A practical AI-work framework for cybersecurity teams

Bound the task and authority

Define the system, time window, data sources, permitted actions, and incident role before AI is introduced. A task such as “summarize these authenticated alerts and propose the next three investigative checks” is inspectable. “Handle the incident” is not.

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes across govern, identify, protect, detect, respond, and recover. Use those functions to locate the AI-supported task and its owner. A drafting assistant in respond should not silently acquire authority to change protection controls.

Label every input by source, retrieval time, sensitivity, and integrity status. Synthetic or sanitized data is appropriate for early assessment and training where production evidence is not authorized.

Sources: [1]

Use a four-lane investigation board

Create four columns: observed, inferred, decided, and executed. Only source-backed facts enter observed. AI-generated explanations enter inferred until checked. A human-owned response choice enters decided with rationale. System changes enter executed with actor, time, and evidence.

The CISA and NCSC Guidelines for Secure AI System Development emphasize secure design, accountability, and organizational ownership. For day-to-day cyber work, the four-lane board prevents a fluent hypothesis from masquerading as a verified event or authorized action.

Every card should link to the alert, log excerpt, configuration record, or approval that supports it. If provenance is unavailable, mark the card unresolved.

Sources: [2]

Work a synthetic alert-triage example

Suppose a packet contains an impossible-travel alert, a successful multifactor challenge, two failed API calls, a planned employee trip, and an identity-provider clock offset. An AI summary states that the account was compromised and recommends immediate disablement.

The board could record:

The final artifact is an evidence-ranked triage brief, not a declaration that the incident is resolved.

• Observed O-01: logins appear 7,800 kilometres apart within 20 minutes, based on two provider events.
• Observed O-02: the second event's timestamp uses a server with a documented 47-minute offset.
• Observed O-03: multifactor challenge succeeded; this is relevant but not dispositive.
• Inferred I-01: credentials may be compromised. Competing explanations include timestamp error, proxy routing, or authorized travel.
• Decided D-01: verify normalized time, device identifier, and travel record before account action unless another containment threshold is met.
• Executed E-01: none in the simulation; proposed checks are listed for the incident owner.

Test adversarial and degraded conditions

Include poisoned log text, untrusted instructions embedded in evidence, missing events, stale threat intelligence, inconsistent clocks, inaccessible systems, and a request that exceeds the participant's authority. Ask whether the workflow preserves source boundaries, identifies uncertainty, and falls back safely.

The NIST AI Cybersecurity Framework Profile provides current guidance for managing cybersecurity risks related to AI systems. Use it with the organization's own architecture, threat model, and incident procedures. A general framework does not decide which control fits a particular environment.

Review both the final brief and the workflow trace. A correct conclusion reached through invented evidence is not acceptable. A cautious conclusion may also be weak if the participant ignored available decisive evidence.

Sources: [3]

Design a bounded assessment

A realistic simulation can present synthetic alerts, policies, logs, messages, and conflicting system notes. The participant must frame the incident, navigate sources, use AI support, verify claims, exercise judgment, and communicate a prioritized response within the authority boundary.

Two Prune can retain the submitted brief and available workflow evidence, then report observed performance across its six AI-fluency pillars for human interpretation. It does not monitor a production network, authorize containment, certify security controls, or establish sector compliance. Missing logs or absent decision opportunities should appear as confidence limitations rather than be treated as participant failure.