the output is yours. regardless of who helped create it.

that’s the core of diligence. not a checkbox. not a disclaimer. a genuine commitment to owning what you produce — even when AI did significant work to get there.

three dimensions of diligence

#

creation diligence — be thoughtful about which AI you use

not all AI systems are equal. before you work with one, consider:

• how was it built and trained?
• what data are you sharing with it?
• does it align with your organisation’s security and privacy policies?

for Security analysts — sharing sensitive incident data with an unchecked external AI tool is a security risk. know your platform before you use it.

transparency diligence — be honest about AI’s role

different contexts have different expectations. academic work, professional reports, client communications — each has its own standards for disclosure.

the question isn’t just “should i disclose?” it’s “who needs to know, and how much detail do they need?”

a simple diligence statement goes a long way: “this report was drafted with AI assistance. all content has been reviewed and verified. i take full responsibility for its accuracy.”

deployment diligence — verify before you share

before any AI-assisted output leaves your hands:

• verify key facts independently
• check for bias or gaps in the analysis
• ensure it meets the required standard for its purpose
• confirm you can stand behind every claim in it

if you wouldn’t be comfortable defending it without the AI output to reference — it’s not ready.

the 4Ds as a complete system

#

this is where it all connects.

• delegation — you decide what AI handles
• description — you communicate clearly
• discernment — you evaluate critically
• diligence — you take responsibility for what goes out

none of these work in isolation. fluency is applying all four together, consistently, across every meaningful AI interaction.

the goal isn’t perfection. it’s intention. deliberate, thoughtful human-AI collaboration that produces better outcomes than either could achieve alone.

for Security analysts specifically

#

the stakes are real. investigations inform decisions. reports shape responses. incorrect outputs don’t just waste time — they can misdirect an entire incident response.

AI fluency in a SOC context means:

• delegating intelligently based on task risk
• describing with enough precision that output is actually usable
• discerning with the skepticism you’d apply to any unverified source
• taking full ownership of everything that carries your name

that’s the series. six posts. from what AI fluency means to how all four competencies work together.

the cheat sheet is below — bookmark it. every term from the framework in one place.

how are you currently doing on diligence — creation, transparency, or deployment? which one needs the most attention?

AI Fluency Cheat Sheet back to series index

the 4Ds — core competencies

#

AI Fluency the ability to work with AI effectively, efficiently, ethically, and safely.

Delegation deciding what work to do yourself, what to collaborate on with AI, and what to let AI handle independently.

• Problem Awareness — understand your goals before involving AI
• Platform Awareness — know the capabilities and limits of different AI systems
• Task Delegation — distribute work intelligently between human and AI

Description communicating clearly and intentionally with AI systems.

• Product Description — define what you want in terms of output, format, audience, style
• Process Description — guide how AI should approach the task
• Performance Description — specify how AI should behave during the collaboration

Discernment critically evaluating AI outputs, reasoning, and behavior.

• Product Discernment — evaluate accuracy, relevance, coherence of outputs
• Process Discernment — assess how AI arrived at its output
• Performance Discernment — evaluate whether AI’s behavior served your needs

Diligence using AI responsibly and taking accountability for AI-assisted work.

• Creation Diligence — be thoughtful about which AI systems you use
• Transparency Diligence — be honest about AI’s role in your work
• Deployment Diligence — verify and vouch for outputs before sharing

three ways to work with AI

#

Automation AI executes specific tasks based on your instructions.

Augmentation you and AI collaborate as thinking partners, iteratively.

Agency you configure AI to work independently on your behalf.

generative AI and LLM concepts

#

Generative AI AI that creates new content rather than just analyzing existing data.

Large Language Models (LLMs) generative AI trained on vast text data to understand and generate human language.

Parameters mathematical values within a model that determine how it processes information. modern LLMs contain billions.

Transformer Architecture the 2017 breakthrough that enabled LLMs to process text in parallel while understanding long-range relationships between words.

Pre-training initial training phase where models learn language patterns from massive datasets.

Fine-tuning additional training that shapes raw capability into helpful, safe, instruction-following behavior.

Context Window the maximum amount of information an AI can consider at one time. exceeding it causes earlier context to drop.

Hallucination when AI confidently states something plausible but incorrect.

Knowledge Cutoff Date the point after which an AI has no built-in knowledge of the world.

Temperature controls randomness in AI responses. higher = more creative. lower = more predictable.

RAG (Retrieval Augmented Generation) connects AI to external knowledge sources to improve accuracy and reduce hallucinations.

Bias systematic patterns in AI outputs that unfairly favor or disadvantage certain groups, often reflecting training data patterns.

prompting concepts

#

Prompt the input given to an AI model — instructions, context, documents.

Prompt Engineering the practice of designing effective prompts to produce desired outputs.

Chain-of-thought Prompting guiding AI to work through a problem step by step before answering.

Few-shot Learning teaching AI by showing examples of desired input-output patterns.

Role or Persona Definition specifying a character, expertise level, or communication style for AI to adopt.

Output Constraints specifying format, length, structure, or other characteristics of the desired response.

Think-first Approach explicitly asking AI to reason through a problem before providing a final answer.

this cheat sheet is based on the AI Fluency: Framework and Foundations course by Rick Dakan, Joseph Feller, and Anthropic. released under CC BY-NC-SA 4.0.

back to series index — still figuring out AI, one post at a time

AI will give you a confident answer whether it’s right or wrong. that’s the problem.

there’s no hesitation. no “i’m not sure about this.” just a well-structured, fluent, convincing response — that may or may not be accurate. discernment is the competency that stops you from treating confident-sounding output as correct output.

in SOC work, this isn’t a minor inconvenience. a wrong answer about a threat actor, a misattributed CVE, a hallucinated IOC in an investigation report — these have real consequences.

what discernment actually is

#

discernment is the ability to thoughtfully evaluate what AI produces, how it produced it, and how it behaved during the process.

it’s the flip side of description. description shapes what goes in. discernment evaluates what comes out.

and just like description, it has three dimensions.

product discernment — evaluate the output itself

#

the most obvious layer. look at what AI actually produced and ask:

• is this accurate? can i verify the key claims?
• is it appropriate for the audience and context?
• is it coherent? does the logic hold together?
• is it relevant to what i actually asked?
• what’s missing that should be there?

for Security analysts — your domain expertise is your primary discernment tool here. you know what a good investigation summary looks like. you know when a threat description doesn’t match what you’ve seen in the environment. trust that knowledge.

the dangerous moment is when you’re evaluating output in a domain where you have less expertise. that’s when confident-sounding wrong answers slip through. slow down in those moments.

process discernment — evaluate how AI got there

#

not just what AI produced, but how it arrived at it. the reasoning path matters.

look for:

• logical errors or jumps in reasoning
• gaps in analysis — what did AI overlook or ignore?
• inappropriate reasoning steps — did it make assumptions it shouldn’t have?
• whether it considered multiple possibilities or locked onto one early

SOC example — you ask AI to assess whether a series of events constitutes lateral movement. it says yes. product discernment checks the conclusion. process discernment asks — did it consider the legitimate admin activity baseline? did it account for the scheduled task that runs at that time? did it look at the full sequence or just the flagged events?

the conclusion might be right. the reasoning might still be flawed. both matter.

performance discernment — evaluate how AI behaved

#

the most overlooked dimension. was AI’s behavior during the interaction actually helpful?

consider:

• did it stay focused on your actual question or drift?
• was the communication style appropriate for your needs?
• did it ask clarifying questions when it should have?
• did it push back when something didn’t add up — or just agree?
• was it concise when you needed concise, detailed when you needed detail?

this matters because performance issues compound across a long conversation. an AI that agrees with everything you say isn’t a thinking partner — it’s an echo chamber. an AI that stays vague when you need precision is wasting your time.

if the behavior isn’t serving you — name it and redirect. “you’re being too generic, i need specific examples” is a valid performance discernment response.

the description-discernment loop

#

these two competencies work together continuously.

you describe → AI produces → you discern → you refine your description → AI produces again → you discern again.

this loop is how good collaborative work actually happens. not one perfect prompt and one perfect output. iterative cycles where each round gets closer to what you need.

the loop also means discernment isn’t just evaluation — it’s input for the next description. what you notice in the output shapes how you communicate next.

a practical discernment habit for SOC work

#

before using any AI output in an investigation or report, ask three questions:

1. can i verify the key facts independently?
2. does the reasoning hold up against what i know about this environment?
3. would i be comfortable explaining this conclusion without the AI output to back me up?

if the answer to any of these is no — the output needs more work before it goes anywhere.

next up — diligence. the competency that asks not just “is this good?” but “am i using this responsibly?”

what’s the most dangerous type of AI error in your SOC context — wrong facts, flawed reasoning, or misaligned behavior?

next up: AI Series #23 — “accountability doesn’t disappear when AI helps you” AI Fluency Cheat Sheet back to series index

AI isn’t vague. your instructions are.

most disappointing AI outputs aren’t an AI problem. they’re a communication problem. the model responded to exactly what you said — just not what you meant. closing that gap is what description is about.

description isn’t just writing better prompts. it’s building a collaborative environment where AI can actually do its best work.

three dimensions of description

#

the AI fluency framework breaks description into three components. most people only think about one.

product description — define what you want

the output. format, length, audience, style, level of detail.

vague: “summarise this alert.” specific: “summarise this alert in 3 bullet points for a non-technical stakeholder. focus on what happened, what the risk is, and what action is recommended.”

same task. very different results.

for SOC work — be explicit about who the output is for. a summary for a CISO reads differently than one for a tier 1 analyst. AI doesn’t know your audience unless you tell it.

process description — guide how AI approaches the task

not just what you want, but how you want AI to get there. the methodology, the steps, the framework to follow.

vague: “analyse this log data.” specific: “analyse this log data by first identifying anomalous timestamps, then cross-referencing with the associated user account activity, then flagging anything that deviates from the baseline behaviour described below.”

process description is particularly powerful for complex, multi-step SOC tasks where the approach matters as much as the output.

performance description — define how AI should behave

the collaboration style. should AI be concise or detailed? challenging or supportive? should it ask clarifying questions or make assumptions and proceed?

this is the most overlooked dimension of description. most people never specify it — then wonder why the interaction feels off.

examples:

• “be concise. one paragraph maximum per point.”
• “challenge my assumptions. push back if something doesn’t hold up.”
• “ask me clarifying questions before starting.”
• “think step by step and show your reasoning.”

for SOC investigations — telling AI to challenge your assumptions is genuinely useful. it surfaces blind spots you might miss under time pressure.

six prompting techniques worth knowing

#

these are practical, not theoretical. use them.

1. give context who you are, what you’re working on, why it matters. “i’m an L2 security analyst investigating a potential phishing incident affecting a finance team member” lands very differently than “help me with phishing.”

2. show examples demonstrate the output you want. paste a previous report you liked. show a format that worked. AI learns from examples faster than from descriptions alone.

3. specify constraints format, length, tone, what to include, what to exclude. be explicit. “under 150 words, bullet points, no jargon, include a recommended action” removes ambiguity entirely.

4. break complex tasks into steps chain-of-thought prompting. list the specific steps you want AI to follow. especially useful for multi-stage investigations or analysis tasks where order matters.

5. ask AI to think first explicitly instruct AI to work through its reasoning before giving a final answer. “think through this carefully before responding” consistently improves output quality on complex tasks.

6. define the role or tone assign a perspective. “respond as a senior threat intelligence analyst reviewing this for a junior colleague” shapes both expertise level and communication style in one instruction.

one technique worth calling out separately

#

if you’re struggling to write a good prompt — ask AI to help you write it.

“i need to ask you about X but i’m not sure how to frame it. can you help me write a better prompt?” works surprisingly well and saves significant back and forth.

the iteration mindset

#

first response is a draft. not a final answer.

description isn’t a one-shot exercise. it’s a conversation. if the output isn’t right — refine, redirect, give feedback. “this is good but too formal, make it more direct” is a valid next prompt.

the analysts who get the best results from AI aren’t the ones who write perfect prompts first time. they’re the ones who iterate quickly and know what good looks like.

next up — discernment. because description gets you better outputs, but discernment is what stops you from using bad ones.

which of the three description components — product, process, or performance — do you currently use least? that’s probably where your biggest gains are.

next up: AI Series #22 — “just because it sounds right doesn’t mean it is” AI Fluency Cheat Sheet back to series index

the first mistake most people make with AI is delegating too early.

they open a prompt window before they’ve clearly defined what they need. they hand over tasks AI isn’t suited for. they skip the thinking that should happen before any AI is involved.

delegation isn’t about offloading work. it’s about distributing it intelligently.

what delegation actually means

#

in the AI fluency framework, delegation is the strategic process of deciding what work to do yourself, what to collaborate on with AI, and what to let AI handle independently.

it sounds simple. it isn’t. good delegation requires two things most people don’t stop to develop — problem awareness and platform awareness.

problem awareness — understand the work before involving AI

#

before you open a prompt window, you need to clearly understand what you’re trying to achieve.

this means:

• what does a good result actually look like?
• what are the different components of this task?
• where does human judgment, creativity, or domain expertise matter most?
• where is AI likely to add the most value?

SOC example — you’re investigating a potential lateral movement alert. before delegating anything to AI, you need to know: what am i actually trying to determine here? what context do i already have? what does a good investigation summary look like?

without that clarity, you’ll get a generic output that doesn’t serve the investigation. with it, you can delegate specific, well-defined pieces — and keep the judgment calls for yourself.

domain expertise is the foundation of effective delegation. you can’t intelligently decide what to give AI if you don’t deeply understand the work yourself.

platform awareness — know what different AI systems can do

#

not all AI systems are equal. different models have different strengths — some prioritise speed, some accuracy, some creative output, some reasoning depth.

platform awareness means:

• understanding the capabilities and limitations of the tools you use
• knowing which tool fits which type of task
• experimenting enough to build genuine intuition

for Security analysts — Claude, ChatGPT, Copilot, and specialised security AI tools each have different strengths. using the wrong tool for the wrong task is a delegation failure even before you write a single prompt.

this isn’t about memorising feature lists. it’s about building hands-on experience and being deliberate about which platform you reach for and why.

task delegation — distributing work intelligently

#

once you understand the work and the tools, you can make intelligent delegation decisions. three categories:

automate — tasks AI can handle independently with minimal oversight. formatting, summarising structured data, generating first drafts from clear briefs, translating, extracting information from documents.

augment — tasks where human and AI work together iteratively. investigation analysis, report writing, threat hunting hypotheses, detection rule drafting. you bring domain expertise and judgment, AI brings speed and pattern recognition.

keep human — tasks requiring critical judgment, ethical decisions, or accountability. final escalation decisions, stakeholder communications on sensitive incidents, anything where being wrong has serious consequences.

what Security analysts should never fully delegate

#

a few things worth naming explicitly:

• final verdict on an alert — AI can inform, never decide
• sensitive stakeholder communication — tone, context, and judgment matter too much
• novel threat assessment — AI’s knowledge has a cutoff. your current context doesn’t
• anything requiring organisational accountability — you sign off on it, you own it

a simple delegation question to ask before every task

#

“what part of this genuinely requires my expertise, and what part is execution that AI can handle?”

that single question, asked consistently, changes how you work.

next up — description. once you’ve decided what to delegate, how you communicate it determines everything.

what’s one task you currently delegate to AI that probably deserves more of your judgment?

next up: AI Series #21 — “the gap between what you mean and what AI understands” AI Fluency Cheat Sheet back to series index

before you can work with AI fluently, you need to understand what you’re actually working with.

not at a PhD level. but enough to know why it behaves the way it does, where it’s reliable, and where it isn’t. that understanding changes how you work with it.

what generative AI actually is

#

most AI you’ve encountered before generative AI was analytical — it classified, predicted, detected. generative AI does something different. it creates. text, images, code, audio — new content that didn’t exist before.

large language models like Claude are the most visible example. trained on vast amounts of text, they learn to predict and generate human language at a level that feels remarkably natural.

three things made this possible:

algorithmic breakthrough — the transformer architecture in 2017. enabled models to process entire sequences of text in parallel while understanding relationships between words across long passages. everything changed after this.

data — the internet. books. code. decades of human-generated text at massive scale. the raw material that made training possible.

compute — GPUs and TPUs powerful enough to train models with billions of parameters. scale unlocked capabilities nobody explicitly programmed.

how these models learn

#

two stages:

pre-training — the model analyzes billions of examples of text, building a statistical map of language. it learns patterns, relationships, facts, reasoning styles — all by learning to predict what comes next.

fine-tuning — after pre-training, the model is further trained to follow instructions, be helpful, and avoid harmful outputs. this is where raw capability gets shaped into something useful and safe.

what they can and can’t do

#

honest and balanced — because this matters for how you use them.

capabilities:

• versatile across language tasks — writing, summarising, translating, explaining
• maintains conversational context across long exchanges
• connects to external tools and data sources
• adapts to new tasks from examples without retraining

limitations:

• knowledge cutoff — no awareness of events after training date
• hallucinations — confidently states incorrect information. sounds plausible. isn’t always true.
• context window limits — maximum information it can hold at once. long conversations can cause earlier context to drop
• non-determinism — same prompt can produce different answers each time
• reasoning challenges — improving rapidly but still struggles with complex multi-step logic
• no access to private data — unless explicitly connected

for Security analysts — hallucinations and knowledge cutoffs are the most dangerous limitations. a confident-sounding wrong answer about a threat actor or CVE is worse than no answer.

the AI fluency framework — the 4Ds

#

knowing what AI is gets you halfway. knowing how to work with it gets you the rest of the way.

the 4D framework is a set of four core competencies for working with AI effectively, efficiently, ethically, and safely.

Delegation — deciding what work to do yourself, what to collaborate on with AI, and what to let AI handle independently. requires understanding both your goals and AI’s capabilities.

Description — communicating clearly with AI. defining what you want, how you want it approached, and how you want AI to behave during the collaboration.

Discernment — evaluating what comes back. assessing the quality, accuracy, and appropriateness of AI outputs with a critical eye.

Diligence — taking responsibility for AI-assisted work. being transparent about AI’s role and accountable for the final output.

each post in this series goes deep on one of these. but they work together — fluency comes from applying all four, not just one.

three ways to work with AI

#

the 4Ds apply across three different modes of AI interaction:

Automation — AI executes specific tasks based on your instructions. you define what needs doing, AI does it.

Augmentation — you and AI collaborate as thinking partners. iterative, back and forth, both contributing to the outcome.

Agency — you configure AI to work independently on your behalf. you shape its knowledge and behavior rather than specifying exact actions.

most Security analysts operate in automation mode — one-off prompts, specific outputs. fluency opens up augmentation and eventually agency. that’s where the real leverage is.

next up — delegation. the competency that starts before you ever open a prompt window.

which mode do you currently use most — automation, augmentation, or agency?

next up: AI Series #20 — “not everything should go to AI — the art of delegation” AI Fluency Cheat Sheet back to series index

there is a difference between using AI and being fluent with it.

most Security analysts i know have Claude or ChatGPT open. they use it daily. ask questions, get answers, move on. and that’s fine — it’s useful at that level.

but fluency is something different. fluency is knowing how to work with AI. not just what to ask, but how to ask it, how to evaluate what comes back, how to decide what to hand over and what to keep, and how to take responsibility for the output.

the difference shows in the results.

why this matters for SOC work specifically

#

we deal with complexity every single day. ambiguous alerts. incomplete context. time pressure. high stakes decisions.

AI can help with all of it — but only if you know how to use it properly. a poorly delegated task gives you a confident-sounding answer that’s wrong. a vague prompt gives you a generic response that wastes your time. an unchecked output that goes into a report damages your credibility.

fluency isn’t about being an AI expert. it’s about being intentional with a tool you’re already using.

what this series covers

#

5 posts built on Anthropic’s AI Fluency course — filtered through a Security analyst’s lens.

• the AI fluency framework and what generative AI actually is
• delegation — deciding what to give AI and what to keep
• description — communicating with intention and clarity
• discernment — evaluating what comes back with a critical eye
• diligence — taking responsibility for AI-assisted work

more reflective than the previous two series. less about features and algorithms, more about how you think when working with AI.

one resource worth bookmarking

#

every post in this series links to a cheat sheet — key terms and concepts from the AI fluency framework in one place. useful to have open as you read.

link at the end of each post.

if you’ve read the AI fundamentals series or the Claude 101 series — this is the missing piece. the first two covered what AI is and how to use the tools. this one covers how to think about working with AI well.

which of these do you do most often — delegate too much to AI, not enough, or somewhere in between?

next up: AI Series #19 — “the AI fluency framework — a smarter way to think about working with AI” AI Fluency Cheat Sheet back to series index