How a Cybersecurity Platform Serving Fortune 500 Clients Cut Onboarding by 95% with an AI Agent Built by Startup House

Key facts at a glance

• Client: US-based cyber risk mitigation platform serving Fortune 500 customers (under NDA)
• Partnership: since July 2020, ongoing; the AI phase started in 2025
• What we built: Aria, an embedded AI agent living inside the client's product
• Onboarding time: cut by 95%, from 45 minutes of guided setup to under 2 minutes
• Usage pattern: the platform moved from a quarterly reporting tool to a daily decision-support system
• Self-service: 100% self-serve data exploration, without analyst support
• Architecture: LangGraph orchestration, Anthropic's Claude models, MCP integrations, OAuth 2.1, tenant isolation by design
• Shipped without touching the platform's core infrastructure, data model, or codebase

The starting point: a respected product that people barely used

This case study covers the second phase of our work with a US cybersecurity company we have partnered with since July 2020. In the first phase, Startup House took the product from prototype to a SaaS used by Fortune 500 companies, with 150% revenue growth in the first year and a 225% increase in B2B clients.

By 2025, the platform was mature and respected. It also had three problems that will sound familiar to anyone running a data-heavy product in a regulated category:

• Complexity at the surface. The platform handled rich cyber risk data, but interpreting it required expert-level knowledge.
• Low engagement frequency. Most users opened the tool once a quarter, to produce periodic reports.
• Heavy onboarding. New clients needed roughly 45 minutes of guided setup with active customer support before they could work on their own.

When ChatGPT-style interaction became a market expectation, the client's brief was direct: bring that interaction model into the cyber risk platform.

The hard part: one interface, three very different users

The same panel had to serve three personas at once. A board member needs a screenshot that explains itself, ready to drop into a quarterly report. A CFO needs the narrative behind the numbers. A CISO needs conversational depth to investigate the data and act on it.

Dropping a ChatGPT clone on top of the platform would have failed all three. So would a co-pilot sitting next to the product, because users would end up with two parallel interfaces.

The solution: Aria, an embedded AI with a four-layer interface

Aria is an embedded AI agent that lives inside the client's product, brand, and authentication boundary. Users never switch to a separate tool. We rebuilt the panel around one principle: simplicity at first, complexity on demand.

The interface is a ladder of four layers, with Aria present at every level:

• Layer 0, Executive: "What's happening?" The first view after login. Classic dashboard, key security status indicators, prerendered answers with no model call and no waiting. Designed for board members who need orientation in seconds.
• Layer 1, Financial: "Why is this happening?" The investigation layer for CFOs and finance leads. Contextual prompt pills suggest what to ask based on what the user is looking at, and open the embedded chat with Aria.
• Layer 2, Execution: "Do it for me." The action layer for CISOs and security operators. Buttons stop being passive ("View") and become commands ("Create", "Identify", "Prepare"). The product moves from showing risk to resolving it.
• Layer 3, Open Inquiry: "Whatever's on your mind." A free prompt field, always available, for users who know exactly what they want.

Users are introduced to working with an LLM gradually, with safety rails at each step. Nobody has to learn a new product to get AI capability. The AI meets users where they already work.

The architecture: built for enterprise from day one

Three architectural decisions matter for enterprise AI deployments, and Aria addresses all three.

Orchestration and reasoning. Aria runs on LangGraph, a stateful agent-orchestration framework supporting multi-agent composition, persistent multi-turn memory, and live tool-execution streaming. The reasoning layer uses Anthropic's Claude models. Model choice is configurable, not architectural, so the platform can switch providers without rewrites.

Tenant isolation by design. Every tool Aria uses is wired to the authenticated user, organization, and profile at the moment it is created. The model cannot pass, change, or even see that identity. Cross-tenant access is not a downstream filter that prompt injection could bypass. The agent simply cannot call tools outside its tenant boundary. On organization-wide chats, business unit names are pseudonymized before any message reaches the model.

Live integrations through MCP. Aria queries the customer's live security stack, starting with CrowdStrike Falcon and extending to any MCP-compliant tool, with OAuth 2.1 handling authentication. This shifts the product from a standalone analytics tool to an orchestration layer for the customer's entire security operation.

There is one more piece: admin-defined agents. The customer's administrators create new AI specialists directly from the application UI, with a name, a prompt, and a set of tools. New agents go live for the whole organization in minutes, without waiting for a release.

The results

• 95% reduction in client onboarding time, from 45 minutes to under 2 minutes.
• 100% self-serve data exploration. Users interpret their own risk data without analyst support.
• From quarterly to daily. The product moved from a quarterly reporting tool to a daily decision-support system.
• 3 distinct personas, one panel. Board members, finance leads, and CISOs each follow their own workflow path in the same interface.
• Zero changes to core infrastructure. The AI integration shipped without touching the platform's data model or codebase, and the security architecture (tenant isolation, encryption, access controls) required no new compliance scope.
• New agents and connectors ship in minutes, configured by the customer's admin team without engineering involvement.

The client's COO, Kyle Ferguson, summarizes the change:

"We spent five years building an analytics platform that our Fortune 500 customers respected but didn't use every day. The AI layer SH built changed that. Customers who used to open the platform once a quarter now run their decisions through it daily. The product is the same product underneath, but the way our customers experience it is completely different."

What this means if you run a data-heavy product

The pattern behind this project is common in accounting, banking, finance, compliance, and security: a product with rich data, expert-only interpretation, and low engagement. An embedded AI agent changes the economics of that product in three ways. Onboarding stops consuming customer success capacity. Users answer their own questions instead of filing support requests. And engagement moves from periodic reporting to daily decisions, which changes how customers value the product at renewal time.

None of this required rebuilding the platform. The AI layer sits on top of existing systems, which is why the whole integration shipped without touching the core codebase.

About Startup House

Startup House (SH) is a 50-person software development company based in Warsaw, Poland, established in 2016. We build AI products grounded in the client's own data, from generative AI prototypes to production AI agents, alongside full-cycle digital product development. We are ISO 27001 compliant, and client data is never used to train AI models.

Thinking about an AI layer for your product? Book a 30-min call.

FAQ

What is Aria?

Aria is an embedded AI agent that Startup House built inside a US cybersecurity platform serving Fortune 500 customers. It combines a four-layer interface with LangGraph orchestration and Anthropic's Claude models, and it connects to the customer's live security stack through MCP.

What results did the AI agent deliver?

Client onboarding time dropped by 95%, from 45 minutes to under 2 minutes. Data exploration became 100% self-serve, and the platform moved from quarterly reporting use to daily decision-support use.

Did the AI integration require rebuilding the platform?

No. The AI layer shipped without changes to the platform's core infrastructure, data model, or codebase. Tenant isolation, encryption, and access controls were all maintained without new compliance scope.

How does Aria prevent prompt injection and cross-tenant data leaks?

Every tool is bound to the authenticated user, organization, and profile at creation time, so the model cannot access anything outside its tenant boundary. This is an architectural guarantee, not a filter. Business unit names are also pseudonymized before messages reach the model.

Who is the client?

The client is a US-based cyber risk mitigation platform under NDA, serving Fortune 500 and private equity customers. Startup House has partnered with the company since July 2020.