EPB Bullet Examples for Cyber Airmen: Translating Technical Work

Senior Airman Park has been working defensive cyber ops for eight months. She identified a lateral-movement vector that could have exposed 340 endpoints, wrote the remediation playbook, and trained her entire shop on the new procedure. Her EPB is due in two weeks.

What she has written so far: "Conducted cybersecurity operations to ensure network integrity and availability."

That one sentence is how good work gets buried.

Cyber careers have an evaluation problem. The value you create is often invisible — you stopped the breach from happening, and nothing happening is hard to count. The technical vocabulary that matters in your world (MTTR, CVE severity scores, SCCM patch compliance, SIEM alert fidelity) doesn't map cleanly to Air Force evaluation language. And a significant slice of the work is classified enough that "details" can't always make it onto an unclassified EPB.

This guide is written for 1B4, 3D0X, and 3D1X Airmen — and anyone else whose duty title contains the words "cyber," "network," or "systems." Here's how to translate what you actually did into EPB language that earns the strat it deserves.

If you want a broader overview of each EPB section and what raters look for, start with our Air Force EPB performance area walkthrough, then come back here for the cyber-specific examples.

Why cyber bullets go flat

The pattern is nearly universal. Cyber Airmen write about activities instead of outcomes.

"Monitored network traffic" instead of "caught and isolated 3 unauthorized access attempts on SIPR enclave; prevented potential exfil of 340 users' cached credentials."

"Completed all required training" instead of "earned CCNA and CompTIA Security+ within 90 days of assignment, both first-time pass, 3 months ahead of shop average."

"Responded to cybersecurity incidents" instead of "led 3-Airman incident response team on 11-hour SIEM triage; traced 4,000 false-positive alerts/week to misconfigured firewall rule, suppressed rule and freed NOC 18 hrs/wk — capacity redirected to active threat-hunting."

The fix is always the same: push past the activity and write the outcome. Then push past the outcome and write the impact on something your rater actually cares about — mission availability, people trained, money saved, time recovered. If you're not sure how to find those numbers, the quantification guide covers every technique from scope to downstream consequence.

Major Duties: set the scope ceiling

The Major Duties block is where you calibrate the scale of your work. Everything else on the EPB gets evaluated against the scope you establish here. A narrow description of the role produces a narrow evaluation of the accomplishments. A precisely-scoped description raises the ceiling.

Weak:

Performs duties as Cyber Systems Technician; responsible for maintaining and troubleshooting network equipment

Strong:

Sole 3D1 on 22-person geographically separated unit; maintains NIPR/SIPR/JWICS transport for 340 endpoints across 4 buildings; safeguards classified infrastructure supporting 3 joint mission partners and daily OPORD execution

What changed: "Sole" establishes span of responsibility immediately, without requiring a rank comparison. The endpoint count ($340 nodes), network classification levels (NIPR/SIPR/JWICS), and downstream mission impact (OPORD execution) all raise the stakes of every bullet that follows. If you can source the dollar value of the infrastructure you protect — procurement records, asset appraisals, wing IT inventories — add it. "$4.2M sensor suite" is the kind of number that stops a board member's eye.

Leadership block: expertise transferred, outcomes documented

Leadership on an EPB doesn't require a command position. For cyber Airmen, the most credible entries are:

• Training junior Airmen on a specific technical skill, with a measurable outcome (certification pass rate, assessment scores, time-to-qualification)
• Leading an incident response action, end-to-end
• Building a training program, SOP, or TTP from scratch that outlived you
• Running PACE planning or alternative comms exercises that actually tested something

Weak:

Strong leader; mentors junior Airmen on cyber operations and assists supervisors when needed

Strong:

Developed 4-block network defense course for 8 Airmen with no prior 1B4 background; all 8 passed unit DCWF assessment within 60 days — reduced shop onboarding timeline from 6 months to 3 months Led 3-Airman incident response team on 11-hour SIEM event triage; diagnosed 4,000 false-positive alerts/week as misconfigured firewall rule; suppressing rule freed NOC 18 hrs/wk, capacity redirected to active threat-hunting

The second bullet captures time savings, which is a real operational resource. Eighteen hours a week recovered, at a 10-person NOC, is 180 person-hours per week reallocated to actual mission work. If you want to make that bullet hit harder still, calculate the weekly or annual figure: "freed ~936 person-hours of NOC capacity per quarter."

Whole Airman Concept: certifications are free wins

The certification ecosystem in cyber is one of the most EPB-friendly parts of the career field. CompTIA Security+, CySA+, CASP+, PenTest+, CEH, CCNA, OSCP, CISSP — all of these land cleanly in the Whole Airman Concept block. So do CCAF degrees, community engagement, and resilience activities.

Weak:

Pursuing degree and professional certifications to enhance professional development

Strong:

Completed 15 credit hours toward BS in Information Technology (3.7 GPA, Dean's List); 9 hours from CCAF degree completion Earned CompTIA Security+ and CySA+ in the same quarter — only Airman in 6-person shop to hold both concurrently; 2 study guides submitted to squadron training library Volunteered as curriculum advisor for local high school's AP Computer Science course; mentored 22 students in 8-week hands-on cyber lab, 14 enrolled in CTE pathway the following semester

Three distinct entries, three domains: education, certification, community engagement. That breadth is exactly what the Whole Airman Concept block rewards — and it's a block where cyber career fields have a structural advantage, because the certifications are real and available to anyone who puts in the preparation hours.

Exceeded Expectations: lead with the stratification

The Exceeded Expectations block is the EPB's most-read section. Reviewing officials spending 90 seconds on a first pass spend the most of those seconds here. For cyber Airmen, the entries that land hardest are the ones where you:

• Found the problem nobody else found
• Fixed the issue that had been broken for months
• Trained more people than your position required
• Saved measurable money by avoiding a procurement or preventing a breach

Weak:

Excellent performer; detected and responded to multiple cybersecurity incidents; received positive recognition from leadership for outstanding work

Strong:

#1 of 7 SrA in unit — nominated for Squadron NCO of the Quarter Q1 and Q2; earned Wing Cyberspace Defense Excellence Award (1 of 3 awarded MAJCOM-wide) Detected and isolated Emotet-variant malware on NIPR enclave 72 hours before OPSEC maintenance window; prevented potential exfil of 340 cached user credentials; MAJCOM IG cited response as best-practice incident handling Redesigned shop's patch compliance tracking from manual spreadsheet to automated SCCM dashboard; pushed 647 overdue patches to 100% compliance in 3 weeks, eliminated 28 man-hours/month of manual tracking — methodology adopted wing-wide

Three paragraphs. The strat leads. The biggest technical win follows, with specifics that make it real ("Emotet-variant," "72 hours before," "340 credentials"). The efficiency win closes, with a number (28 hours/month) and a scope statement (adopted wing-wide).

If you have a strat, the words "1st of [N]" or "Top X%" need to appear here, not buried in a trait block. Don't make the reviewing official dig for the stratification — put it in the first line.

Converting everyday tasks into EPB language

Most cyber work runs on a ticket queue: patches, maintenance windows, scheduled scans, connectivity troubleshooting, cert renewals. None of those generate headlines on their own, but all of them generate numbers if you count what you touched.

Everyday task	EPB version
Ran a vulnerability scan	"Identified 23 critical CVEs on SIPR enclave; prioritized and patched all within 72-hour SLA — first quarter shop achieved sub-14-day median dwell time"
Fixed a recurring network outage	"Diagnosed recurring BGP route flap as misconfigured keepalive timer; eliminated 11 monthly outages averaging 45 min each — restored 8.25 hrs/month of mission network availability"
Managed the helpdesk queue	"Closed 312 trouble tickets across 90-day eval window; 97% resolved within SLA; fastest average closure time (1.4 days) across 3-squadron help desk comparison"
Renewed SSL certificates	"Managed TLS lifecycle for 38 public-facing services; zero certificate expirations across eval period — prevented browser-trust failures for 4K+ daily users"
Conducted a STIG review	"Completed DoD STIG review across 14 systems; identified and remediated 47 open findings, closed 2 CAT-I vulnerabilities — cleared unit for Authorizing Official reaccreditation on schedule"

The pattern in every row is the same: task → count → outcome → impact. That's the structure. Fill in the numbers and the verb, and most bullets write themselves.

One test before you submit

Read your draft EPB out loud. Every time you hit a phrase that could appear word-for-word on any other cyber Airman's EPB in the Air Force, that phrase needs more specificity. "Maintained network security posture" is on every 3D0 EPB in every unit. "Reduced SIPR enclave median vulnerability dwell time from 22 to 8 days across 340 nodes" is yours alone.

The board reviewing a hundred EPBs in a day knows what network monitoring looks like. They want to know what your network monitoring led to, in numbers they can compare.

RapidEPR is built for exactly this translation. Drop in the raw version of what you did — even the technical jargon version — pick the EPB format, and get a draft back that's calibrated to what Air Force boards read. No marketing gloss added. Just your work, in evaluation language.

Get started free →