Case study · Software requests
Screening every software request the same way before IT opens it.
A financial services firm’s IT team asked staff to submit new software requests through a form. We built the workflow that researches each vendor, checks the approved catalog and attaches a written recommendation to the request. IT still decides.
A screened request
Example- Request
- Design collaboration tool, 12 users
- Catalog match
- No approved tool does this job
- Full vendor review
- Recommended: stores customer files, uses generative AI
- Legal and compliance
- Recommended: personal data involved
- Vendor found
- SOC 2 Type II, no public breach on record
The situation
Every request needed the same questions asked, and every vendor needed looking up.
Staff ask for new software through a form. It captures the business purpose, who will use the tool, what sensitive data it touches, what it connects to, and whether it uses generative AI.
Answering well meant the same work each time: checking whether the firm’s approved-software catalog already has a tool that does the job, researching the vendor, and deciding whether legal and compliance should look and whether the vendor needs a full security review or a lighter desk review.
The firm wanted that review consistent and written down for every request, whichever IT member picked it up. We built it on infrastructure we operate.
What we built
What we built, in order.
The firm’s request board stays the only system of record. A new request starts the workflow, and everything it produces is written back onto that request.
Intake · Rules in code
Staff submit a request. They and IT get a confirmation.
Catalog check · AI step
Is this tool, or one that does the same job, already approved?
Vendor research · AI step
Certifications, past breaches, complaints and a light external check.
Recommendation · AI step
Two flags with reasoning: legal review and full vendor review.
Decision · Person
IT approves, sends it back or asks for a re-screen.
What changed
Every request now arrives with a written review attached.
Each request carries the vendor overview, certifications, security summary, catalog match and the reasoning for both flags. We have no before-and-after figures to publish, and no fixed turnaround: a request needing legal or full vendor review takes longer than a straight catalog match.
- Requesters
- Get a confirmation straight away, an email at each stage change and a weekly digest of anything still open.
- IT team
- Start from a researched recommendation instead of a blank request, and spend their time on the requests that raise a flag.
- Vectra View
- Monitors failures, makes changes when IT asks and emails IT a monthly summary of request volume and screening activity.
Have a process like this?
Tell us which review or routing step your team repeats and we will tell you whether it is a good fit.