{"id":"sec-it-awareness-tips-from-incidents","audience":"it-security","category":"security","track":"security","technique":"context","title":"Write a month of security tips from real incidents","free":false,"task":"Write next month's 4 weekly security tips for the staff newsletter, each based on one incident type from this quarter's report. Skip the topic already covered last month. Write exactly 4 numbered lines like '1. Week 1: tip', each one sentence under 25 words that tells staff exactly what to do. No security jargon. Plain text, under 100 words.","materialLabel":"Quarterly incident summary (attached to your prompt automatically)","material":"Q3 2026 incident summary - Harborline Freight (internal)\n\n1. Fake invoice emails: 23 reports. Emails claimed to be from our fuel supplier with \"updated bank details.\" Two staff replied before reporting; no money was sent.\n2. Lost or stolen laptops: 3 cases. All were encrypted, so no data was exposed. One was left in a taxi.\n3. Sign-in approval prompts staff didn't start: 9 cases. Two people tapped approve. Accounts reset within an hour.\n4. Shared passwords on sticky notes: found on 6 desks during the September walk-through at the Dock Road depot.\n5. Fake package delivery texts on work phones: 15 reports. Links went to a fake login page for our email.\n6. USB drives found in the parking lot: 2 cases, both handed to IT unopened. Good job!\n\nNewsletter history:\n- October tip: \"Never plug in a USB drive you found. Hand it to IT.\"\n- Staff survey: people want tips that take less than a minute to read.\n\nHow to report anything suspicious: forward it to report@harborline.example.com or call the help desk at ext. 4400.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":100}],"mistakes":[{"title":"Generic tips","why":"The AI writes 'use strong passwords' and 'think before you click' instead of tips tied to your incidents.","fix":"Say: \"Base each tip on one incident type from the report.\"","checks":["r0"]},{"title":"Repeating last month","why":"The AI picks the USB story because it's memorable.","fix":"Add: \"Skip found USB drives; we covered it in October.\"","checks":["r1"]},{"title":"Tips without an action","why":"The AI explains the threat but doesn't say what to do, and uses words like smishing.","fix":"Ask: \"Each tip says exactly what to do, in everyday words.\"","checks":["r2"]},{"title":"Long newsletter copy","why":"The AI writes a paragraph per week with a heading.","fix":"Be exact: \"Exactly 4 numbered lines, one sentence each, under 20 words.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the newsletter tool they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Ties tips to the incidents","patterns":["incident","report","based on","q3"]},{"label":"Skips last month's topic","patterns":["usb","skip","already covered","october"]},{"label":"Asks for an action","patterns":["action","what to do","specific","do this"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(tip|line|week)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Tips stick when they come from what actually happened here. Point the AI at the report, say what was already covered, and ask for one action per tip.","rubricLabels":["Each of the 4 lines is labeled Week 1 to Week 4 and is based on a different incident type from the report","No tip is about found USB drives (already covered in October)","Each tip tells staff a specific action (for example call the supplier on a known number before changing bank details, deny sign-in prompts you didn't start, report to report@harborline.example.com or ext. 4400), using no jargon like phishing, smishing, MFA or social engineering"]}