“You don't actually have to take six months”

Who Steven is

Steven Lilly, Founder, LillyCyber

Steven did not come to these sessions as a beginner. He spent 23 years in the legal sector, most recently as Director of IT and Compliance at a UK law firm, with executive responsibility for IT operations, information security, compliance, quality management, enterprise risk and supplier assurance. His public profile credits him with leading the firm's implementation and certification of ISO 27001, ISO 9001 and ISO 20000, leading its Lexcel implementation and maintenance, achieving Cyber Essentials Plus and acting as its data protection lead. LillyCyber was his way of offering that experience to other firms: information security, governance, risk and compliance consultancy for law firms and other regulated businesses.

The expertise was already there. What he had not yet done, by his own account, was use AI much beyond Copilot.

May: a new business and a specialist's knowledge

At the start of May, Steven thought LillyCyber had been incorporated that week. He had a logo and early ideas about what to offer. He and Luke met on Teams to work through the business, starting with how Steven was working.

Luke: What AI tools are you currently using?

Steven: I only use Copilot at the moment, so I'm not familiar with any other one, although I did [try] ChatGPT on my phone the other day.

Luke's first piece of advice was to get a Claude subscription and have a conversation with it about what he wanted to achieve. He offered to work through the prompting with Steven in a session together. Steven had already met a practical problem: keeping hold of the work he had built up.

Luke: How does it work in terms of you being able to get the data from the chats you already have?

Steven: Some of it, I'm just copying and pasting it, and some of it, if I take the link... I'm sharing that to my own email address, but when you click on it, it doesn't have all the previous stuff. So when you open it, it actually produces something different.

Luke's answer was structure: keep a project's working context in files the AI reads every time, and turn the steps that work into something repeatable. He also described a habit he calls reverse prompting, asking the AI what it needs from you. “What am I not asking is a good question to ask.” Later in the call he turned to the business itself.

Luke: What's your next step, Steven, for your business? Because we've not talked about what you're actually going to do for the firms.

Steven: At the moment, I'm working with one firm just now to take them through their ISO 27001. I'd like to do more of that, but also looking at the wider information security side of things as well... whether it be finding where the risks are, or examining the governance piece, or policies and procedures, or helping them with getting their 27001 certification... At the moment, it's like a consultancy that I want to provide.

Luke: ...Do you want to target law firms?

Steven: It's something I've not really thought about, and given my legal knowledge, it makes more sense to target legal firms.

A colleague in the sector had told him the same. Luke agreed: go deep into one sector first, then widen. Near the end of the call Steven said what he had come for.

Steven: This is what I wanted to get out of today... actually seeing where I could actually embrace AI rather than being afraid of it and not using it, because... if I can get into Claude and using it in the right way, it's going to help me build my business a lot faster...

Two weeks later: building the foundation, live

The second session was hands-on. Steven shared his screen and Luke talked him through it.

Luke: Have you had any hands-on with Claude?

Steven: I have not really. I've got it signed up and I've got the Pro all set up, and that's literally all I've done as yet... so excited to get into it and get going, but I am set up.

Luke had one of his own AI assistants draft ten questions about the business. Steven answered them live, and his answers became the instructions for his first Claude project.

Luke: What do you want it to be known for in one sentence?

Steven: It's got to be information security, governance, risk and compliance consultancy.

Luke suggested adding “in the legal sector”. The questions went on through services, pricing, the frameworks Claude should understand and the tone the business should take.

Luke: In 90 days, what would make Claude feel genuinely valuable to you?

Steven: ...I've got a proper business model, I've got a service and something that is not only ready to take to market, but that I'm actually monetising. If I'm monetising it within 90 days, that's where I want to be.

Luke named what they were doing. “They call this reverse prompting. To get the output you want, ask it what it needs to know, and then you answer the questions...” The draft instructions came back, built from Steven's answers.

Luke: ...It's summarised it quite well. Are you happy with that?

Steven: Mind-blowingly well. It's like, get out of my head, what are you doing in there?

Not all of it was smooth. A few minutes later Steven stopped to ask what he was being asked to build.

Steven: I'm a bit confused by this, and the term markdowns doesn't mean anything to me.

Luke explained that a markdown is a plain text file an AI can read cheaply, so a project's key facts stay in view. The instructions went into the wrong place at first and had to be moved, and in that session any files had to be saved into the project by hand. The session ran past an hour and a half and did not reach everything on the agenda. Luke called the foundation the biggest win of the day, and Steven agreed.

Steven: It's a massive win. Yeah, it's a massive win.

Late May: a live client project

Eleven days later, on another call, Luke checked in.

Luke: So, how have you been getting on then, Steven?... You've been playing with Claude, which is great, [hitting] usage limits, I'd imagine.

Steven: Yeah, [I hit] my usage limits quite frequently on that. But yeah, honestly, it's pretty eye-opening and amazing... The other client that I'm working with... the scope of my whole project for them is completely changed. It's a full sort of gap analysis, recertification, stage one, stage two, and all the rest. But Claude is helping me project plan it, budget, and everything like that, so it's been quite revolutionary for me.

The proposal was due to go to the client the following week.

October: looking back

In October Luke and Steven caught up on Teams and looked back over the work.

Steven: Starting up a business from nothing into being ready to actually go to market within a month and a half, two months, that's an absolute game changer... The insight that you gave me, particularly on the Claude side, was the real game changer, and that really opened my eyes to what could actually be achieved... You don't actually have to take six months to do all these things. They can be done really, really fast.

Luke: ...I know you were using Copilot originally, weren't you?

Steven: I used Copilot and I was just sort of feeling around the edges... particularly with the image building and brand identity side of things... You'd get something you really like and then you would go, oh, can you make this little change? And it would make the change, but the whole thing would look totally different.

Luke: And then you also mentioned some of the project work it helped you do with... We got a project set up in Claude...

Steven: That's right, yes. I set up a project with one of the businesses I was working with, and it totally helped me produce the proposal documents pretty instantly... A gap analysis for a company: that could be a couple of weeks to a month's work easily. I was able to do that using Claude really quickly, feeding in the information that I had and finding the gaps, and producing a proposal, costing it. I didn't know anything about the costing of it, and actually getting to grips with... my worth, if you like: what kind of charge.

Pricing had come up in their first session, when Luke urged him to charge market rates rather than undercharge. The work reached how the business presented itself too. Steven described being able to “quite quickly spin up a business identity with the logos and the capabilities statements and all the rest, like go-to-market stuff.”

Luke: There's a LinkedIn as well...

Steven: Yeah, the LinkedIn side of things... all that content creator stuff and all the rest. It was quite eye-opening how quickly it could be done, and quite how professional it sounded.

Then Steven named what he would take from the work.

Steven: I think that's probably one of the key things and the key takeaways that I will get from our time and what you did for me. It's really drilling down on the prompts and asking the right things, putting the right guardrails in, getting the tone right, all those things that you taught me... really made a difference.

Luke: I feel like people... undervalue the capability of AI because of that piece...

Steven: Absolutely. They're too general with their prompts and don't give it enough information. I even do that now: if I'm using ChatGPT to find out something about a health thing or a food thing or whatever it is, I'll give it the background and then ask the question, and then say, are there any questions you need to ask from me?

Five months on, he was still giving the AI the background first, and still inviting it to ask him what it needed.