Prototyping a software tool for the UK Government
Cyber degree assessors can spend days cross-referencing PDFs, Word documents and spreadsheets. I built and deployed a Python and FastAPI prototype that gives them a structured first pass, so they verify evidence instead of starting from scratch.
Role
Backend Engineer
Organisation
CSE Connect, delivering for the National Cyber Security Centre (part of GCHQ)
Industry
Cyber Security · GovTech · Education
Focus
Backend · AI · API
/ Problem
A certification application can contain up to twenty documents. Assessors move constantly between Word files, PDFs and spreadsheets, checking evidence, calculating credits and sometimes verifying material against CyBOK.
One application can take three or four days. Some assessors told us they worked on weekends simply to avoid distractions, while others kept separate Excel sheets or used extra monitors to track progress.
The bigger problem was discovering an issue late. An assessor could spend days reviewing an application, then find something that sends it back to the university for a twenty-day review period.
They wanted one place to track the assessment and a reliable first pass through the evidence before they began verifying it.
/ Solution
My first version sent an entire section and all its evidence to the LLM. It was slow, expensive and often vague.
I rebuilt the pipeline around individual criteria.
Fixed checks, yes or no questions and credit calculations run as deterministic Python logic. Only criteria requiring interpretation use the LLM, with retrieval supplying the specific evidence needed.
I also changed document extraction after Word templates began feeding instructional text into the model instead of the university’s answers.
Extracted evidence is cached in Redis and independent criteria run concurrently. Every path returns the same structured assessment format: Achieved, Not Achieved, Unclear or Not Applicable, with supporting feedback.
The complete application is deployed on Render, with files stored in S3.
/ What I learned
The biggest lesson was knowing when not to use AI.
Sending everything to a language model felt simpler at first, but ordinary code was faster, cheaper and more reliable whenever the answer followed a fixed rule.
The system improved when I stopped treating AI as the default and started treating it as one tool within the workflow.
If I rebuilt it, I would also move file uploads directly from the browser to S3 using presigned URLs rather than routing large files through the application server.