Case study

Peregrine went from 25% to 80% questionnaire answer coverage with Wolfia

Peregrine x Wolfia
DescriptionData analytics and decision support for public safety
HeadquartersSan Francisco, CA
Founded2017
From 25% to 80% answer coverage on the first questionnaire. Today Wolfia answers 90% of questions, Peregrine keeps 87% of those answers without editing, and any employee gets a security answer in Slack in under 1 minute.

Peregrine answers security questionnaires from public safety agencies. For a long time, one person answered all of them. Eric Wood runs GRC and security at Peregrine. Most of the questions asked for something the company had already written down somewhere, so he thought AI should be able to help. As demand grew he started testing tools that could put that material to work.

Results

  • 25% to 80%: Answer coverage on the first questionnaire, compared with the two AI tools Peregrine had tried previously.
  • 90%: Answer coverage at production volume, the share of questions Wolfia returns an answer for.
  • 87%: Acceptance rate, the share of those answers Peregrine’s team keeps without editing.
  • Under 1 minute: Time for any employee to get a security answer in Slack.
  • Human review and approval: Peregrine’s GRC team reviews and approves every questionnaire response before it is sent to a customer.

Company background

  • Company size: 450 employees
  • Products used: Questionnaire Agent, Slack Agent, Knowledge Base Agent
  • GRC team: 1 person at the start

One person answered every questionnaire

Eric was the whole GRC team when he started, so every security questionnaire that came in was his to answer. A typical one had 90 to 120 questions and took hours to complete. By his estimate, nine out of ten asked for information he had already supplied on a previous questionnaire. As the backlog built up, customers sometimes waited weeks for a response, which held up deals already in progress.

Meanwhile that procurement had stopped progressing, because the customer needed their security team to give the thumbs up to move forward with procurement. So it was really impacting our deal velocity by being able to close deals within the planned business cycles.

Peregrine builds data analytics and decision support systems for high-criticality organizations, including law enforcement and the wider public safety sector. Eric explained why delays are expensive in that market. Attention and budgets there are scarce and fleeting, so keeping momentum with a customer is often what gets a shared goal delivered on schedule. A delay of a week or two makes it harder to re-engage the customer, who then has to get back onto the agenda of the council or committee that reviews and approves the contract.

Not all of the questions came in spreadsheets. A forward-deployed engineer might be sitting with a customer to connect a data source when the customer asks how that connection protects their data. The person in the room does not work on that part of the system, so they contact the product engineer who does. That engineer is usually writing code or in another meeting. “You end up waiting for that response to come back to get that customer comfortable with moving forward,” Eric says, “and you missed the opportunity in that hour scheduled meeting you had with them.”

Two earlier tools answered about a quarter

Before Wolfia, Peregrine tried two other AI questionnaire tools. Eric loaded both with the same knowledge and ran real questionnaires through them.

I would say 25% of the questions they’d be able to generate answers for. It was pretty bad. Or they would generate answers like, that wasn’t what the question was asking. They should not have released that, in my opinion. It was that bad.

At that level of coverage he was still writing most of each questionnaire himself, while the answers the tools did produce had to be read closely and often rewritten. Some documents also had to be reformatted before the tools could use them. As he put it, “It was more efficient to just not use a tool and keep doing it manually. And that’s a big miss if you’re using AI.”

So when a colleague pointed him toward Wolfia, he was not expecting much. “I was skeptical, I have to tell you. I was skeptical going into it. Like, fine, I’ll do it.”

He loaded 25 to 30 documents into Wolfia and submitted a recent questionnaire.

Portrait of Eric Wood
I would say 80-plus percent of the questions had answers, and they were on point. They were relevant to what the question was being asked. They pulled in relevant artifacts or knowledge from what I had fed it. Does that mean it was perfect out of the gate? No. But it was markedly better than what I’d seen to date.

Eric Wood, Information Security & Compliance Manager, Peregrine

With more than 80% of the questions answered, the work became reviewing answers rather than writing them. Eric still read every response carefully, and the corrections he made were reused on later questionnaires. “My previous responses became the new facts.”

Getting the answers to sound right

Relevant answers were the first requirement. Eric also wanted them to read like something Peregrine would send, since they go to security teams at law enforcement agencies. He spent time editing the tone and response style. “In the early days I was also caring deeply about the tone, the response style, to make sure that my voice was carrying through in that response.”

He brought Naren detailed feedback on the answers and on how his team worked, which they used to change the product. “I was getting same-day responses, often within an hour frankly, or less. That rapid iteration on feedback is what I feed off of.”

Eric said he was editing less over time as Wolfia incorporated his previous responses.

What Wolfia should not answer

Peregrine serves multiple public safety agencies, so information that belongs in an answer for one agency should not appear in an answer for another. Filtering the knowledge mattered as much as retrieving it.

Naren described the work behind that: curating the knowledge base to separate common information from account-specific detail, and excluding sensitive or irrelevant material from the context used to generate an answer. The knowledge base holds Peregrine’s own security documentation and its approved questionnaire responses. Peregrine decides what is shareable with which customer.

Eric later built an internal AI agent of his own, called Swoop, which he connected to Wolfia over MCP. His GRC team asks Swoop questions through Slack, and Swoop calls Wolfia to retrieve the knowledge. He kept the agent he had built and used Wolfia for the curated security knowledge behind it. Asked what would happen without Wolfia, he said that having the same documents available to his own agent would still leave a gap in answer quality and efficiency.

Opening it up to the rest of Peregrine

Eric also saw that colleagues in customer meetings were interrupting product engineers for security answers that already existed. He brought that to Naren as the next thing to solve.

They were reaching out to those and pulling them off product development features, right, to answer frequently asked questions. Such a value disparity there that it made sense to solve it.

Peregrine had 450 employees at the time of the interview and, by Eric’s estimate, 30 to 40 subject matter experts. Today a colleague gets an answer in Slack in under a minute, while the customer is still in the meeting, without taking a product engineer off their work.

Running the questions through one system also let him see them. “Now we have a lot more visibility to these questions that we didn’t even have before,” he says, “because you would have to be party to that two-person exchange to know where were these happening.” The questions Wolfia could not answer showed him what the knowledge base was missing.

Preparing to double the customer base

At the time of the interview, Peregrine expected its customer base to keep growing. Eric said that keeping up manually would have required more GRC headcount.

Do we bring in, you know, $130-150K GRC professionals, or do we acquire a tool that uses AI that’s purpose-built for this task? It’s kind of an easy math at that point.

The GRC team still reviews and approves every response before it goes to a customer. They now do that against accurate answers drawn from material the company has already reviewed.

Portrait of Eric Wood
I don’t look at Wolfia as a security questionnaire company. I look at it as a knowledge company that facilitates security and compliance knowledge when and where you need it.

Eric Wood, Information Security & Compliance Manager, Peregrine

Get started

Ready to automate?

Upload your documentation. AI does the work.
Respond 10x faster with unlimited seats and outcome-based pricing.

Get a demo