{"id":"sec-it-incident-status-update","audience":"it-security","category":"security","track":"security","technique":"format","title":"Write an hourly incident status update for stakeholders","free":false,"task":"Write the 3 pm status update for the email outage incident. Use exactly 4 lines starting 'Status:', 'Impact:', 'What we're doing:' and 'Next update:'. Only include confirmed facts; the next update is always 1 hour after this one. Plain text, under 70 words.","materialLabel":"Incident notes as of 2:55 pm (attached to your prompt automatically)","material":"INC-4410 - Email delivery problems (notes as of 2:55 pm, Nov 6, 2026)\n\n1:40 pm: users report outside emails arriving late.\n2:05 pm: confirmed: our spam filter vendor is having an outage. Incoming outside mail is queued, not lost. Internal email works normally.\n2:30 pm: vendor says fix in progress, no time estimate.\n2:45 pm: about 1,200 outside emails queued so far.\n2:50 pm: Tomás thinks \"maybe it's a cyberattack on the vendor?\" - not confirmed, vendor hasn't said.\n2:52 pm: we are checking whether to route mail around the filter temporarily. Decision by 3:30 pm with the CISO.\n\nStatus page wording rules: plain language, no blame on the vendor by name in all-staff updates.\nAudience: all staff.","rules":[{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Passing on speculation","why":"The AI includes the cyberattack guess, which spreads fear.","fix":"Say: \"Only confirmed facts.\"","checks":["r1"]},{"title":"No fixed shape","why":"The AI writes a paragraph or a full incident report.","fix":"Give the lines: \"Status:, Impact:, What we're doing:, Next update:\"","checks":["r0"]},{"title":"Forgetting the next update","why":"The AI ends with 'we'll keep you posted'.","fix":"Add: \"Next update: 1 hour after this one, 4 pm.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 70 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 55 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the status page they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the 4 lines","patterns":["status:","impact:","next update"]},{"label":"Uses confirmed facts only","patterns":["confirm","speculat","only facts","rumou?r"]},{"label":"Sets the next update time","patterns":["4 ?pm","1 hour","next update"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"During an incident, people need the same short shape every hour. Give the AI the four lines, say only confirmed facts, and when the next update is.","rubricLabels":["Exactly 4 lines starting 'Status:', 'Impact:', 'What we're doing:' and 'Next update:', in that order","Impact says outside emails are delayed but not lost and internal email works; the update does not mention a possible cyberattack and does not name the vendor","Next update says 4 pm (or 4:00 pm)"]}