82% reduction in reporting.

Niamh Lordan28:42

Thanks, David, for that really detailed demo. We're nearly at the end, so if anyone needs support on this journey, David and our experts are available. We'd be happy to run a one-to-one consultation to discuss your needs, a customized demonstration, or a trial. Just let us know your preferred next step and our team will follow up.

Hannah Colley29:37

Now for our live Q&A. We have a couple of questions in already, and if we don't have time to answer yours today, we'll get back to you. First: can we customize our questionnaire templates?

Niamh Lordan30:12

Yes. Customization and flexibility are part of our mission. We never wanted organizations to have to change their processes to fit our platform, and the same is true of FlowAssure. You can use our templates, edit them, or start from scratch, and every question, the design and the look and feel can be customized.

David Shanley30:45

A lot of tools out there are inflexible when it comes to customization and need developer input or outsourced services. FlowForma is built from the ground up as a process automation tool for process owners to build with. It's 100% no-code, so you can change and refine your process using simple business logic in a single build interface.

Hannah Colley31:12

That relates to another question: can workflows be customized without coding? And as David said, no coding is needed. Next question: do you use our data to train your AI model?

Niamh Lordan31:33

It's a very popular question that vendors are being asked, and the answer is absolutely not. FlowForma uses Microsoft's secure OpenAI service and Google Gemini, and none of your data is used for training. We also offer bring your own AI model, so you can use your own OpenAI or Google Gemini with FlowAssure.

Hannah Colley32:06

Can your questionnaire agent work across reports generated by different pen test companies? This person says there could be 100 companies with different reports. Will the agent know what to do, or do we need an agent for each one?

David Shanley32:26

Our agents use context and prompt engineering, which generally brings through most of the information you need. If you need additional information, you can clone the original agent and add those instructions to it.

Hannah Colley32:44

How is audit history logged?

David Shanley32:52

We have a deep audit history. We sit on SharePoint, so it's all about compliance and auditing: you can see who did what in the process design at any point in time, and exactly what was done in each form instance.

Hannah Colley33:07

This will be our last question, as we're a little over time: how easy is it to onboard FlowAssure?

Niamh Lordan33:18

It's straightforward, and customers who've onboarded found it a seamless process. When you onboard with FlowAssure, your team gets two days of training and three days of onboarding support, and we have an academy of resources to support your team.

Hannah Colley33:46

That's our last question. If we didn't get to yours, we'll get back to you. You can choose a next step in the post-webinar survey: schedule a complimentary demo tailored to your processes, or book a consultation with one of our experts. Thank you so much for joining us, and thanks to Niamh and David for their expertise.