---
title: "Cedars Case Study"
canonical: https://wavect.io/case-studies/cedars/
language: en
description: "Cedars software assessment: architecture and requirements documentation, QA, targeted code review and responsible-AI evaluation with prioritized follow-up."
image: "https://wavect.io/img/general/bak/open_graph_preview.jpg"
---

![Cedars International logo](/img/case-studies/logos/cedars.webp)

CASE STUDIES · 2026

Cedars

# Architecture, requirements and code review in one evidence trail.

A documentation foundation and a technical assessment for Cedars’ cybersecurity software.

[“They were consistently able to provide me with advanced expert-level responses.” Anonymous, Executive, Cedars International Clutch](https://clutch.co/go-to-review/f2290100-9e13-4140-a1b0-0ee301a5fd39/490912)

ENTERPRISE QA and technical assessment 2026 Live

At a glance

Engagement QA and technical assessment

Industry Cybersecurity / software assurance

Year 2026

Status Live

Stack

PHP JavaScript Python FastAPI scikit-learn MySQL

Client website [ccdsglobal.com](https://ccdsglobal.com/)

## Overview

The Cedars engagement had two phases: documentation and QA, followed by technical assessment. Wavect organized architecture, requirements and governance records, then used targeted source review and controlled checks to prepare prioritized follow-up.

The reviewed environment included a PHP and JavaScript application, Python components using FastAPI and scikit-learn, and MySQL/MariaDB access.

## What's the challenge?

Architecture descriptions, requirements, asset records and operating responsibilities answer different questions. To support a product decision, they need consistent definitions and a traceable relationship to the available software evidence.

AI introduces another layer: an application test can establish behavior under specified conditions, while model-quality evaluation needs representative tasks and criteria. Reviewers must keep these forms of evidence distinct and make the scope of each conclusion explicit.

## What call did we make?

### Give a review observation somewhere to go.

> A useful finding needs a next step. We linked the documentation and software evidence to priorities, proposed actions and recheck criteria, giving the team a route from assessment to follow-up.

## What We Did

We began with documentation structures and drafting guidance: architecture, requirements, technical assets and access, roles, and third-party governance. Cedars supplied the product-specific information. We supported successive reviews and cross-references so the documents could be used together, including the link from a requirement to its verification.

The later assessment examined selected source paths, repository tests and isolated checks using synthetic inputs. For the AI review, we organized the evidence around intended use, information handling, human oversight and evaluation criteria. Each check had a defined scope.

The reporting paired observations with priorities, proposed actions and recheck criteria. That combined [software QA](/services/software-quality-assurance/) with [technical discovery](/services/software-discovery/), giving the team concrete work to take forward from the assessment.

## Outcomes

### Evidence trail - Architecture, requirements, assets and responsibilities organized for review.
- **Category:** Business

### Targeted checks - Source review and controlled tests informed priorities for follow-up.
- **Category:** Risk

### Recheck criteria - Assessment reporting paired proposed actions with subsequent verification.
- **Category:** Signal

Want outcomes like these on your build?

Fixed scope. Fixed deadline. Signed SoW.

[Get in touch](/contact/)

## Client Voice

[Clutch · Verified](https://clutch.co/go-to-review/f2290100-9e13-4140-a1b0-0ee301a5fd39/490912)

> **They were consistently able to provide me with advanced expert-level responses.**

Anonymous, Executive, Cedars International

Want to have the same impact?

Fixed scope. Fixed deadline. Signed SoW.

[Get in touch](/contact/)

## What We Learned

Useful assurance connects technical observations with a decision, an owner and a verification criterion. Documentation becomes more valuable when the team can maintain that relationship as the product changes. For another QA engagement in a different setting, see [Polity](/case-studies/polity/).

## Tech Stack

- PHP
- JavaScript
- Python
- FastAPI
- scikit-learn
- MySQL
- MariaDB

## Tags

- QA and technical assessment

## Links & Resources

[Cedars' public CCDS overview](https://ccdsglobal.com/)

## Questions about this project

### What is Cedars?

Cedars International develops CCDS, a cybersecurity product publicly described in terms of security operations, risk and decision support. Wavect’s engagement combined documentation and QA with subsequent technical assessment. Cedars supplied product knowledge and implementation information; Wavect structured, reviewed and connected the evidence.

### What was the challenge in the Cedars project?

Architecture descriptions, requirements, asset records and operating responsibilities answer different questions. To support a product decision, they need consistent definitions and a traceable relationship to the available software evidence.

AI introduces another layer: an application test can establish behavior under specified conditions, while model-quality evaluation needs representative tasks and criteria. Reviewers must keep these forms of evidence distinct and make the scope of each conclusion explicit.

### What did Wavect do for Cedars?

We began with documentation structures and drafting guidance: architecture, requirements, technical assets and access, roles, and third-party governance. Cedars supplied the product-specific information. We supported successive reviews and cross-references so the documents could be used together, including the link from a requirement to its verification.

The later assessment examined selected source paths, repository tests and isolated checks using synthetic inputs. For the AI review, we organized the evidence around intended use, information handling, human oversight and evaluation criteria. Each check had a defined scope.

The reporting paired observations with priorities, proposed actions and recheck criteria. That combined [software QA](/services/software-quality-assurance/) with [technical discovery](/services/software-discovery/), giving the team concrete work to take forward from the assessment.

### What were the outcomes of the Cedars project?

- Evidence trail, Architecture, requirements, assets and responsibilities organized for review.
- Targeted checks, Source review and controlled tests informed priorities for follow-up.
- Recheck criteria, Assessment reporting paired proposed actions with subsequent verification.

### How did Wavect work with Cedars?

Engagement: QA and technical assessment. Year: 2026.

### Which tech stack did Wavect use for Cedars?

PHP, JavaScript, Python, FastAPI, scikit-learn, MySQL, MariaDB.

### What did Wavect learn from the Cedars project?

Useful assurance connects technical observations with a decision, an owner and a verification criterion. Documentation becomes more valuable when the team can maintain that relationship as the product changes. For another QA engagement in a different setting, see [Polity](/case-studies/polity/).

Related services

- [Quality assurance](/services/software-quality-assurance/)
- [Software discovery](/services/software-discovery/)

Client references and trademarks

Wavect publishes these case studies about its own work. Client names, logos and trademarks are the property of their respective owners and are used here to identify the work, not to imply any partnership, sponsorship or endorsement. Each case study describes Wavect's own contribution inside a larger effort, and other parties, including the client's own teams and other vendors, contributed to the results. Figures attributed to a client are that client's own reported numbers. Figures about our work come from our records as of the review date, and we provide evidence on request. Reviews are reproduced from the platform named on each card and link to their source. We do not publish the commercial terms of any engagement, and product screenshots remain the property of the client shown. If you are named here and want a correction, a change or a removal, write to us and we will act on it: [office@wavect.io](mailto:office@wavect.io)

### [Polity](/case-studies/polity/)

Polity is an enterprise-grade platform running on seven microservices. Distributed, complex, and held to the standards enterprise clients demand, the kind of …

## Structured Data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@id": "https://wavect.io/#organization",
      "@type": [
        "Organization",
        "ProfessionalService",
        "LocalBusiness"
      ],
      "employee": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "founder": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "legalRepresentative": [
        {
          "@id": "https://wavect.io/team/kevin-riedl/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Kevin Riedl",
          "url": "https://wavect.io/team/kevin-riedl/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        },
        {
          "@id": "https://wavect.io/team/christof-jori/#person",
          "@type": "Person",
          "jobTitle": "Managing Director",
          "name": "Christof Jori",
          "url": "https://wavect.io/team/christof-jori/",
          "worksFor": {
            "@id": "https://wavect.io/#organization",
            "@type": [
              "Organization",
              "ProfessionalService",
              "LocalBusiness"
            ]
          }
        }
      ],
      "name": "Wavect GmbH",
      "subjectOf": {
        "@id": "https://wavect.io/verified-claims.json#dataset",
        "@type": "Dataset",
        "creator": {
          "@id": "https://wavect.io/#organization",
          "@type": [
            "Organization",
            "ProfessionalService",
            "LocalBusiness"
          ]
        },
        "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.",
        "inLanguage": "en",
        "isAccessibleForFree": true,
        "license": "https://creativecommons.org/licenses/by/4.0/",
        "name": "Wavect verified publication claims",
        "url": "https://wavect.io/verified-claims.json"
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/team/kevin-riedl/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Kevin Riedl",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796365",
        "https://www.linkedin.com/in/wsdt",
        "https://github.com/wsdt"
      ],
      "url": "https://wavect.io/team/kevin-riedl/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/team/christof-jori/#person",
      "@type": "Person",
      "jobTitle": "Managing Director",
      "name": "Christof Jori",
      "sameAs": [
        "https://www.wikidata.org/wiki/Q139796367",
        "https://www.linkedin.com/in/jocr77/",
        "https://github.com/jo-chris"
      ],
      "url": "https://wavect.io/team/christof-jori/",
      "worksFor": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      }
    },
    {
      "@id": "https://wavect.io/#website",
      "@type": "WebSite",
      "inLanguage": [
        "en",
        "de",
        "es",
        "zh"
      ],
      "name": "Wavect",
      "potentialAction": {
        "@type": "SearchAction",
        "query-input": "required name=search_term_string",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://wavect.io/search/?q={search_term_string}"
        }
      },
      "publisher": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      },
      "url": "https://wavect.io/"
    },
    {
      "@id": "https://wavect.io/case-studies/cedars/#webpage",
      "@type": "WebPage",
      "dateModified": "2026-10-28",
      "inLanguage": "en",
      "isPartOf": {
        "@id": "https://wavect.io/#website",
        "@type": "WebSite"
      },
      "lastReviewed": "2026-10-28",
      "speakable": {
        "@type": "SpeakableSpecification",
        "cssSelector": [
          "h1",
          ".cs-faq__q",
          ".cs-faq__a"
        ]
      },
      "url": "https://wavect.io/case-studies/cedars/"
    },
    {
      "@id": "https://wavect.io/verified-claims.json#cedars-assessment",
      "@type": "Claim",
      "appearance": {
        "@id": "https://wavect.io/case-studies/cedars/#webpage",
        "@type": "WebPage",
        "inLanguage": "en",
        "url": "https://wavect.io/case-studies/cedars/"
      },
      "author": {
        "@id": "https://wavect.io/#organization",
        "@type": [
          "Organization",
          "ProfessionalService",
          "LocalBusiness"
        ]
      },
      "dateModified": "2026-10-27",
      "identifier": "cedars-assessment",
      "inLanguage": "en",
      "text": "Wavect supported Cedars with documentation structures, QA, source review, bounded synthetic checks and assessment reporting."
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@id": "https://wavect.io/case-studies/cedars/#case-study",
  "@type": "Article",
  "about": {
    "@id": "https://wavect.io/case-studies/cedars/#project",
    "@type": "CreativeWork",
    "creator": {
      "@id": "https://wavect.io/#organization",
      "@type": [
        "Organization",
        "ProfessionalService",
        "LocalBusiness"
      ]
    },
    "dateCreated": "2026-01-01",
    "description": "QA and technical assessment engagement",
    "funder": {
      "@type": "Organization",
      "name": "Cedars"
    },
    "name": "Cedars",
    "subjectOf": {
      "@id": "https://wavect.io/case-studies/cedars/#case-study",
      "@type": "Article"
    },
    "url": "https://ccdsglobal.com/"
  },
  "abstract": "Architecture descriptions, requirements, asset records and operating responsibilities answer different questions. To support a product decision, they need consistent definitions and a traceable relationship to the available software evidence.\n\nAI introduces another layer: an application test can establish behavior under specified conditions, while model-quality evaluation needs representative tasks and criteria. Reviewers must keep these forms of evidence distinct and make the scope of each conclusion explicit.",
  "author": {
    "@id": "https://wavect.io/#organization",
    "@type": [
      "Organization",
      "ProfessionalService",
      "LocalBusiness"
    ]
  },
  "dateModified": "2026-10-28",
  "datePublished": "2026-01-01",
  "description": "Cedars International develops CCDS, a cybersecurity product publicly described in terms of security operations, risk and decision support. Wavect's engagement combined documentation and QA with subsequent technical assessment. Cedars supplied product knowledge and implementation information; Wavect structured, reviewed and connected the evidence.",
  "headline": "Cedars, Wavect Case Study",
  "image": "https://wavect.io/img/case-studies/logos/cedars.webp",
  "inLanguage": "en",
  "isPartOf": {
    "@type": "CollectionPage",
    "name": "Wavect Case Studies",
    "url": "https://wavect.io/case-studies/"
  },
  "keywords": "QA and technical assessment, PHP, JavaScript, Python, FastAPI, scikit-learn, MySQL, MariaDB",
  "mainEntityOfPage": "https://wavect.io/case-studies/cedars/",
  "mentions": [
    {
      "@type": "DefinedTerm",
      "name": "PHP"
    },
    {
      "@type": "DefinedTerm",
      "name": "JavaScript"
    },
    {
      "@type": "DefinedTerm",
      "name": "Python"
    },
    {
      "@type": "DefinedTerm",
      "name": "FastAPI"
    },
    {
      "@type": "DefinedTerm",
      "name": "scikit-learn"
    },
    {
      "@type": "DefinedTerm",
      "name": "MySQL"
    },
    {
      "@type": "DefinedTerm",
      "name": "MariaDB"
    }
  ],
  "publisher": {
    "@id": "https://wavect.io/#organization",
    "@type": [
      "Organization",
      "ProfessionalService",
      "LocalBusiness"
    ]
  },
  "url": "https://wavect.io/case-studies/cedars/"
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "item": "https://wavect.io/",
      "name": "Home",
      "position": 1
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/case-studies/",
      "name": "Case Studies",
      "position": 2
    },
    {
      "@type": "ListItem",
      "item": "https://wavect.io/case-studies/cedars/",
      "name": "Cedars",
      "position": 3
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cedars International develops CCDS, a cybersecurity product publicly described in terms of security operations, risk and decision support. Wavect's engagement combined documentation and QA with subsequent technical assessment. Cedars supplied product knowledge and implementation information; Wavect structured, reviewed and connected the evidence."
      },
      "name": "What is Cedars?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Architecture descriptions, requirements, asset records and operating responsibilities answer different questions. To support a product decision, they need consistent definitions and a traceable relationship to the available software evidence. AI introduces another layer: an application test can establish behavior under specified conditions, while model-quality evaluation needs representative tasks and criteria. Reviewers must keep these forms of evidence distinct and make the scope of each conclusion explicit."
      },
      "name": "What was the challenge in the Cedars project?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "We began with documentation structures and drafting guidance: architecture, requirements, technical assets and access, roles, and third-party governance. Cedars supplied the product-specific information. We supported successive reviews and cross-references so the documents could be used together, including the link from a requirement to its verification. The later assessment examined selected source paths, repository tests and isolated checks using synthetic inputs. For the AI review, we organized the evidence around intended use, information handling, human oversight and evaluation criteria. Each check had a defined scope. The reporting paired observations with priorities, proposed actions and recheck criteria. That combined software QA with technical discovery, giving the team concrete work to take forward from the assessment."
      },
      "name": "What did Wavect do for Cedars?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Evidence trail, Architecture, requirements, assets and responsibilities organized for review.; Targeted checks, Source review and controlled tests informed priorities for follow-up.; Recheck criteria, Assessment reporting paired proposed actions with subsequent verification."
      },
      "name": "What were the outcomes of the Cedars project?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Engagement: QA and technical assessment. Year: 2026."
      },
      "name": "How did Wavect work with Cedars?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PHP, JavaScript, Python, FastAPI, scikit-learn, MySQL, MariaDB."
      },
      "name": "Which tech stack did Wavect use for Cedars?"
    },
    {
      "@type": "Question",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Useful assurance connects technical observations with a decision, an owner and a verification criterion. Documentation becomes more valuable when the team can maintain that relationship as the product changes. For another QA engagement in a different setting, see Polity."
      },
      "name": "What did Wavect learn from the Cedars project?"
    }
  ]
}
```