CyberAI Field Guide

1. Interviewing for Impact: A Field Guide for Student Consultants

In a CyberAI Clinic, technical expertise is only half the equation. You can deploy the sharpest vulnerability scanners or evaluate the most sophisticated Large Language Model (LLM) architectures, but if you don't understand the human, organizational, and operational realities of your client, your technical recommendations will end up gathering dust on a shelf.

Interviewing for Impact is the practice of moving beyond rigid, checklist-driven audits to conduct empathetic, context-aware discovery sessions. It transforms client interviews from administrative interrogations into collaborative, trust-building strategic dialogues.

1.1 The Mindset Shift: Auditor vs. Impact Consultant

To conduct impactful interviews, you must pivot from an auditor mindset to a clinic consultant mindset.

💡 Core Clinic Insight: Organizations rarely fail to implement security or AI safety because they lack awareness—they fail because security controls conflict with their core mission, timeline pressure, or budget limits.

1.2 The 3-Phase Framework for Impactful Interviews

1.3 Rewording Questions for Impact: A Cheat Sheet

When preparing your interview guide, use this reframing guide to convert closed technical questions into impact-driven prompts:

• Cybersecurity:
  • ❌ Auditor: "Do you enforce multi-factor authentication (MFA) across all staff accounts?"
  • ✅ Impact Consultant: "Walk us through how your team logs into their daily software tools—where do friction points or login headaches usually happen?"
• AI Governance:
  • ❌ Auditor: "Does your organization use Generative AI tools?"
  • ✅ Impact Consultant: "When workload is heavy, what informal AI assistants or online tools do team members turn to to draft documents or automate repetitive tasks?"

2. Qualitative Interview Moderating: A Field Guide for Student Consultants

📌 Credit & Attribution: This section is adapted for student consulting teams based on the foundational principles established in Meta Research's article, Qualitative Interview Moderating Phrase Toolkit.

As a student consultant, qualitative interviews—whether with executives, technical staff, or frontline end-users—are your primary channel for gathering authentic field data. However, conducting a discovery interview isn't just about reading questions off a script; it's about moderation.

Moderation is the art of steering the conversation, digging past surface-level assumptions, managing time, and remaining completely neutral—all while keeping your participant comfortable.

2.1 Setting the Stage: Building Rapport & Permission

When interviewing experienced industry professionals, you may encounter a perceived authority gap. Bridge this immediately by establishing clear roles: they are the subject-matter experts, and you are the neutral researchers.

• To lower their guard: "There are no wrong answers today. We aren't testing you, and we don't work directly for internal management, so please feel free to be completely candid."
• To establish the mindset: "We’re here to understand how things work in reality, not just how they’re supposed to work on paper."
• To grant permission to pass: "If I ask a question that’s outside your scope or sensitive, just let me know and we’ll move right along."

2.2 Probing: Digging Past Surface Answers

Participants often default to buzzwords or high-level generalizations (e.g., "Communication is bad" or "The interface is confusing"). Your job is to extract concrete behavior without asking leading questions.

• The Replay Probe: "Take me back to yesterday morning when you ran into that roadblock—what was your very first step?"
• The Contrast Probe: "How does completing [Task A] compare to how you handle [Task B]?"
• The Emotion Anchor: "You mentioned that process felt frustrating—what specifically made it frustrating?"

2.3 Steering: Managing Time & Tangents

Consulting interviews run on strict schedules. When an executive goes on a long tangent, regain control politely without dismissing their input.

• The Gentle Pivot: "That context around [Tangent Topic] is super helpful. I want to make sure we respect your calendar today—may I pause us here and loop back to [Original Topic]?"
• The Parking Lot: "I want to explore that further, but I want to make sure we cover our core topic first. Let me write [Tangent Topic] down so we can revisit it at the end if time permits."
• The Speed Check: "We have about 15 minutes left and three key areas I’d love your perspective on. I might nudge us along a bit faster for this next section."

2.4 Clarifying: Validating Without Influencing

Always avoid feeding your consulting hypotheses directly to the participant. Echo their points back to confirm accuracy without shaping their response.

• Echo & Confirm: "I want to make sure I capture this accurately for our findings: You're saying that [Summary]—did I capture that correctly?"
• Disentangling Acronyms: "You mentioned [Internal Term]—how would you explain what that means to someone joining the team on day one?"
• Testing Extremes: "Is that something that happens on every project, or was that specific to this particular vendor?"

2.5 Navigating Silence & Awkward Moments

Silence feels uncomfortable, but in qualitative research, silence is often when the deepest reflection occurs.

• Embrace the 5-Second Rule: After a participant finishes speaking, count silently to five before jumping in. They will frequently expand on their answer.
• If They Get Stuck: "Take all the time you need—there's no rush on this one."
• If They Give One-Word Answers: "Tell me a bit more about the thinking behind that."
• If They Ask for Your Opinion: "As consultants, we’re keeping our perspective neutral for now so we don't bias the research, but I’d love to hear what you think first."

2.6 The Golden Wrap-Up Questions

Conclude every interview session with open-ended probes to unlock unscripted insights:

• The Magic Wand Question: "If you had a magic wand and could change one single thing about this workflow tomorrow, what would it be?"
• The Blindspot Check: "What is one question I didn't ask today that you think I should have asked?"
• The Network Bridge: "Who else on your team has a unique or differing perspective on this that we should speak with?"

2.7 Quick Reference Moderator Cheat Sheet

3. Demystifying Algorithmic Dependencies: A CyberAI Clinic Field Guide

When a client tells you, "We built an internal AI customer support tool," it is easy to imagine a single, self-contained box. The reality is almost always a complex web. Modern AI and cybersecurity tools depend on open-source libraries, cloud-hosted foundation models, vector databases, and third-party APIs.

3.1 The Anatomy of an Algorithmic Dependency

An algorithmic dependency exists whenever a client’s technology relies on an external algorithm, model, service, or dataset to make decisions, transform data, or execute security functions.

3.2 Algorithmic and API Dependency Risk Framework

Table 1. Algorithmic and API Dependency Risk Taxonomy.

4. Problem Diagnosis and Reframing: A Field Guide

When a client walks into a CyberAI Clinic project, they rarely hand you the real problem. Instead, they hand you either a symptom or a premature solution. Problem Diagnosis and Reframing is the art of looking past surface-level requests to uncover root technical and human vulnerabilities.

4.1 The Iceberg Model of Problem Diagnosis

Stated Request (Above Water): "Build an AI Security Chatbot"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Underlying Root Causes (Below Water): Unstructured Data & Noise • Fragile Access Controls • Workflow Bottlenecks • Governance Gaps

4.2 Diagnostic Matrix for Student Teams

5. How to Inventory Cybersecurity and AI Assets

Before an organization can assess risks, enforce security policies, or ensure regulatory compliance, it must answer a foundational question: What assets do we actually own and run?

5.1 Categorizing Cybersecurity vs. AI Assets

5.2 Real-World Standards & Frameworks

• NIST Cybersecurity Framework 2.0: A foundational guidance framework providing standards, guidelines, and best practices to manage and reduce cybersecurity risks across all types of organizations.
• NIST AI RMF 1.0: A voluntary risk management framework designed to help organizations map, measure, manage, and govern risks associated with artificial intelligence systems throughout their lifecycle.
• ISO/IEC 27001: An international standard specifying the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
• ISO/IEC 42001: An international standard for establishing, implementing, and maintaining an AI governance structure, including AI asset management protocols.
• SOC 2: An auditing framework developed by the AICPA that assesses a service provider's internal controls based on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
• STRIDE: A threat modeling framework used to systematically identify potential security vulnerabilities across six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
• MITRE ATT&CK: A globally accessible, open-source knowledge base detailing real-world cyber adversary tactics, techniques, and procedures (TTPs) to help teams model threats and test security controls.
• MIT AI Risk Taxonomy: A comprehensive classification system and repository that categorizes potential AI-related harms, failure modes, and societal risks by domain, intent, and timing.
• CIS Controls: A prioritized set of 18 actionable, high-impact cybersecurity safeguards published by the Center for Internet Security to help organizations defend against common cyber threats.

6. Technical Threat Modeling Meets Socio-Technical Risk Identification

Traditional threat modeling answers a critical question: "How could a malicious actor break our system?" In a CyberAI Clinic environment, algorithms interact with human workflows, organizational incentives, and historical biases. Socio-technical risk identification expands traditional threat modeling to bridge software security with human impact.

6.1 The Integrated 4-Step Threat Modeling Workflow

6.2 STRIDE Meets Socio-Technical Risk