Crafting Your Demo's Story: From Problem to Insight

Hello! Welcome back to the final module of your course on AI Security.

In our last lesson, we took a critical first step in preparing your professional demo by defining your target audience personas—the CISO and the Head of Engineering—and crafting the key takeaway messages tailored to each. This groundwork is essential for ensuring your presentation resonates and achieves its goal.

Today, we'll build directly on that foundation. This lesson focuses on structuring your entire presentation into a compelling narrative. You will learn how to storyboard the demo's narrative arc and script the talking points for each phase: the problem, the threat landscape, the attacks, the defenses, and the monitoring insights. By the end of this lesson, you will have a complete blueprint for your demo.

---

1. The Power of a Narrative: From Technical Demo to Compelling Story

Your goal is not just to present a sequence of technical actions but to tell a story that persuades your audience. A strong narrative arc transforms a dry demonstration into a memorable and impactful experience. In your work as an SRE and automation specialist, you know that an architecture diagram is crucial for planning a system's components before building. A storyboard serves the same purpose for a presentation: it allows you to architect the flow of information for maximum clarity and persuasive power.

Let's begin by understanding a classic framework for structuring professional presentations, used by top consulting firms to create clear and engaging narratives.

The SCQA framework gives your demo a logical, problem-oriented structure that executives are accustomed to. Let's map it directly to your AI security demo:

• Situation: Generative AI is a transformative technology that we are adopting to accelerate innovation and improve business efficiency.
• Complication: However, this new technology introduces a new class of critical vulnerabilities—specifically prompt injection (OWASP LLM01)—that our existing security tools are blind to.
• Question: How can we harness the power of GenAI without exposing our business to unacceptable risks like data theft, financial fraud, and compliance violations?
• Answer: By implementing a proactive, defense-in-depth architecture that integrates input validation, runtime guardrails, output filtering, and continuous monitoring.

This SCQA structure forms the introduction and high-level summary of your presentation. The rest of your demo will be dedicated to proving your Answer.

---

2. Storyboarding Your Demo's 5-Act Structure

Now, we'll break down your "Answer" into a five-act narrative structure. This structure will guide your audience from understanding the abstract threat to seeing your concrete solution in action.

Your demo will follow these five phases:

1. The Problem & Threat Landscape (The "Why")
2. The Attack Demo (The "Before" State)
3. The Defense Strategy (The "How")
4. The Defended Demo (The "After" State)
5. Monitoring & Insights (The "Payoff")

Let's script the key talking points for each phase.

Phase 1: The Problem & Threat Landscape

This is your inciting incident. You need to make the threat feel real and urgent. Start by setting a relatable business scene.

Your Talking Points:

• (Situation): "Our company is investing in GenAI to build intelligent assistants, automate workflows, and create better customer experiences."
• (Complication): "But this opens a new front in security. The OWASP Top 10 for LLMs lists Prompt Injection as the number one threat. It allows an attacker to hijack our AI, turning it from an asset into a liability."
• (Business Impact): "This isn't a theoretical risk. It can lead to data exfiltration of customer PII, manipulation of business decisions leading to financial loss, or reputational damage from the AI generating harmful content."

Phase 2: The Attack Demo (The "Before" State)

This is the rising action. Here, you'll show, not just tell. Demonstrate 2-3 of your most impactful attacks against the vulnerable application. Good choices would be:

• Goal Hijacking: Visually compelling and has clear business implications.
• Prompt Leaking: A straightforward confidentiality breach.
• Indirect RAG Poisoning: The most sophisticated attack, showing how the threat can be hidden in your own data.

Your Talking Points (as you demo each attack):

• For the CISO: "Here, you see the attacker has poisoned a document in our knowledge base. When the chatbot uses this document to answer a customer query, the hidden instruction causes it to leak proprietary API keys. This is a critical data breach that bypasses traditional network security."
• For the Head of Engineering: "Watch as I inject a command into the user prompt. Because the model's context window doesn't distinguish between trusted instructions and untrusted input, it obeys my command and reveals its underlying system prompt. This exposes our core IP and makes further attacks easier."

Phase 3: The Defense Strategy

This is the turning point of your story. You've established the danger; now you introduce the solution. Present your defense-in-depth strategy using the architecture diagrams you've created.

Your Talking Points:

• "No single defense is a silver bullet. Our strategy is defense-in-depth, with three layers of protection."
• Layer 1: Input Sanitization. "This is our first line of defense, acting as a basic firewall to block known, simple attack patterns before they ever reach the model."
• Layer 2: Runtime Guardrails. "Using Guardrails AI, we establish programmable policies that the LLM's inputs and outputs must follow. This is a more sophisticated check that understands the structure and topic of the conversation, not just string patterns."
• Layer 3: Output Filtering. "Our final check. Before a response is sent to the user, we scan it one last time to ensure no sensitive information has been leaked and that the model's response is consistent with its intended purpose."

Phase 4: The Defended Demo (The "After" State)

This is the climax and resolution. Re-run the exact same attacks from Phase 2, but this time against your fully defended application.

Your Talking Points (as each attack is blocked):

• "Remember the prompt leaking attack? Watch. The input sanitizer immediately flags and blocks the malicious prompt. The request never even makes it to the LLM."
• "Now for the more complex RAG poisoning attack. The input filter misses it, but our Guardrails AI output guard detects that the model is attempting to generate content unrelated to its task—in this case, leaking an API key—and blocks the response, replacing it with a safe fallback. The user sees a helpful message, and the attack is neutralized."
• "This demonstrates why a layered approach is critical. A sophisticated attack that bypasses one layer is caught by the next."

Phase 5: Monitoring & Insights (The "Payoff")

This is your "new status quo." The immediate threat is over, but the story isn't. Now you show how you maintain security over time. Switch to your Langfuse dashboard.

Your Talking Points:

• For the CISO: "A successful defense isn't silent. Here in Langfuse, we have a complete audit trail. We can see every blocked attack, which defense layer caught it, and the full context. This dashboard provides the evidence we need for compliance and demonstrates the ROI of our security controls."
• For the Head of Engineering: "For the engineering team, these traces are invaluable for incident response and debugging. We can see the exact payload, the model's internal reasoning, and where the defense was triggered. This allows us to quickly analyze new attack patterns and fine-tune our guardrails without slowing down development."

---

3. Avoiding Common Pitfalls

As you script your talking points, it's crucial to stay focused on storytelling and avoid common traps.

Additionally, the article from Brixon Group on B2B storyboarding highlights a key mistake: being too product-oriented instead of customer-centric. In your case, don't focus on what Guardrails AI is; focus on what problem it solves for the audience.

---

4. Your Turn: Create Your Storyboard Outline

Now, it's time to create your own storyboard. Use the 5-phase structure we've discussed. Create a document or table with the following columns. This will be the master script for your entire demo.

Phase	Key Objective for this Phase	Talking Points for CISO	Talking Points for Head of Eng	Visuals & Demo Actions
1. Problem & Threat	Establish the business urgency and relevance of prompt injection.	e.g., "Risk to reputation and compliance..."	e.g., "Blocks innovation, introduces unpredictable behavior..."	Show slide with OWASP LLM01. Show slide with high-level architecture.
2. Attack Demo ("Before")	Demonstrate the tangible impact of an attack on a vulnerable system.	e.g., "This represents a critical data breach..."	e.g., "This shows a fundamental flaw in the application logic..."	Live demo: Run goal-hijacking and RAG poisoning attacks on the vulnerable FastAPI endpoint.
3. Defense Strategy	Explain the 'how' of your solution in a clear, logical way.	e.g., "Our layered controls provide comprehensive risk mitigation..."	e.g., "This is a scalable security pattern for all GenAI apps..."	Show your defense-in-depth architecture diagram. Briefly explain each component.
4. Defended Demo ("After")	Prove the effectiveness of your solution.	e.g., "The control has successfully neutralized the threat..."	e.g., "Notice how the sanitizer caught this, but the guardrail was needed for the other..."	Live demo: Re-run the same attacks against the defended endpoint. Show the blocks.
5. Monitoring & Insights	Show how the solution provides long-term value and visibility.	e.g., "This provides the audit trail we need for compliance..."	e.g., "This trace gives us the data to debug and improve the model..."	Live demo: Show the Langfuse dashboard with traces of the blocked attacks.

Take about 20 minutes to fill out this table with your own specific talking points for the attacks you've built. This will become the definitive guide for your presentation.

---

Conclusion

In this lesson, you've transformed your collection of technical components into a coherent and persuasive narrative. By structuring your demo around a classic storytelling arc, you ensure your audience stays engaged and understands not just what you did, but why it is critically important.

Key Takeaways:

• Use the SCQA Framework: Structure your introduction as Situation, Complication, Question, Answer to immediately align with a business audience.
• Follow the 5-Act Narrative: Guide your audience through the Problem, Attack, Defense, Resolution, and Payoff to create a memorable story.
• Show, Don't Just Tell: Live demonstrations of the "before" and "after" states provide undeniable proof of both the risk and your solution's effectiveness.
• Speak Their Language: Continuously tailor your talking points to the specific priorities of your audience, whether it's the CISO's focus on risk or the Head of Engineering's focus on reliability.

Next Up:

With your narrative storyboard complete, the next step is to prepare for the inevitable Q&A. In our next lesson, we will draft concise answers to common business-focused questions that a CISO or Head of Engineering is likely to ask, ensuring you're prepared to handle any challenge with confidence.