A CyberJuice × 55x × uQualio case study

"It's good to be able to squeeze your cybersecurity in instead of making it a massive project — something that follows you and you're aware of, instead of something that's all over the place." — Christian, uQualio

Small software companies increasingly need ISO 27001 certification to win customers — but few have the in-house security expertise to get there alone. They lean on a platform, templates, and a coach. The bottleneck is almost always the same: there's never enough expert time to go around, and compliance work gets pushed to "whenever there's a free hour."

That's the problem CyberJuice set out to test with Squeezy, a proactive AI support agent prototyped together with AI implementation partner 55x, with uQualio — a software SME preparing for ISO 27001 certification — as the pilot customer.

What we built

Over the course of the project, the team prototyped three agentic flows on n8n: a Meeting Prep briefing, a Module Form intake, and an Audit Prep flow. Each pulled context from the CyberJuice platform and customer documents, drafted summaries or emails, and routed everything through a CyberJuice expert before it ever reached a customer — AI drafts, human sends.

Of the three, one earned its keep clearly.

The flow that won: doing nothing was the feature

Meeting Prep sends a coach a short briefing ahead of every customer session — outstanding tasks, recent activity, a suggested agenda — built automatically from where the customer's account already stands. It asks the customer for nothing.

That's exactly why it worked. Before Squeezy, a coach either logged in and pieced together a customer's status before a meeting, or showed up without that context and spent the meeting itself finding out where things stood — which felt unprofessional. Meeting Prep removed that gap without adding any homework for the customer.

"It does give you a good summary of what you do — especially after you added links back to where I could quickly do it." — Christian, uQualio

The response from the coach side has been just as clear. One of CyberJuice's compliance coaches, testing Squeezy for the first time, put it simply: "I have received an email from Squeezy and it is pretty impressive." She wants to use it in her work — which is the kind of signal that matters more than any benchmark.

The form-based flows: right output, wrong mechanism

The other two flows — Module Form and Audit Prep — asked the customer to fill in structured input first. That input genuinely improved the output: when Squeezy had Christian's own audit-form answers to work from, its emails read as specific and actionable rather than generic.

"It pulled in some of the statuses from our installation… it was closer to something that was actionable." — Christian, uQualio

But there's an important nuance here worth being honest about: Christian is not a typical test case. He's an experienced compliance user, comfortable filling in forms — and he was the only customer who actually completed one. As a coach himself, his own read was blunt: he'd never ask his customers to fill in forms. Several of CyberJuice's more recent customers are doing compliance for the first time, and for them, another form is pure burden, not a feature.

The fix isn't to drop the form-based flows — the intelligence they produced had real value. It's to change where the input comes from. The direction the team has landed on: shift that input to the coach side, either through a lightweight post-session form or by having AI extract the same context directly from a meeting transcript. The coach stays responsible for holding the structure — which is what CyberJuice actually sells — and Squeezy becomes a copilot to the coach, not a replacement for the coach.

The honest lesson: design around how coaches actually work

Maybe the most candid finding from the pilot wasn't about the AI at all. The original form-based design was modeled closely on how CyberJuice's founder runs onboarding — structured and modular. The coaches now running customer relationships work more fluidly than that, and a rigid form sequence didn't fit how they actually prepare.

The takeaway: the coaches' way of working should shape the design, not the other way around. That's now baked into how the next iteration gets built.

The value proposition, in the customer's own words

If there's one idea this pilot validated, it's that for a small team without a dedicated compliance person, the win isn't a slicker dashboard — it's turning ISO 27001 maintenance into small, bounded tasks that fit into the gaps of a busy day.

"Squeezing in your cybersecurity tasks in a tight schedule." — Christian, uQualio

"Doing it when you need it, instead of when the coach is available." — Hatla, uQualio

The flow that watched and summarized beat the flow that asked the customer to type things in. Squeezy didn't need customers to report on themselves — it just needed to look at what they'd already done, and that was enough.

What's next

This was the final milestone of the project, and there's no follow-on funding locked in yet — but the direction is clear. CyberJuice is moving Squeezy from a prototype built on n8n to something it owns and runs natively in its own platform, where customer data is already at hand instead of being reconstructed from the outside. Meeting Prep carries forward as the production-worthy flow; the module flow is being reshaped into a coach-facing tool.

A few concrete requests from the pilot are already on the list for the next build:

• Email-to-Squeezy — coaches can write a question about any customer directly to Squeezy and get an answer back. Rather than logging in and piecing together context, a coach can ask "where does this customer stand on access control?" and get a direct, account-specific reply. This builds on the calendar-invite integration already in place and turns Squeezy into a genuine on-demand copilot for the coach.

• Context-aware, proactive triggers — noticing an onboarding/offboarding event in a customer's own ticketing tool and nudging the related ISO 27001 tasks automatically.

• Time estimates on tasks — knowing whether something is a 2-minute or 30-minute job, so it's easier to decide when to tackle it.

• Module content inside the platform — rather than living off to the side.

• The ability to save partial progress — because real work gets interrupted.

The takeaway

Squeezy is, at its core, AI working as operational glue — pulling the right context from where it already lives, and proactively keeping the right people on the same page before they even talk. That kind of internal tooling would have been too expensive to build a few years ago. It's cheap enough now to be worth doing — and that holds well beyond ISO 27001 coaching.

Squeezy is a joint pilot between CyberJuice (ISO 27001 platform & domain expertise), 55x (AI agent implementation, led by Steffen Bilde), and uQualio (pilot customer).