{"id":"sec-it-incident-exec-summary","audience":"it-security","category":"security","track":"security","technique":"audience","title":"Summarize an incident for the CEO without jargon","free":false,"task":"The CEO wants a quick summary of last night's incident on her phone. Write exactly 4 lines starting 'What happened:', 'Business impact:', 'What we did:' and 'Decision needed:', in that order. Use only the final confirmed facts, and no security jargon (no phishing kit, lateral movement, IOC, EDR, C2 or exfiltration). Plain text, under 90 words.","materialLabel":"Incident timeline (attached to your prompt automatically)","material":"INC-2291 timeline (all times Nov 4-5, 2026)\n\n22:40 EDR alert: suspicious login to the marketing file share from 198.51.100.77 using the account of a marketing coordinator.\n22:55 On-call (Dev) confirms the coordinator's password was reused from a third-party site breach. MFA was not enrolled on this account.\n23:10 Initial estimate from Dev: \"possible exposure of up to 40,000 customer records.\"\n23:25 Account disabled, sessions revoked. Attacker IP blocked at the firewall.\n00:30 Lateral movement check: no other systems touched. No C2 traffic found.\n01:15 CORRECTION (Lena, IR lead): file access logs show only the marketing share was opened. It holds brand assets and event photos. No customer records are stored there. The 40,000 estimate was wrong.\n02:00 Forced MFA enrollment for the remaining 37 accounts without it.\n08:30 Lena: we recommend hiring an outside forensics firm (Harbor Point Forensics, quote $18,000) to confirm nothing was copied. Needs CEO approval by Thursday so they can start Friday.","rules":[{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Using the first estimate","why":"The AI grabs the scary 40,000 figure from early in the timeline and misses the correction.","fix":"Say: \"Use only the final confirmed facts; the 40,000 estimate was corrected.\"","checks":["r1"]},{"title":"Writing for engineers","why":"The AI copies terms like EDR and lateral movement that a CEO can't act on.","fix":"Add: \"No security jargon. Write for a CEO who isn't technical.\"","checks":["r2"]},{"title":"No fixed shape","why":"The AI writes a timeline recap with headings and the ask buried at the end.","fix":"Give the 4 line starts: \"What happened:, Business impact:, What we did:, Decision needed:\"","checks":["r0"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 90 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 70 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a phone text they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Says who it's for","patterns":["ceo","executive","non-?technical","boss"]},{"label":"Gives the 4 line labels","patterns":["what happened","business impact","decision needed"]},{"label":"Bans jargon","patterns":["jargon","plain (english|language|words)","no (technical|security) terms"]},{"label":"Uses the corrected facts","patterns":["correct","final","confirmed","40,?000"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]}],"hint":"Executives need the impact and the ask, in their words. Tell the AI the four line labels, that the early estimate was corrected, and to drop the security terms.","rubricLabels":["Has exactly 4 lines starting 'What happened:', 'Business impact:', 'What we did:' and 'Decision needed:', in that order","Uses the corrected facts: says no customer records were affected (only brand assets and event photos on the marketing share) and does not mention 40,000 customer records as exposed","The Decision needed line asks for approval of the $18,000 outside forensics firm by Thursday, and the summary uses none of the terms phishing kit, lateral movement, IOC, EDR, C2 or exfiltration"]}