Business & Operations

Design chunking strategies — semantic splitting, overlap tuning, retrieval-aware chunk sizing. Use when asked "how should we chunk documents", "what chunk size for retrieval", or "set up semantic splitting".

Design token budgets — system/user/assistant allocation, overflow handling, context compression. Use when asked "we are blowing the context window", "design a token budget", or "handle context overflow".

Write SIEM detection rules for a threat or TTP — SIGMA format, MITRE mapping, and test cases. Use when asked to "write a SIGMA rule", "build a detection rule for this TTP", or "map a SIEM rule to MITRE".

Audit existing SIEM deployment — log coverage, rule quality, and alert volume. Use when asked to "audit our SIEM", "find log coverage gaps", or "our alert volume is too high".

Tune a SIEM alert — reduce false positives, add context, and improve analyst experience. Use when asked to "tune this alert", "we have too many false positives", or "improve alert quality".

Design a SAST/DAST scanning pipeline — tooling selection, CI integration, and triage workflow. Use when asked to "set up SAST in CI", "add DAST scanning", or "build a security scanning pipeline".

Audit existing application security tooling and code for OWASP Top 10 coverage. Use when asked to "audit our appsec tooling", "check OWASP Top 10 coverage", or "find code security gaps".

Audit existing incident response capability — playbook coverage, tooling gaps, and readiness. Use when asked to "audit our incident response", "assess IR readiness", or "find playbook coverage gaps".

Write an incident response playbook for a threat scenario — detection, containment, eradication, recovery. Use when asked to "write an IR playbook", "build an incident response runbook", or "how do we respond to ransomware".

Design containment procedures for an active incident — isolation, quarantine, and credential rotation. Use when asked to "contain this incident", "isolate the compromised host", or "rotate credentials after a breach".

Write a penetration test or red team finding report — CVSS scores, business impact, and remediation. Use when asked to "write a pentest report", "document this finding", or "score CVSS and business impact".

Design a reconnaissance plan — OSINT, attack surface mapping, and enumeration methodology. Use when asked to "map our attack surface", "run OSINT on our org", or "build an enumeration plan".

Build ranking evaluation — NDCG/MRR measurement, human relevance labeling, offline eval harness. Use when asked to "measure ranking quality", "compute NDCG for our search", or "set up human relevance labeling".

Design ranking pipelines — reranker selection, score fusion, cross-encoder patterns, latency trade-offs. Use when asked to "add a reranker", "design a ranking pipeline", or "improve retrieval relevance".

Design a backpressure and scaling strategy for a queue consumer system. Use when asked "our consumers are falling behind", "design backpressure", or "scale queue consumers".

Build prompt versioning systems — storage, A/B testing, regression tracking, rollback. Use when asked to "version our prompts", "A/B test prompts", or "roll back a prompt".

Produce a complete positioning document using the Dunford framework — competitive alternatives, unique attributes, value, best-fit customer, market category, positioning statement, and tagline. Use when asked to "write our positioning", "define our value prop", "positioning statement", "what market are we in", "how do we position against X", "what's our tagline", or "write our messaging foundation".

Messaging framework — produce a full headline, subheadline, proof points, and CTA hierarchy for use across all surfaces. Use when asked to "write our messaging", "messaging framework", "what should our headline say", "copy hierarchy", "tagline and messaging", or "how do we talk about the product".

Design a security awareness training curriculum — topics, format, and effectiveness measurement. Use when asked to "design security training", "build a security awareness curriculum", or "train our team on security".

Audit existing security awareness program — coverage gaps, effectiveness metrics, and culture indicators. Use when asked to "audit our security awareness program", "find training coverage gaps", or "measure our security culture".

Design a phishing simulation program — scenario selection, difficulty curve, and measurement. Use when asked to "run a phishing simulation", "design a phishing test", or "measure phishing susceptibility".

Triage a set of CVEs — CVSS + EPSS + KEV scoring, prioritization, and recommended remediation order. Use when asked to "triage these CVEs", "which vulnerabilities matter", or "prioritize our patching".

Audit existing vulnerability management — find SLA gaps, missing tiers, and process failures. Use when asked to "audit our vulnerability management", "find patch SLA gaps", or "are we patching fast enough".

Design a vulnerability management program — SLAs, asset tiers, escalation, and metrics. Use when asked to "design a patching program", "set vulnerability SLAs", or "define our patch cadence".