IP Library › Granted Patent US 12,694,128
Granted Patent B1
US 12,694,128 · App. 19/370,573 · Granted Jul 28, 2026

Cybersecurity compliance assessment

Inventors: Guy-Hubert Bourgeois (Saint Marc Jaumegarde, FR); Billal Chouli (Enghien les Bains, FR)
Assignee: HEADMIND PARTNERS AI
G06F21/577G06F2221/034H04L41/16H04L63/1416H04L63/1425H04L63/1433
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,694,128
App. No.
19/370,573
Granted
Jul 28, 2026
Kind
B1
Abstract

The disclosure notably relates to a computer-implemented method for cybersecurity compliance assessment. The method comprises obtaining one or more documents containing a description of an IT infrastructure, or of an organization or project relying on an IT infrastructure and a plurality of requirements, including a set of cybersecurity requirements. The method further comprises selecting, for each requirement, one or more respective chunks each of a respective document. The method further comprises assessing, for each requirement, a level of compliance of the description with the requirement, the assessing being based on the requirement and on the selected one or more respective chunks. The assessing is performed by an assessing module comprising a plurality of LLMs configured to cooperate for computing the level of compliance. The method further comprises generating digital data that represents a result of the assessment. Such a method improves cybersecurity compliance assessment.

Claims (69)

1 . A computer-implemented method for cybersecurity compliance assessment, the method comprising:

obtaining one or more documents containing a description of an (Information Technology (IT) infrastructure, or of an organization or project relying on an IT infrastructure;

obtaining a plurality of requirements, including a set of cybersecurity requirements, each requirement including a text, the text of each obtained requirement containing one or more sentences;

determining, for each document of the obtained one or more documents, one or more respective document vectors, each respective document vector being a numerical vector representing a chunk of the document, thereby obtaining a plurality of document vectors each representing a respective chunk of a respective document, the determining of each respective document vector comprising:

determining a respective text representation of the respective chunk, the respective text representation of each chunk containing one or more sentences; and

vectorizing the respective text representation of the respective chunk, the vectorizing comprising providing as input the respective text representation of the respective chunk to an embedding module, thereby obtaining as output the respective document vector, wherein the embedding module comprises a first embedding sub-module and a second embedding sub-module, and the embedding module is configured for taking a respective text containing one or more respective sentences as input and for:

by the first embedding sub-module, taking as input each sentence of the one or more respective sentences and determining an embedding vector representing the sentence, thereby obtaining a set of one or more embedding vectors, and

by the second embedding sub-module, taking as input the set of one or more embedding vectors and combining the set of one or more embedding vectors into a single vector representing the respective text provided as input to the embedding module;

determining, for each requirement of the obtained plurality of requirements, a respective requirement vector, the respective requirement vector being a numerical vector representing the text of the requirement, the determining of the respective requirement vector comprising providing as input the text of the requirement to the embedding module, thereby obtaining as output the respective requirement vector;

selecting, for each requirement, one or more respective chunks each of a respective document, the selecting being based on a relevance of the document vectors with respect to the respective requirement vector;

assessing, for each requirement of the obtained plurality of requirements, a level of compliance of the description with the requirement, the assessing being based on the requirement and on the selected one or more respective chunks, the assessing being performed by an assessing module, the assessing module comprising a plurality of Large Language Models (LLMs) configured to cooperate for computing the level of compliance; and

generating digital data that represents a result of the assessment.

2 . The method of claim 1 , wherein at least one chunk of at least one document contains at least one piece of non-textual data, and determining a respective text representation of the respective chunk comprises converting each piece of non-textual data of each chunk into a piece of textual data and including the piece of textual data in the respective text representation of the respective chunk, the converting comprising providing as input each piece of non-textual data to a converting module including a respective LLM.

3 . The method of claim 1 , wherein the first embedding sub-module comprises a trained embedding model with a transformer-based architecture, the trained embedding model having been trained on a training dataset comprising entries, each entry comprising a cybersecurity text.

4 . The method of claim 1 , wherein the selecting of the one or more respective chunks comprises, for each requirement:

computing a similarity score between each document vector and the respective requirement vector;

identifying a number of document vectors having a smallest distance with the respective requirement vector; and

determining among the chunks corresponding to the identified number of document vectors the one or more respective chunks having a highest relevance with respect to the requirement.

5 . The method of claim 4 , wherein the determining among the chunks corresponding to the identified number of document vectors the one or more respective chunks is performed with a respective LLM, the respective LLM having been fine-tuned using cybersecurity text.

6 . The method of claim 1 , wherein the assessing module is configured for performing one or more executions of a block including:

a first LLM which provides as output a respective level of compliance among a set of values including “fully compliant”, “partially compliant”, and “non-compliant”, and

a second LLM configured to be executed when, and only when, the first LLM provides as output “partially compliant”, the second LLM being configured to refine the respective level of compliance;

the level of compliance of the description with the requirement provided by the assessing module being based on the respective level of compliance outputted by each execution of the block.

7 . The method of claim 6 , wherein:

the assessing module is configured for further executing, after each respective execution of the block a third LLM, the third LLM being configured for taking as input the requirement, the selected one or more respective chunks, and the respective level of compliance outputted by the respective execution of the block, and providing as output a respective score of confidence indicating an exactness of the respective level of compliance outputted by the respective execution of the block;

the assessing module is configured for sequentially iterating executions of the block and of the third LLM until the respective score of confidence is higher than a predetermined threshold; and

the level of compliance of the description with the requirement provided by the assessing module is based on the respective level of compliance outputted by a last execution of the block.

8 . The method of claim 6 , wherein:

the assessing module is configured for performing several executions of the block independently and in parallel; and

the level of compliance of the description with the requirement provided by the assessing module is a most common level of compliance among the respective level of compliance outputted by each execution of the block.

9 . The method of claim 1 , wherein the digital data comprises a document data file.

10 . The method of claim 1 , wherein the method further comprises establishing a justification of the result of the assessment with a respective LLM.

11 . The method of claim 1 , wherein the digital data comprises, for at least one requirement, an instruction to increase the level of compliance.

12 . The method of claim 11 , wherein the method comprises establishing the instruction to increase the level of compliance with a respective LLM.

13 . The method of claim 1 , wherein the IT infrastructure is a real-world IT infrastructure, and the digital data comprise, for at least one requirement, configuration data to be deployed in the IT infrastructure to increase the level of compliance.

14 . The method of claim 1 , wherein the digital data comprises a graphical representation of the result, the method further comprises displaying the graphical representation on a display.

15 . The method of claim 1 , wherein the method further comprises creating a data management component comprising at least:

a requirement dataset comprising entries, each entry being indexed by a requirement, and comprising the text of the requirement;

a description dataset comprising entries, each entry being indexed by a chunk of one of the documents, and comprising the determined text representation of the chunk; and

a vector dataset comprising requirement entries and description entries, each requirement entry comprising:

a pointer to an entry of the requirement dataset; and

a respective requirement vector having been determined from the requirement indexing the pointed entry;

each description entry comprising:

a pointer to an entry of the description dataset; and

a respective description vector having been determined from the description indexing the pointed entry.

16 . A non-transitory computer readable medium having recorded thereon instructions configured for, when executed by one or more processors, causing performance of a method for cybersecurity compliance assessment, the method comprising:

obtaining one or more documents containing a description of an Information Technology (IT) infrastructure, or of an organization or project relying on an IT infrastructure;

obtaining a plurality of requirements, including a set of cybersecurity requirements, each requirement including a text, the text of each obtained requirement containing one or more sentences;

determining, for each document of the obtained one or more documents, one or more respective document vectors, each respective document vector being a numerical vector representing a chunk of the document, thereby obtaining a plurality of document vectors each representing a respective chunk of a respective document, the determining of each respective document vector comprising:

determining a respective text representation of the respective chunk, the respective text representation of each chunk containing one or more sentences; and

vectorizing the respective text representation of the respective chunk, the vectorizing comprising providing as input the respective text representation of the respective chunk to an embedding module, thereby obtaining as output the respective document vector, wherein the embedding module comprises a first embedding sub-module and a second embedding sub-module, and the embedding module is configured for taking a respective text containing one or more respective sentences as input and for:

by the first embedding sub-module, taking as input each sentence of the one or more respective sentences and determining an embedding vector representing the sentence, thereby obtaining a set of one or more embedding vectors, and

by the second embedding sub-module, taking as input the set of one or more embedding vectors and combining the set of one or more embedding vectors into a single vector representing the respective text provided as input to the embedding module;

determining, for each requirement of the obtained plurality of requirements, a respective requirement vector, the respective requirement vector being a numerical vector representing the text of the requirement, the determining of the respective requirement vector comprising providing as input the text of the requirement to the embedding module, thereby obtaining as output the respective requirement vector;

selecting, for each requirement, one or more respective chunks each of a respective document, the selecting being based on a relevance of the document vectors with respect to the respective requirement vector;

assessing, for each requirement of the obtained plurality of requirements, a level of compliance of the description with the requirement, the assessing being based on the requirement and on the selected one or more respective chunks, the assessing being performed by an assessing module, the assessing module comprising a plurality of Large Language Models (LLMs) configured to cooperate for computing the level of compliance; and

generating digital data that represents a result of the assessment.

17 . A computer system comprising one or more processors coupled to memory, the memory having recorded thereon instructions configured for, when executed by one or more processors, causing performance of a method for cybersecurity compliance assessment, the method comprising:

obtaining one or more documents containing a description of an Information Technology (IT) infrastructure, or of an organization or project relying on an IT infrastructure;

obtaining a plurality of requirements, including a set of cybersecurity requirements, each requirement including a text, the text of each obtained requirement containing one or more sentences;

determining, for each document of the obtained one or more documents, one or more respective document vectors, each respective document vector being a numerical vector representing a chunk of the document, thereby obtaining a plurality of document vectors each representing a respective chunk of a respective document, the determining of each respective document vector comprising:

determining a respective text representation of the respective chunk, the respective text representation of each chunk containing one or more sentences; and

vectorizing the respective text representation of the respective chunk, the vectorizing comprising providing as input the respective text representation of the respective chunk to an embedding module, thereby obtaining as output the respective document vector, wherein the embedding module comprises a first embedding sub-module and a second embedding sub-module, and the embedding module is configured for taking a respective text containing one or more respective sentences as input and for:

by the first embedding sub-module, taking as input each sentence of the one or more respective sentences and determining an embedding vector representing the sentence, thereby obtaining a set of one or more embedding vectors, and

by the second embedding sub-module, taking as input the set of one or more embedding vectors and combining the set of one or more embedding vectors into a single vector representing the respective text provided as input to the embedding module;

determining, for each requirement of the obtained plurality of requirements, a respective requirement vector, the respective requirement vector being a numerical vector representing the text of the requirement, the determining of the respective requirement vector comprising providing as input the text of the requirement to the embedding module, thereby obtaining as output the respective requirement vector;

selecting, for each requirement, one or more respective chunks each of a respective document, the selecting being based on a relevance of the document vectors with respect to the respective requirement vector;

assessing, for each requirement of the obtained plurality of requirements, a level of compliance of the description with the requirement, the assessing being based on the requirement and on the selected one or more respective chunks, the assessing being performed by an assessing module, the assessing module comprising a plurality of Large Language Models (LLMs) configured to cooperate for computing the level of compliance; and

generating digital data that represents a result of the assessment.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 5, 2026
From: BOURGEOIS, GUY-HUBERT; CHOULI, BILLAL
To: HEADMIND PARTNERS AI
Reel/Frame 073358/0408 →
References Cited (38)
US 11321538B1 · Fontecilla · 2022 [cited by examiner]
US 12505095B1 · Rozen · 2025 [cited by examiner]
US 20170063912A1 · Muddu · 2017 [cited by examiner]
US 20240422187A1 · Shah · 2024 [cited by examiner]
US 20250348664A1 · Dhindsa · 2025 [cited by examiner]
WO WO2025101512A1 · 2025 [cited by examiner]
“Rethinking Legal Compliance Automation: Opportunities with Large Language Models”—Hassani et al., University of Ottowa, Apr. 22, 2024 https://arxiv.org/pdf/2404.14356 (Year: 2024). [cited by examiner]
“Securing Large Language Models: Threats, Vulnerabilities, and Responsible Practices”—Abdali et al., Microsoft & University of California, Riverside, Jun. 11, 2025 https://www.microsoft.com/en-us/research/wp-content/upl… [cited by examiner]
“Open-Orca/OpenOrca Datasets at Hugging Face.”, Available online at <https://huggingface.co/datasets/Open-Orca/OpenOrca>, retrieved on Nov. 20, 2025, 11 pages. [cited by applicant]
Dettmers, T., et al., “Qlora: Efficient Finetuning of Quantized LLMs.”, Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 10088-10115. [cited by applicant]
Du, M., et al., “DeepResearch Bench: A Comprehensive Benchmark for Deep Research Agents.”, arXiv preprint arXiv:2506.11763, Jun. 16, 2025, 31 pages. [cited by applicant]
Erhan, D., et al., “Why Does Unsupervised Pre-Training help Deep Learning?. ”, Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics, 2010, pp. 201-208. [cited by applicant]
Guo, Y., et al., “Efficient Continual Pre-Training by Mitigating the Stability Gap.”, arXiv preprint arXiv:2406. 14833, Jun. 27, 2024, 28 pages. [cited by applicant]
Hoffmann, J., et al., “Training Compute-Optimal Large Language Models.”, arXiv preprint arXiv:2203.15556, Mar. 29, 2022, 36 pages. [cited by applicant]
Hu, E. J., et al., “Lora: Low-Rank Adaptation of Large Language Models.”, ICLR, vol. 1, No. 2, Oct. 16, 2021, 26 pages. [cited by applicant]
Ke, Z., et al., “Continual Pre-Training of Language Models.”, arXiv preprint arXiv:2302.03241, Apr. 12, 2023, 16 pages. [cited by applicant]
Liu, H., et al., “Few-shot Parameter-Efficient Fine-Tuning is Better and Cheaper than In-Context Learning.”, Advances in Neural Information Processing Systems, vol. 35, Aug. 26, 2022, pp. 1950-1965. [cited by applicant]
Matena, M. S., et al., “Merging models with Fisher-Weighted Averaging”, Advances in Neural Information Processing Systems, vol. 35, Aug. 26, 2022, pp. 17703-17716. [cited by applicant]
Mohtashami, A., et al., “Cotformer: A Chain-of-Tthought Driven Architecture with Budget-Adaptive Computation Cost at Inference.”, arXiv preprint arXiv:2310.10845, Aug. 14, 2024, 14 pages. [cited by applicant]
Mukherjee, S., et al., “Orca: Progressive Learning from Complex Explanation Traces of GPT-4.”, arXiv preprint arXiv:2306.02707, Jun. 5, 2023, 51 pages. [cited by applicant]
Muralidharan, S., et al., “Compact Language Models via Pruning and Knowledge Distillation.”, Advances in Neural Information Processing Systems, vol. 37, Nov. 4, 2024, pp. 41076-41102. [cited by applicant]
Parmar, J., et al., “Reuse, Don't Retrain: A Recipe for Continued Pretraining of Language Models.”, arXiv preprint arXiv:2407.07263, Jul. 9, 2024, 15 pages. [cited by applicant]
Rafailov, R., et al., “Direct Preference Optimization: Your Language Model is Secretly a Reward Model.”, Advances in Neural Information Processing Systems, vol. 36, Jul. 29, 2024, 27 pages. [cited by applicant]
Schulman, J., et al., “Proximal policy optimization algorithms.”, arXiv preprint, arXiv:1707.06347, Aug. 28, 2017, pp. 1-12. [cited by applicant]
Shao, Z., et al., “Deepseekmath: Pushing the Limits of Mathematical Reasoning in Open Language Models.”, arXiv preprint arXiv:2402.03300, Apr. 27, 2024, 30 pages. [cited by applicant]
Singh, S. P., et al., Model Fusion via Optimal Transport., Advances in Neural Information Processing Systems, vol. 33, May 16, 2023, 36 pages. [cited by applicant]
Sreenivas, S. T., et al., “LLM Pruning and Distillation in Practice: The Minitron Approach.”, arXiv preprint arXiv:2408.11796, Dec. 9, 2024, 11 pages. [cited by applicant]
Su, J., et al., “Roformer: Enhanced transformer with rotary position embedding.”, Neurocomputing, vol. 568, Nov. 8, 2023, pp. 1-14. [cited by applicant]
Sun, K., et al., “Amuro & char: Analyzing the relationship between pre-training and fine-tuning of large language models.”, Proceedings of the 10th Workshop on Representation Learning for NLP, May 4, 2025, pp. 131-151. [cited by applicant]
Tirumala, K., et al., D4 Improving LLM pretraining via document de-duplication and diversification., Advances in Neural Information Processing Systems, vol. 36, 2023, 13 pages. [cited by applicant]
Vm, K., et al., “Fine Tuning LLM for enterprise: Practical Guidelines and Recommendations.”, arXiv preprint arXiv:2404.10779, Mar. 23, 2024, 17 pages. [cited by applicant]
Wang, Y., et al., “Self-instruct: Aligning Language Models with Self-Generated Instructions.”, Proceedings of the 61st annual meeting of the association for computational linguistics, vol. 1: long papers, May 25, 2023, … [cited by applicant]
Xia, Y., et al., “Understanding the Performance and Estimating the Cost of LLM Fine-Tuning.”, IEEE International Symposium on Workload Characterization, Aug. 8, 2024, 14 pages. [cited by applicant]
Xu, C., et al., “WizardLM: Empowering Large Pre-Trained Language Models to Follow Complex Instructions.”, The Twelfth International Conference on Learning Representations, May 27, 2025, 22 pages. [cited by applicant]
Yadav, P., et al., “Ties-merging: Resolving Interference when Merging Models.”, Advances in Neural Information Processing Systems, vol. 36, Oct. 27, 2023, 23 pages. [cited by applicant]
Yu, L., et al., “Language Models are Super Mario: Absorbing Abilities from Homologous Models as a Free Lunch.”, Forty-first International Conference on Machine Learning, Jun. 13, 2024, 21 pages. [cited by applicant]
Zhang, B., et al., “When Scaling Meets LLM Finetuning: The Effect of Data, Model and Finetuning Method.”, arXiv preprint arXiv:2402.17193, Feb. 27, 2024, 20 pages. [cited by applicant]
Zhu, Q., et al., “When does Further Pre-Training LLM help? An Empirical Study on Task-Oriented Dialog Pre-Rraining.”, Proceedings of the Second Workshop on Insights from Negative Results in NLP, 2021, pp. 54-61. [cited by applicant]