Page 229 - CyberSecurityEssentialsEnglish

✕ Common misconception Correction

When that person is absent, the method
Storing the best prompt inside a personal disappears and the team starts

conversation or in one employee’s experimenting again. Move what works
memory. into a shared, versioned asset with an

owner.

5.11.1 Measurement and Continuous Improvement
A workflow cannot be improved if evaluation is limited to impression. We need a baseline

before the change: how long did it take? How often was it redone? What was the error rate?
How many people took part? Then we compare after AI is introduced. Drafting time may fall
while review time rises, which is why the whole cycle must be measured.

Cycle time is the time from the trigger to delivery. Touch time is the time a person actually

works on the case. The rework rate is the proportion of cases that returned to an earlier
step. First-pass yield is the proportion of cases that passed review the first time. The cost
per case, user satisfaction, and field accuracy can be added.

A net productivity gain is not equal to the time saved in writing. The whole cycle must be

computed before and after AI is introduced, because some solutions make the draft faster
and then shift the burden to review and correction. A simple formula helps: net gain equals

the previous process time minus the sum of the new workflow time, the review time, and
the rework time.

Structured evaluations help test outputs against a fixed set of cases and criteria, particularly
because models are not deterministic and their behavior may change between versions [13].

A complex technical platform is not always needed; you can begin with twenty real cases
and a fixed human scoring table, then widen the testing once the process is stable.

Process mining uses event logs to reveal actual paths, bottlenecks, and rework, while task
mining focuses on the detailed activities a user performs inside a task on their own device.

Process mining does not work well without a structured event log; a table showing only the
final status is not enough to understand the route a case took over time [7][8].

228