Deploying large language models in security operations exposes a hard truth. A model that answers correctly once may answer differently the next time. Identical alerts can be assigned different levels of severities. A phishing sample can be called malicious in one run and suspicious in another. Hence, remediation steps can shift in that order between sessions. In a domain built on repeatable playbooks, that variability can undermine trust.

To this end, CyberNEMO explored strict, versioned personas in its decision support design. Instead of one general-purpose assistant, specialized roles such as a security analyst, Threat Intelligence Correlator, and a Compliance Reviewer were used. Additionally, madate fields, explicit exclusions, fixed decision rubric, output contracts with a fixed template and fallback rules were also defined.

The outcome led to more realistic and stable model outputs across repeated runs on the benchmark set. Outputs became noticeably more consistent in structure, severity grading, and in terminology. The preliminary results in CyberNemo show that disciplined prompt design is one of the most cost-effective first steps toward trustworthy LLM security tooling.