Business & Operations

Analyze LLM eval results — score breakdowns by category, regression detection vs baseline, failure clustering. Use when asked to "analyze our eval results", "did the model regress", or "cluster the eval failures".

Survey existing network and identity controls for zero trust readiness. Use when asked "are we ready for zero trust", "survey our identity controls", or "assess our network segmentation".

Design a zero trust architecture — phased roadmap, identity pillar, and network segmentation. Use when asked to "design a zero trust architecture", "build a zero trust roadmap", or "plan network microsegmentation".

Audit an existing environment against zero trust principles — find implicit trust and over-privileged access. Use when asked to "audit against zero trust", "find implicit trust", or "find over-privileged access".

Audit LLM observability coverage — trace gaps, logging completeness, cost attribution accuracy. Use when asked to "audit our LLM observability", "find trace coverage gaps", or "check cost attribution accuracy".

Instrument LLM calls with tracing — span structure, token counts, latency, model metadata. Use when asked to "add tracing to our LLM calls", "log prompts and completions", or "instrument token counts".

Debug AI system behavior using traces — prompt reconstruction, output comparison, failure attribution. Use when asked "why did the model output this", "debug this LLM failure", or "reconstruct the prompt".

Audit token usage patterns — avg context size, waste, truncation frequency, budget adherence. Use when asked to "audit our token usage", "how often do we truncate", or "find context waste".

Design chunking strategies — semantic splitting, overlap tuning, retrieval-aware chunk sizing. Use when asked "how should we chunk documents", "what chunk size for retrieval", or "set up semantic splitting".

Design token budgets — system/user/assistant allocation, overflow handling, context compression. Use when asked "we are blowing the context window", "design a token budget", or "handle context overflow".

Write SIEM detection rules for a threat or TTP — SIGMA format, MITRE mapping, and test cases. Use when asked to "write a SIGMA rule", "build a detection rule for this TTP", or "map a SIEM rule to MITRE".

Audit existing SIEM deployment — log coverage, rule quality, and alert volume. Use when asked to "audit our SIEM", "find log coverage gaps", or "our alert volume is too high".

Tune a SIEM alert — reduce false positives, add context, and improve analyst experience. Use when asked to "tune this alert", "we have too many false positives", or "improve alert quality".

Design a SAST/DAST scanning pipeline — tooling selection, CI integration, and triage workflow. Use when asked to "set up SAST in CI", "add DAST scanning", or "build a security scanning pipeline".

Audit existing application security tooling and code for OWASP Top 10 coverage. Use when asked to "audit our appsec tooling", "check OWASP Top 10 coverage", or "find code security gaps".

Audit existing incident response capability — playbook coverage, tooling gaps, and readiness. Use when asked to "audit our incident response", "assess IR readiness", or "find playbook coverage gaps".

Write an incident response playbook for a threat scenario — detection, containment, eradication, recovery. Use when asked to "write an IR playbook", "build an incident response runbook", or "how do we respond to ransomware".

Design containment procedures for an active incident — isolation, quarantine, and credential rotation. Use when asked to "contain this incident", "isolate the compromised host", or "rotate credentials after a breach".

Write a penetration test or red team finding report — CVSS scores, business impact, and remediation. Use when asked to "write a pentest report", "document this finding", or "score CVSS and business impact".

Design a reconnaissance plan — OSINT, attack surface mapping, and enumeration methodology. Use when asked to "map our attack surface", "run OSINT on our org", or "build an enumeration plan".

Build ranking evaluation — NDCG/MRR measurement, human relevance labeling, offline eval harness. Use when asked to "measure ranking quality", "compute NDCG for our search", or "set up human relevance labeling".

Design ranking pipelines — reranker selection, score fusion, cross-encoder patterns, latency trade-offs. Use when asked to "add a reranker", "design a ranking pipeline", or "improve retrieval relevance".

Design a backpressure and scaling strategy for a queue consumer system. Use when asked "our consumers are falling behind", "design backpressure", or "scale queue consumers".

Build prompt versioning systems — storage, A/B testing, regression tracking, rollback. Use when asked to "version our prompts", "A/B test prompts", or "roll back a prompt".