Cognition ×

Nothing on screen but the lockup. Every word of the open is spoken, so the room is looking at you, not reading ahead.
Because nothing here is written down, the open only exists if you say it. Have the first two sentences memorised cold — not paraphrased on the day.
Do not narrate the logos. The lockup is the whole slide; talking about it wastes the one moment the room is giving you their full attention.
Names/titles confirmed the morning of. Say names correctly or don't say them.

Cognition operates Devin, the first autonomous software engineer.

Ten seconds. Do not linger.

The line is Cognition's own, verbatim from cognition.com. Using the house language is deliberate: in this room it reads as literacy, not as a pitch you wrote.
Assert the category, never argue it. Cognition's own surfaces never explain what an agent is or compare Devin to a copilot — arguing it concedes the category is contested. If someone raises Copilot, that's appendix A1, not this slide.
Say the word autonomous once, clearly, then move on. The room will test it later and you want them testing your definition, not one they filled in themselves.

Three of the world's systemically important banks already build with Devin

Case study available

40,000

developers at Citi, rolling out agentic AI across the org

8-12×

efficiency gain on Nubank's 6M-line migration

70%

of security vulnerabilities auto-remediated at Itaú

Cognition's own selling motion: a named peer and a number, early.

The headline claim is precise, not decorative. Citi, Goldman Sachs and Santander are all on the FSB's global systemically important banks list — the same list Bank of America is on. That is deliberately a stronger statement than "Fortune 100" for this room: it says these are firms inside your regulatory perimeter, not just firms your size. Re-check the FSB list before the meeting — it is republished every November and the claim is only worth making if it is exactly right.
Every logo here is publicly named by Cognition or independently reported. Citi's 40,000-developer rollout is American Banker, not a Cognition claim — say that out loud, it's the strongest citation on the slide.
"Case study available" on Itaú, Nubank and Ramp is a real offer, not decoration. All three are published at devin.ai/customers. If anyone shows interest, send the links the same day — that's the follow-up hook.
Only three of the six carry a number, deliberately. Goldman, Santander and Ramp are named partners without published figures for this shape of work, and inventing one would be the single fastest way to lose this room.
Nubank is the one to go deep on if asked: 6M+ lines, 1,000+ engineers, ~100,000 call sites, dependency chains 70 deep, fanned out across parallel Devins. That is structurally the same problem as the Angular initiative.
Verify all three figures at devin.ai/customers the morning of. Case-study numbers get revised, and a stale stat here costs you the same credibility as a wrong EOL date.

What would each of you like to get out of this?

Ask it. Then stop talking.

Introduce yourself here, spoken, in about twenty seconds. No slide for it. Only the load-bearing part: you spent six years shipping code that ran inside other companies' production systems, and you ran the technical sale and the integration yourself. Then the bridge, in one line: that is the same trust problem Devin has here, running inside someone else's production system where their engineers have to be able to verify what it did. Then ask the question.
The slide is empty on purpose. Nothing to read means the only thing happening in the room is the question, and the silence after it belongs to them.
Deliberately no names and no guesses at what anyone cares about. Guessing on screen is a bet with no upside: right is unremarkable, wrong is presumptuous, and in front of their colleagues it's expensive. Asking gets you the same information and hands them control.
Count to ten in your head before saying anything else. Whoever speaks first tells you who the real decision-maker is. That is worth more than any slide after this one.
Write the answers down visibly, then actually change your emphasis. If someone names something you hadn't planned for, return to it explicitly in the close.
Everything after this is "the how." If an answer here contradicts what you were about to recommend, follow the answer, not the deck.

High urgency projects

Project

Today

Objective

Test coverage

30% covered across 12+ services

Pass the OCC exam

Angular upgrade

Angular 14, shared component library

Upgrade before the EOL deadline

Notification service

On-prem: Java/Spring, IBM MQ, Oracle

Serverless on Lambda, 99.99% held

Their words, their numbers. No recommendation yet.

Nothing on this slide is Cognition's opinion. It is their three objectives read back accurately, with the numbers they gave you. Most vendors cannot do this, and doing it well is worth more here than a recommendation would be.
You have just asked them what they want. Repeating it back before pitching anything is the natural next move, and it gives them a cheap chance to correct you while it is still free to be wrong.
Do not propose a sequence here. You do not yet know their priorities or their internal politics, and a printed running order is something they have to push back on rather than something you can adjust. Ask instead: "which of these is under the most pressure right now?"
If they name one, that is where you go, and the deep-dive slides are ordered by them, not by you. Jump straight to it.
If any objective here is wrong, that is the most valuable thing you learn all meeting. Fix it out loud and carry the correction into the rest of the deck.

“Shifting from proofs of concept… to actual end-to-end process transformation.”

Hari Gopalkrishnan, Chief Technology & Information Officer, Bank of America. CIO Dive, 14 April 2026.

Their words, so let them carry the weight.

Read it once and stop. Do not explain it, do not agree with it out loud, and do not add "which is exactly why we're here". The room knows their own CTIO's position, and narrating it turns a strong slide into flattery.
This is the frame for everything after it. It says the bar for today is not "is this interesting enough to trial", it is "is this ready to run as a programme". You want that bar set by them, not by you.
It commits you. Having put this up, do not close by asking for a proof of concept. If your ask sounds like a POC, someone in the room will hold this slide against it. Whatever you request at the end has to be programme-shaped, with a real owner and written success criteria.
Verify the exact wording against the CIO Dive piece before the meeting. The version in our research has an ellipsis in the middle, which means it may be stitched from a longer passage. If you cannot confirm it verbatim, drop the quotation marks and state it as their published direction instead.
Same interview, useful if governance comes up: "If you overdo it, you stall innovation. If you underdo it, you introduce a lot of risk."

Test coverage

Divider. Two seconds on screen. Say why the demo is this one.

Why this one and not the other two, spoken, in about twenty seconds. The Angular risk lives in their proprietary component library, their SSO/MFA integration and their analytics SDK, none of which is reproducible outside their walls, so a demo would show the easy part and skip what they are worried about. The notification service has no application code migrated yet, so there is nothing to run. Coverage is the only one where the demo is the proof. On the other two you would be demoing a promise.
That is a statement about your preparation, not a ranking of their roadmap. If they want the hour on Angular, go to Angular and the demo waits.
30% overall is the headline number they gave you, but it is not the job. The job is the four paths they named: transaction processing, authentication, PII handling and audit logging, where they say coverage is "significantly lower."
The exam wants edge cases around error handling and data validation. That is their wording, and it is the reason mutation testing is on the next two slides rather than a coverage percentage.
Skip this section entirely if they told you it is not a priority. These three sections are jumpable and independent, in whatever order the room asked for.

Pass the exam, then keep passing it

Phase

Objective

Description

OneGroundwork

Make every service testable

Some services have no framework, no CI job and no mocks. Nothing can be written until they do.

TwoCompliance

Pass the OCC exam

Transaction processing, authentication, PII handling and audit logging: the four paths the examiner asks about.

ThreeDelivery

Keep coverage rising

Coverage ratchets on new code, so tests arrive with the feature rather than a year after it.

The exam is phase two. Phase three is what stops you doing all of this again in three years.

Every phase leaves an asset, not a dependency.

What each phase leaves behind is spoken, not on the slide. One leaves the playbook every later session follows. Two leaves tests that fail when a control breaks. Three leaves a ratchet, so coverage cannot fall back. Say it as the answer to the lock-in question every bank has and almost none of them ask out loud: nothing here stops working when Cognition leaves the room.
The description column is there so nobody has to ask "why those four?" out loud. If anyone does, the answer is that they are the paths the OCC examines and the paths where they told you coverage is lowest. Do not read the column aloud.
Phase three is aimed at the VP. One and two answer the Chief Architect and the Security Engineer. Three is the one that pays the engineering org back: they told you the team has been focused on feature delivery, leaving testing as persistent tech debt. Phase three is where that trade stops being necessary, because the tests arrive with the code rather than after it.
Phase one is their own sentence. They told you some services have no test frameworks, no CI test jobs and no mocking patterns. You cannot write a test into a service that has nowhere to put it, so bootstrapping is genuinely first, and it is also the safest possible place to start: no production code is touched.
Phase one's real output is the playbook. A fleet writing tests without one produces two hundred pull requests in two hundred styles, which is exactly what the Chief Architect is afraid of. Say that to him directly: he reviews and signs one versioned artifact, not two hundred diffs.
Phase two is scoped to the four paths they named, not to a percentage. If the VP asks for a number, the honest one is that the inventory comes out of phase one: a coordinator session counts the units and returns them as structured JSON, and only then does anyone commit to a date against the OCC exam.
Sizing, if it comes up: 4-8 hours of junior-engineer work per unit is Cognition's own published guidance on where Devin performs best. One module, one pull request, and the work is additive, new test files rather than edits to theirs, so parallel sessions cannot collide.
Phase three is the one nobody else offers. Diffblue and an offshore testing vendor both leave you with a number on the day they finish and no mechanism to hold it.

Demo

The third one is the demo. The first two are setup.

Anyone can show a green pipeline. The moment that earns the room is Devin hitting a genuine ambiguity and asking instead of guessing, a human answering in under a minute, and that answer being promoted to shared knowledge so the next module inherits it. Stopwatch that exchange out loud and report the elapsed minutes.
Say the time-box at the start: "thirteen minutes, I stop at [clock time] regardless of where we are." An external, spoken clock makes the cutoff read as discipline rather than as running out of road.
Start from a pipeline that is already green on the untouched code. A red starting point destroys the "your existing safety net" framing before you begin.
If it breaks, do not debug live past thirty seconds. Switch to the recording of the same run from that morning and say so plainly: "let me show you this morning's run rather than debug my network in front of you."
Pre-flight, day of: reset to the known-good tag, confirm CI is green on it, confirm the escalation-triggering ambiguity is still genuinely unresolved, confirm the backup video plays offline. Never narrate a feature that got cut from the build.

The same work, at two regulated institutions

Litera

+40%

Test coverage lifted, regression cycles cut by about 90%, with teams of Devins acting as QE and SRE.

devin.ai/customers/litera

Itaú Unibanco

70%

Of security vulnerabilities auto-remediated, and test coverage roughly doubled, at global-finance scale.

devin.ai/customers/itau

Named customers, published numbers.

Both are public case studies with live links, so anyone in the room can check them afterwards. Offer to send them the same day rather than reading the numbers aloud.
Itaú is the stronger of the two for this room: a regulated bank, across the SDLC. Litera is the closer match to the actual work.
Verify every figure at the source the morning of. Case-study numbers get revised, and a stale stat costs you the same credibility as a wrong EOL date.

Angular 14 to 18 upgrade

Divider. Two seconds on screen.

Their words, their target version. Do not correct the 18 on this slide, it comes up on the next one as a question.
Skip this section entirely if they told you it is not a priority. These three sections are jumpable and independent, in whatever order the room asked for.

Three versions are still supported

Version	Released	End of life	Status
14	2 Jun 2022	18 Nov 2023	End of life	Where the application is today
15	16 Nov 2022	18 May 2024	End of life
16	3 May 2023	8 Nov 2024	End of life
17	8 Nov 2023	15 May 2025	End of life
18	22 May 2024	21 Nov 2025	End of life	The stated target
19	19 Nov 2024	19 May 2026	End of life
20	28 May 2025	28 Nov 2026	Long term support
21	19 Nov 2025	30 Jun 2027	Long term support
22	3 Jun 2026	30 Jun 2028	Active support	The only landing with real headroom

Let the table talk. Do not read it out.

Say one sentence and stop: "this is the support ladder as of this morning." Then let them find 14 and 18 themselves. Anyone in that room can read a table faster than you can narrate one, and the finding lands harder when they reach it rather than when you announce it.
Not a gotcha, and the tone here decides whether the rest of the section works. Assume they know. The framing is: "14 support ended in November 2023, so I am assuming your deadline is a remediation date from your risk function rather than the vendor date. Worth confirming, because it changes what done means." That question is the single most valuable thing you can get out of this slide.
Angular 20 has under four months left. If they push for 20 as a compromise target, that is the number to say out loud: they would arrive at an end of life version again within the same financial year.
If asked why not 21: 21 buys them to June 2027, 22 buys them to June 2028. Same work, one extra step, one extra year. Worth deciding with their architects rather than on this slide.
Verify every date at angular.dev/reference/releases the morning of. Also check the support policy wording itself, not just the dates. Angular's own page now describes annual majors with 24 months of support, while the wider ecosystem still documents six month majors with 18 months. The next slide does not depend on which is true, but the Objectives slide says "roughly every six months" and the Chief Architect may know better than the deck does.

Devin-assisted investigation

DeepWiki indexes the repositories. Every answer comes from your own code.

What we audit

The question

The outcome

Dependencies

Does a build exist that reaches 22

Bump, replace, rewrite or fork. Every package gets an owner and a target step.

Angular APIs

Which calls die, and at which version

Each deprecation mapped to the release that removes it, and migrated ahead of it.

Target version

How far this estate can actually go

It stops being a preference and becomes a finding.

The cheapest thing you will ask them for. Say so.

This slide exists to make the first step easy to say yes to, and the line that does that is no longer on screen, so you have to say it. Static analysis only. No production access, no code changed, read access to two repositories and about a week. It touches nothing, changes nothing and commits them to nothing, and it still produces the plan and the price. That sentence is the difference between a proposal and a purchase, and it is also the first thing that relaxes the Security Engineer.
Dependencies. Every Angular library pins a hard peer dependency to one major of @angular/core, so a version bump is a coordinated bump of the whole ecosystem at once, at every step. The analyzer answers one question per package: does a build exist that reaches 22. Four outcomes follow, and each package gets an owner and the step it has to be ready for.
Two dependency deaths worth having ready as examples. ngcc was removed in Angular 16, so any library last published in the View Engine era stops working there with no workaround at all. And Angular's own @angular/flex-layout was deprecated in October 2022, last released as 15.0.0-beta.42, does not support 16, and was archived in January 2025. Use that one because it is the framework authors abandoning their own package, so it criticises nobody's choices. Do not guess at their libraries.
Angular APIs. The deprecation policy gives roughly one major of warning, so each step surfaces a wave rather than a surprise. Class based route guards gave way to functional guards, HttpClientModule to provideHttpClient, entryComponents went at 15, NgModule declared components need standalone false from 19, and the structural directives were deprecated at 20 for built in control flow. Do not read that list out. The point is that all of it is machine detectable, by Angular's own update schematics, the angular-eslint rules and the compiler's diagnostics.
Hold this separation if the Chief Architect probes. The dependency ceiling and the API ceiling are different constraints and both have to clear. A package can reach 22 and still call something internally that dies at 19.
The third row is the one that matters commercially. Two slides ago the version table raised a question it deliberately did not answer. This is where it gets answered, and the answer comes from their estate rather than from you. If one capped dependency sets the maximum at 18, that is the answer and you say so.
If they ask what it costs, do not quote. Say it is a week of read access and you come back with the ladder, the owners and the number, and then they decide whether there is a programme.

The harness that makes every step provable

Layer

What it catches

How it works

Visual

Styling, every component and state

A permutation gallery generated from your own input types, pixel baselined on 14.

Compile

Breaking changes, before a browser sees them

Type coverage raised first, so untyped seams fail the build rather than the page.

Runtime

Behaviour no static check can prove

Unit and Playwright suites in your CI, then a soak window where alerts open a session.

The baseline has to be captured on 14. It is the one piece that cannot be added later.

Built for step one. Unchanged by step eight.

The framing. The investigation tells you what you are facing. This is what stops it breaking, and unlike the migration it does not get thrown away at the end. It is the reason a version upgrade stops being a programme and becomes a routine change.
Visual, and the detail that proves you have done this before. Angular Material rewrote its DOM and class names at 15 and replaced the theming API at 18, so a DOM snapshot suite is supposed to go red at those two steps. The pixel layer is the one that has to hold: the component looks the same even though its markup changed. Say that before the Chief Architect says it, because he will.
The permutation point is the interesting one. A component library's surface is combinatorial, variant by size by state by theme, and hand-curated snapshots always miss combinations. The matrix is derivable from the components' own Input types, so it can be generated exhaustively rather than curated.
Visual snapshots fail as a programme when they are flaky, and then the team turns them off. Determinism is the whole game. Frozen clock, animations disabled, fonts pinned, rendering in a container rather than on someone's laptop. It is the difference between a harness and noise.
Compile. Every untyped value is a place the compiler cannot warn you, and Angular gets stricter each major while the TypeScript floor rises underneath it. Raising type coverage first converts runtime risk into build time risk, which is the same move as everything else here: make it machine checkable before it ships.
Runtime. Devin writes the Playwright suite and it runs in their CI, not inside a Devin session. Do not imply the agent is the test runner, their pipeline is. If they still have Protractor specs, which anything on 14 probably does, that tool is itself end of life and this work retires it rather than duplicating it.
Expect the Security Engineer on end to end through SSO and MFA. MFA is designed to resist automation, so it needs a test identity provider or seeded sessions. Raising it yourself is worth more than any answer you give afterwards.
The soak half. Devin is MCP compatible with Sentry and Datadog in the marketplace, and the API can open a session programmatically, so an alert can trigger triage against the version step that just shipped. Security will ask what goes into that prompt. The honest answer is that stack traces from a banking application can carry customer identifiers and need scrubbing before they leave, and that belongs in the security review rather than in an answer you improvise in the room.
On cadence, do not promise a flat week per step. The first step carries the Material work and builds this harness, so it is materially longer. The later steps are the ones that go weekly, and the week is for soak rather than for the work.
The closing line is the only reason to start now that is not a sales argument. The baseline is a recording of how the application behaves today on 14. It cannot be reconstructed later, and every week the application changes it gets harder to capture cleanly.
Worth saying out loud once. The test coverage programme and this migration are the same investment. The tests they need for the OCC exam are the tests that make this provable, and that is also why the live demo is on coverage rather than on Angular.

Build the process once, repeat to 22

Steps

What is in them

Description

Steps one to four14 to 18

Every hard problem is here

Material MDC, the ngcc removal, the new build system, Material 3 theming. Four decisions, made once, applied everywhere.

Steps five to eight18 to 22

The same process, less in it

Standalone defaults, built-in control flow, dependency floors. Schematics your team can watch run.

What you keepThe harness

Outlives the upgrade

Built for step one and unchanged by step eight. That is why the later steps are cheap.

Angular 22 is reachable because the cost sits in the first four steps, and those are the four you already scoped.

This is the slide that turns a project into a capability.

The argument in one line: they scoped four version steps and every judgment call in the whole ladder is inside those four. Steps five to eight are the same harness with less in them. So the extra distance to 22 costs calendar, not risk.
Name the four hard ones if the Chief Architect wants them. Angular Material moved to MDC in 15, which changes DOM structure and CSS class names underneath a custom design system. ngcc was removed in 16, so any View Engine library stops working. 17 deletes the legacy Material entry points and the update schematic refuses to run while they are still in use, so that work is not deferrable. 18 replaces the theming API with Material 3 design tokens.
The harness row is the commercial subtext and it should stay understated. A consumer build matrix and a visual diff on the component library are what make every future version a routine change rather than a programme. Let them reach that themselves.
Expect "why not just run ng update." Agree fast that the schematics are the right tool and that Devin should run them rather than replace them. Then the honest answer: ng update moves one major at a time and needs the whole dependency tree satisfiable at each step, and it knows nothing about their design system, their vendored libraries, their build configuration or their downstream consumers. It gets you to compiling. It does not get you to releasable. The gap is the work.
If they ask for a number of steps per week, do not invent one. Say an inventory in week one counts the modules and the consumers, and the estimate comes back with their numbers in it.

Fan-out migrations, already done at scale

FE fundinfo

1,800

Repos covered as engineering capacity scaled across the estate, the same fan-out shape as your component library.

devin.ai/customers/fefundinfo

Mercedes-Benz

8mo → 8d

A 200,000-line modernisation estimate cut to eight days during a four-week pilot.

cognition.com/blog/mercedes-benz-cognition

Named customers, published numbers.

Both are public case studies with live links, so anyone in the room can check them afterwards. Offer to send them the same day rather than reading the numbers aloud.
FE fundinfo is the relevant one: one shared library, many consumer repos. Mercedes is there for scale of legacy, not for Angular.
Verify every figure at the source the morning of. Case-study numbers get revised, and a stale stat costs you the same credibility as a wrong EOL date.

Notification service migration

→

Divider. Two seconds on screen.

The biggest and the most human-led of the three. Set expectations here: this is the one where the plan looks different.
Skip this section entirely if they told you it is not a priority. These three sections are jumpable and independent, in whatever order the room asked for.

Move the system without moving the risk

Phase

Objective

Description

OneDesign

Settle the target and the cutover

Ordering semantics, data residency and failure modes are judgment calls. Your architects decide them before any code moves.

TwoBuild

Adapters, harnesses and load tests

The mechanical surface around that design, fanned out in parallel once the shape is agreed.

ThreeCutover

Prove it on real traffic

Shadow run against production traffic, compare the two outputs, then cut over with a rollback path.

Correctness here shows up at cutover, not in code review. So the plan is built backwards from cutover.

Be honest about which half is human.

Phase one is deliberately theirs, not ours. Your architects own the design; Devin takes the mechanical edges. Saying that plainly is worth more than claiming the whole thing.
This is not a refusal and must not sound like one. If this is their priority, this is where you start.
Ask whether ordering is global or scoped to a partition key before anything else. Partition-scoped is tractable on SQS FIFO. Truly global ordering is an architecture question worth answering before the target platform is committed to, whoever builds it.
Depth to hold in reserve, only if the Chief Architect pushes: RDS Proxy does not support Oracle, error-budget maths against 99.99%, and IBM MQ semantics that do not map cleanly onto SQS.

Known, proposed, and what week one answers

Nothing on this slide is a finding.

Say it out loud, early. Left is their brief, word for word. Right is our proposal. Amber is what nobody can know without reading the code. Mark your own unknowns and the room stops auditing everything else you say.
Point at MessageGroupId = ?. That key decides whether SQS FIFO runs in parallel or one message at a time, and it exists nowhere but in their code. It is the best argument for week one you have.
Audit goes to S3, append-only. Oracle hangs off it, dashed and optional. If they ask why not write to Oracle directly: it puts Lambda concurrency straight onto the database they already cannot scale, and rebuilds the coupling they are migrating to escape.
The legacy path never leaves during the migration. Rollback at any stage is a flag flip, not a deploy.
Hold these back unless pushed. Poison messages on FIFO are a real tradeoff: halt the group and keep ordering, or send to the DLQ and keep availability. Encryption at rest is one line of IaC on the queue, DLQ, dedupe store and log groups, not application work. And if the hot path turns out not to need Oracle, Lambda does not even have to sit inside a VPC.

Same decisions, far less waiting between them

This is the slide that answers "is this just autocomplete".

Lead with the bars, not the swimlanes. The bright blocks are the same width in both rows on purpose. Only the legwork collapses. Most vendor charts shrink everything, which is exactly why nobody believes them.
Step 5 is deliberately human-heavy, and the slide says so. Volunteering where you want humans slower buys more credibility than the other five ratios put together.
The ratios and the bar widths are judgement calls, not measurements. The slide says so. Do not defend them as data. What you can defend: this project is gated today by how fast engineers can type, not by how fast architects can decide.
If they ask which number to hold us to, offer review hours per consumer, falling consumer over consumer. That number proves the model scales. A demo does not.

Core migrations, with the numbers published

Nubank

8-12×

Efficiency gain migrating a 6M-line core monolith, fanned out across parallel Devins. Over 20x cost saving.

devin.ai/customers/nubank

AngelList

5.2×

Faster Redshift to Snowflake migration, a data-platform move with the same cutover-shaped risk.

devin.ai/customers/angellist

Named customers, published numbers.

Both are public case studies with live links, so anyone in the room can check them afterwards. Offer to send them the same day rather than reading the numbers aloud.
Nubank is the flagship and the closest analogue: legacy core, millions of records, humans owning the architecture.
Verify every figure at the source the morning of. Case-study numbers get revised, and a stale stat costs you the same credibility as a wrong EOL date.

Suggested next steps

Programme owner

A single point of accountability

This week

Success criteria

Measurable targets, agreed in writing

Two weeks

Security review

SOC 2 Type II and the VPC deployment model

Two weeks

Executive sign-off

Approval of the agreed criteria

Three weeks

Commercials

Scope, cost and a start date

Four weeks

Questions first. This goes up last.

Take questions first. This goes up once they have run out, never before.
Close it verbally, not on the slide: you come back in three weeks with results measured in their own environment, not a case study from another bank.
A programme ask, not a pilot ask. Their CTIO is on screen six slides earlier saying they are past proofs of concept, so a trial here would undercut your own slide.
The sequence is the argument: criteria are written, then reviewed, then approved, then funded. Nobody is asked to fund something undefined.
"A single point of accountability" is deliberately neutral. If they run this through a steering group, that is their business. What matters is one name you can call between meetings, and you can say exactly that if asked.
Measurable targets means numbers: a coverage figure, an exam-readiness bar, a ceiling on review hours. Offer to draft it for them to edit. Faster than asking them to write it, and it keeps you close to the definition.
Name the Security Engineer when you reach that row. Before anything is touched, not after, and it is thirty minutes rather than a workshop.
If they counter with a free proof of concept, accept it, then hold the owner and the written criteria. Those two are what stop this quietly dying.

Thank you

Cognition ×

Leave it up.

This is what stays on screen through the questions, so it should be the lockup rather than a slide full of content competing with the conversation.
Do not add a new argument here. If something got missed, it goes in the written follow-up the same day.