Yōjin AI Cybersecurity and Compliance Platform

Challenge pressure

Organisations and the managed service providers behind them have to meet NIS2, DORA, GDPR and the AI Act, but generic checklists ignore their size, budget and supply chain, and general language models do not know the frameworks well enough to advise on them.

The situation

Yōjin takes organisations from compliance to cyber resilience. It finds security gaps across a business and its third parties, assesses exposure against a threat-and-compliance knowledge base, and puts context-aware actions into daily workflows, matched to each organisation's size, budget, risk profile and regulatory duties. It serves enterprises and managed service providers, and today presents itself as an EU-sovereign GRC platform.

What we built

Mistral 7B was fine-tuned on 424k training samples with 106k held out for validation, in runs of about four hours. A Neo4j graph models threats, controls and compliance obligations, and ChromaDB backs retrieval over the knowledge base. LangGraph orchestrates each query across the fine-tuned model, the graph and the vector store, with OpenAI models alongside, on AWS.

What changed

Recommendations come from a model trained on security and compliance material and grounded in the organisation's own graph of controls and obligations, rather than from a general model or a static checklist.

Constraints and decisions

A fine-tuned 7B model instead of a large general one: a smaller model trained on the domain can be served where the customer's data has to stay, which a platform promising that its AI runs in Europe depends on. The graph keeps controls and obligations as explicit relationships, so every recommendation can name the obligation it serves.

Technology stack

Mistral 7BFine-tuningNeo4jChromaDBRAGLangGraphOpenAIAWS