The question is coming
Your CISO is going to ask how you're using AI to do your job better. Often the question doesn't start with them. Boards are asking every CISO how security is using AI to do more with the same budget, and your CISO needs real use cases to bring back.
That's your opening. Don't wait to be asked. Be the program owner who raises a hand and says, "Here's how my team is doing it."
Stop asking. Start delegating.
Think of Livvy as the senior analyst you were never approved to hire. It knows your people, behaviors, campaigns, and policies, and it works around the clock.
It also learns your voice. Train Livvy on your culture, your brand, and how you talk to employees. Then every nudge, reminder, and manager note sounds like your team, not just an agent.
Brief Livvy the way you'd brief a strong analyst. The best prompts include:
- The outcome: launch, build, enroll, report. Not "tell me about."
- Your inputs: policies, approved templates, report formats.
- The timeline: launch dates, completion windows, cadence.
- The rules: difficulty mix, time limits, who gets notified and when.
- The follow-through: who gets thanked, enrolled, or escalated.
A basic answer ends with a number. A great prompt ends with an action. Here are ten to start with, by team.
Security Awareness & Training: run the program, not the spreadsheet
Awareness teams carry the heaviest operational load with the fewest people. These prompts take the launches, reminders, and reporting off your plate.
1. Build annual training from your own policies
"Hey Livvy, set up my annual training using our current security policies. Launch in April with 90 days to complete. Send weekly reminders starting at day 30 and notify managers of anyone incomplete starting at day 45. Keep it to 25–27 minutes."
Why it works: Your content, your calendar, your escalation path. The reminders and manager follow-up run without you.
2. Run a full year of phishing, with follow-through built in
"Hey Livvy, launch an annual phishing program using our approved templates. Mix easy, medium, and hard, and make every other month a credential harvesting campaign. Send a Teams nudge thanking everyone who reports a simulation, and move anyone who clicks into the clicker program."
Why it works: Twelve months of planning in one prompt. Reporters get reinforced in the moment, and clickers get coached without a manual list pull.
3. Automate your phishing reporting
"Hey Livvy, automate my monthly phishing report using this template. Break down click and report rates by region and role, and flag any group trending worse than last quarter."
Why it works: Your stakeholders keep the format they know. You stop building pivot tables and start working the hot spots.
4. Measure what Cybersecurity Awareness Month actually changed
"Hey Livvy, which behaviors changed the most during October's Cybersecurity Awareness Month, and which campaigns supported that messaging? Compare each behavior to September, show which campaigns and nudges ran alongside it, and tell me which ones we should keep running into Q4."
Why it works: Awareness Month is your biggest push of the year, and most teams only report on who took part. This prompt ties each campaign to a real behavior change. You know what to repeat next October, and your CISO gets proof the month paid off.
Insider Threat & DLP: turn alerts into behavior change
DLP tools create volume. Most violations get closed without anyone changing how they work. These prompts make the intervention automatic.
5. Coach repeat DLP offenders in the moment
"Hey Livvy, create me a cohort of everyone with three or more DLP violations in the last 30 days and group them: personal email, unsanctioned cloud uploads, and removable media. Send each person a nudge explaining the policy and the approved alternative. In 30 days, show me who improved and who didn't."
Why it works: You stop counting violations and start changing behavior, with the before-and-after proof built in.
6. Watch the highest-risk moment in the employee lifecycle
"Hey Livvy, create me a cohort of employees who resigned or entered a notice period in the last two weeks. Show any unusual data movement, access changes, or DLP activity, rank them by risk, and recommend who needs an Insider Threat review."
Why it works: Departing employees are a known risk window. Your team gets a short, ranked list instead of a haystack.
SOC: put the human context next to the alert
Analysts see the endpoint and the identity. What they usually lack is the person behind them. Livvy brings that context into the investigation.
7. Get a human risk brief before you investigate
"Hey Livvy, give me a risk brief on this user before I open the incident. Include phishing history, training completion, recent DLP events, identity risk signals, and anything unusual in the last 30 days. Tell me if this looks like a mistake, a compromised account, or an Insider Threat case."
Why it works: A pivot across four consoles becomes one answer, with a starting hypothesis for triage.
GRC & the Board: prove the program works
Boards don't want completion rates. They want to know if risk is going down and what you did to make that happen. These prompts produce that story on a schedule.
8. Show the board that interventions change behavior
"Hey Livvy, create a monthly board report showing the trend in DLP violations by behavior. Show the interventions we ran each month and how each behavior changed afterward. Keep it to one page with a short executive summary."
Why it works: It ties action to outcome. Not "we ran training," but "we intervened here, and this behavior dropped." That's the story that protects your budget.
9. Build audit evidence before the auditor asks
"Hey Livvy, build an audit evidence package for our human risk controls. Map training completion, phishing results, policy acknowledgments, and remediation to NIST CSF and ISO 27001. Flag any control where our evidence is incomplete."
Why it works: Weeks of screenshots and exports become one request, and you find the gaps before the audit, not during it.
10. Give your CISO a quarterly human risk scorecard
"Hey Livvy, prepare a quarterly human risk scorecard for our CISO. Show the overall risk trend, the top five risky behaviors, which departments improved or declined, and incidents we believe early intervention prevented. Also include incident count by category to show decrease in SOC load. End with three recommendations for next quarter."
Why it works: Your CISO gets a business review ready for the executive team, with your recommendations already attached.
Your answer to the CISO
With a few of these prompts running, you don't have to wait for the question. Bring the answer to your CISO first, with use cases ready for the board. Here are two ways to frame it.
The efficiency answer
"I use Livvy as an always-on analyst, trained on our culture and our voice. It runs our annual training and phishing program end to end, including reminders, manager escalations, and enrolling clickers into coaching. It coaches repeat DLP offenders and shows me who changed. It briefs the SOC on the human side of every investigation. And it builds our board and audit reporting on a schedule. That gives me back time every week, and I spend it on the people and behaviors that actually drive our risk."
The risk reduction answer
"We use AI to find and fix human risk faster than a team our size could on its own. Livvy watches behavior across phishing, identity, endpoint, and data every day. When someone's risk goes up, it steps in right away with coaching, a manager note, or a handoff to the SOC based on how we've trained it. Then it measures whether the behavior changed. So when the board asks what we're doing with AI, we can show them the incidents we've reduced and the underlying behaviors improving, not just the tasks we've automated."
The first answer speaks to bandwidth. The second speaks to outcomes. Use whichever fits the room, or both.
Either way, bring numbers. Before you roll out these prompts, note how many hours a month each task takes your team today, then check again after 90 days. Hours returned and behaviors improved beat "we're experimenting with AI" every time.
It's also your best answer to the headcount question. You're not asking for another analyst. You're showing what you already get from the one you have.
Start with one prompt this week
You don't need all ten on day one. Pick the task that eats the most of your week, brief Livvy like your best analyst, and let it run. Then add the next one.
The gap between a basic answer and an always-on analyst is the prompt. The board is asking your CISO. Be the one with the answer.
Want help building prompts for your program? Reach out to your Living Security customer success team, or request a demo to see Livvy in action.
