How to Effectively Use AI

Untrained Users Using AI—A Growing Problem

As AI adoption continues, we in security have gotten good at telling people how not to use AI, why they shouldn’t share sensitive data with AI, the importance of verifying AI output due to concerns with hallucinations and inaccuracies, and why they shouldn’t use random consumer grade technology for business processes.

It’s time to change that.  Here is a new model to help the average person use AI, using the mnemonic “GIVE PETS TREATS”.  This approach addresses the concerns that arise when an organization believes that AI is the future and just tosses it into the business hoping that AI magic will make people more efficient and effective in their roles. Let’s look at each of the three components of this approach.

DOWNLOAD NOW: Tips for Reducing AI Risk

Take a High-Level Approach—GIVE

Most people, when presented with an AI tool, go straight to asking their question. This can result in superficial and often incorrect answers. We advise people to always check the outputs from AI tools but seldom set them up for success in this area. To help with this, consider the following workflow:

1. Gather your thoughts, if you do not clearly understand the problem, you will be unable to clearly articulate it, meaning the AI has to guess – which isn’t what we want.
2. Investigate existing solutions and do not bring in yet another tool where an already approved tool will work.
3. Visualize your path, determining the context around what you need and convey that context to the AI (using PETS, see below)
4. Execute your AI process, running the AI tool in a deliberate manner (using TREATS, see below)

By taking this approach, you are being intentional in how you use your AI tools, which will result in better results with fewer re-runs. To continue the process, you will need to create your AI context with PETS and then work within that context using TREATS.

READ MORE: AI Governance Tech Problems Without Tech Solutions

Setting Yourself Up for Success With AI—PETS

All AI tools work within a context. To be successful with AI, however, you need to tell the tool what the context is for a particular run. For example, if you want the AI to help you make a presentation, it would be really helpful if you first told the AI how to focus in on your organization, your specific goals, and to run in a specific manner that makes it easier to get what you need. 

This is where PETS comes in. Each of the elements below will be part of the initial prompt that you provide to the AI to make sure it has what it needs to be successful.

1. Purpose – Like humans, AI works better with a purpose. Just pretend it’s a person and describe what sort of person it is.
2. Expectations – This is where you clearly identify what you are expecting the AI to do - Both how it is to “think” about the problem and what you want out of it. I generally tell it to take time to “think” and to output in Markdown format.
3. Transparency – Verifying answers is a lot easier when you give it your transparency requirements up front. Some people may specify metrics here.
4. Steps – By defining each step to take, you can help keep the AI on track, avoiding hallucinations, reducing re-work and improving quality.

DOWNLOAD NOW: AI Acceptable Use Policy Template

Using The AI Tool—TREATS

When it comes to actually using AI, you can optimize using the TREATS method. This approach gives the AI information it needs in a specific order, so it can get clarification as you go along.

1. Train the AI with reference data, such as documents or internet searches.
2. Revise your instructions based on what the AI provides after the initial training, optimizing the upcoming run.
3. Enter your request to perform the initial run. This should be as clear as possible.
4. Analyze the output from the AI run, checking that it meets your needs and lacks hallucinations.
5. Tune the query. AI works best iteratively, so don’t be afraid to re-run it.
6. Stop, if the responses go off the rails. There’s no shame in restarting, adjusting PETS as needed.

Example—Generating a Meeting Agenda With GIVE

In this example, let’s assume that someone is out sick and it’s up to you to create a meeting agenda for an upcoming board meeting, and you only have 30 minutes to do so.

Gather your thoughts—start by understanding the problem. You have limited time, and your board is full of very powerful people. You cannot waste their time, so the agenda has to be relatively complete and succinct.

Investigate existing solutions—you do a bit of research and find that there are no approved solutions for making agendas, but that what you have should work. The online agenda-focused tools seem sketchy, and you don’t have time to go through the approval process anyway.

Visualize your path—the context should involve prior board documents if you have them, as well as any internal documents that you might need to reference during the board meeting.  You’ll do more of this shortly with PETS.

Execute your AI process—by interactively running the tool using the TREATS approach, you will complete the task.

Putting PETS to Work

Here, you will create the prompts you need to set the context.

#PURPOSE
You are an AI assistant, expert in running meetings and working with highly paid, powerful, business leaders. You have 50 years of experience in this area. Your primary role is to analyze reference data and consider the expectations of the meeting attendees based on previously used materials, as well as the future-looking plans—considering the differences between the business-focused board members and the more narrowly focused and technical people presenting to the board members.

#EXPECTATIONS
You are expected to consider the request from multiple angles, considering how it could be misinterpreted and ask for clarification if needed.  Once the request is fully understood, you will take some time to think about implications and generate a response in Markdown format, using parentheticals (like this) to call our specific areas for deeper consideration.

#TRANSPARENCY
If you directly or indirectly use information from the reference data or other data you were trained on, you will denote that using brackets [like this], with links to content where possible. Additionally, you will analyze all claims you make based on commonality—scoring from 1 to 10, with 10 being the most common. All claims with a score of 4 or less will require elaboration.

#STEPS
- Carefully analyze the reference data
- Assess the question directly, as written
- Identify any unstated implications
- Create an audience profile
- Draft an initial response to the question
- Using the profile, revise response
- Review Expectations rules
- Draft final response
- Ask questions, refining as needed

Taking Steps with AI and TREATS

Now, you will execute the process within the AI tool. Start by pasting in the PETS statements from above, then allow the AI to respond. Then work through the TREATS steps.

1. Train the AI with reference data. In this case, you would upload last year’s board presentation so it has an idea what you’re looking for, and other data that you want the board to know, such as risk assessments and pentests, multi-year plans, compliance reports, etc.
2. Revise your base instructions based on what the AI gives you. Answer the questions it asks but then ask it to restate its plan before you tell it go ahead, so you can verify that it will do what you want.
3. Enter your request. I like to restate the AI’s plan, just to be sure it will do what it says it will do.
4. Analyze the output, making sure that the overall response makes sense and aligns with what you need. Verify all claims. Put enough time in to learn from the AI.
5. Tune the query based on what you learned. Iterate as needed. It may take a few runs to get it where you need.
6. Stop the process if things go of the rails. While this approach works well, no approach is perfect. Don’t be afraid to start over – re-working the PETS prompts as needed to keep you on track.

READ MORE: How to Establish GRC Practices for AI

Take our CISO Comp and Budget Survey in less than 10 minutes and receive career defining data and other valuable insights and data sets.

Security staff professionals can also take our  2025 Cybersecurity Staff Compensation and Career Benchmark Survey.

Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.