Page 108 - CyberSecurityEssentialsEnglish

Source: Mata v. Avianca, Inc., Opinion and Order on Sanctions [1].

◆ Key idea: no AI tool is best at everything.

A professional choice is a match among the task, the knowledge, the medium, the risks,
the privacy requirements, the cost, and the method of verification. That match is then
tested on real cases.

Chapter Objectives
▪ Distinguish the model from the application, the platform, the interface, the tool, the
agent, and the workflow.
▪ Classify a task as generation, retrieval, extraction, computation, or execution, and define

the impact of failure.
▪ Explain the effect of probabilistic generation, temperature, top-p, top-k, and the random
seed on the variety of results.

▪ Diagnose the cause of a weak output and choose the right intervention: prompting,
context, retrieval, a tool, a structured output, fine-tuning, or model routing.

▪ Read model cards, system cards, datasheets, and benchmark results critically.
▪ Build a local reference evaluation set that covers Arabic, edge cases, and repeated runs.
▪ Apply the seven-factor matching framework with mandatory gates and weighted criteria.

▪ Document a tool selection decision and set a date to re-evaluate it.

3.1 Begin with the Task, Not the Name of the Tool

◆ Key idea: turn the need into a verb, an output, and evidence of success.
Before opening any product, ask the right question. It is not “what is the best tool?” but
“what do I want to carry out, what is the most dangerous failure, and how will I verify the
result?”

Turn a General Wish into a Testable Task
The sentence “I want to use AI at work” is so broad that it permits neither the choice of a
tool nor the measurement of success. Choosing begins with a specific verb: I want three
alternative campaign headlines; I want to find a rule inside a regulation and cite the page; I

want to extract fields from a hundred invoices; I want to compute indicators from a data file;
or I want to update a record in a system after human approval.

Do not stop at describing the subject. Define the input, the output, the user, and the
deadline. “Analyze the complaints” may mean summarizing them, classifying them,
extracting their causes, computing their proportions, or sending alerts. Each reading leads
to a different system and to different risks.

107