Case study · SprintoX · Sprinto 2025–26
Turning compliance from a checklist into a state
Sprinto's growth was capped by a human bottleneck: every small customer needed a technical account manager to walk them to audit readiness. SprintoX is the bet that the system can do that itself.
Results
What changed, labelled by how it was verified.
The real problem
Compliance onboarding was a services workflow wearing a product's clothes. Customers sat through several onboarding sessions led by a technical account manager. The product told them what to do, and people filled every gap in between.
That model doesn't scale to companies with under 100 people. It also can't win against twenty-year-old enterprise GRC platforms on flexibility. They will always have more settings than we do.
So the question changed. We stopped asking "which feature is missing?" and started asking, phase by phase across the journey: is this step necessary, does a person support it today, can it be self-serve, can it be autonomous?
Three decisions
Reframe the product from task-driven to state-driven
The easy path was to add AI features to the existing flows. I pushed for a different frame instead: the product should hold a living compliance state and act on it. The question a customer cares about isn't "what do I do next?" It's "how audit-ready am I right now, and what has the system already done about it?"
Trade-off: belief over completeness. We chose to ship one journey that feels autonomous rather than ten that feel assisted. That frame is now the narrative across product, GTM and R&D planning.
Score every phase of the journey on an autonomy ladder
"Add AI" is not a roadmap. I mapped the full customer journey into phases and scored each one on how much the system could be trusted to do alone. Each row below is a bet, sequenced so trust is earned before it's spent.
| Journey phase | Where it was | Where it's going |
|---|---|---|
| Gap analysis | A person decides which policies, risks and controls apply | The system decides from the org setup. Already autonomous |
| Integrations | An agent exists, but it's slow and user-driven | Discovers and runs integrations in the background |
| Setup: people, tech, process | People and tech solved; process still manual | The system decides the right setup for an SMB |
| Fixing external gaps | The fix-it agent needs help per monitor type | Fixes most external gaps without the user noticing |
| Fixing internal gaps | A TAM moves the customer to the main app | Tasks disappear; users see outcomes |
| Audit prep | TAM-heavy, chasing evidence after the fact | An audit agent reviews evidence before the audit |
| Auditor interaction | Manual responses, high coordination cost | The system handles most auditor queries |
Trade-off: autonomy over manual control, and opinionated flows over customisation. Some customers will want settings we deliberately left out.
Make AI quality something you can review
I built the pattern language for the journey: explanation layers, confidence signals, controls to steer the agent, a way to refine its output, and a plain-language audit trail of what it did. Then I mapped which patterns each module needs.
I also set the measurement frame, so "is the AI good?" became a question with numbers: how much output ships with a reason attached, how often people override it (a trust signal, not a failure), how accurate its predictions are, and how much time each workflow saves.
Trade-off: more design and instrumentation work up front, in exchange for being able to say when autonomy has been earned.
What changed
Setup dropped from 5–6 hours of account-manager time to 40 minutes, and every onboarding for companies under 25 people now runs through SprintoX. The pilot halved onboarding sessions.
What didn't work yet
Enterprise customers haven't adopted it the way smaller ones have. The reasons are accuracy and trust: larger companies have messier setups, and a system that's right most of the time isn't good enough when the stakes are an audit you can fail. That gap now shapes what we build next.
The hard part wasn't the AI. It was convincing an organisation to trade completeness for belief.