{"id":"sec-it-phish-sim-results-ciso","audience":"it-security","category":"security","track":"security","technique":"format","title":"Report phishing simulation results with the math shown","free":false,"task":"Summarize last month's phishing awareness simulation for the CISO. Write exactly 4 numbered lines: overall click rate with the math, the department(s) over the 10% target with their math, the report rate with the math, and 'Next:' with one action from the notes. Plain text, under 80 words.","materialLabel":"Simulation results (attached to your prompt automatically)","material":"Phishing awareness simulation - October 2026 (training exercise, approved by HR)\nTemplate used: fake \"shared document\" notice\n\nDepartment | Sent | Clicked | Reported\nFinance    | 40   | 2       | 22\nSales      | 60   | 9       | 15\nOperations | 50   | 4       | 20\nSupport    | 50   | 5       | 23\nTotal      | 200  | 20      | 80\n\nNotes:\n- Target: click rate under 10% for every department.\n- Last month's overall click rate was 14%.\n- Sales had a new-hire class of 18 people in September; 7 of the 9 Sales clicks were new hires.\n- Planned action options: (a) 15-minute refresher for Sales new hires in November, (b) company-wide training in Q1.\n- The CISO asked for \"just the numbers and one next step\".\n- Someone suggested naming the people who clicked in the all-hands. HR said no.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"Numbers without working","why":"The AI gives percentages the CISO can't check.","fix":"Ask: \"Show the math, like 20 of 200 = 10%.\"","checks":["r0","r1"]},{"title":"Fuzzy target check","why":"The AI lists Support as 'at risk' even though 10% isn't over.","fix":"Say: \"List only departments over 10%.\"","checks":["r1"]},{"title":"Several next steps","why":"The AI lists every idea, plus naming clickers.","fix":"Add: \"One action from the notes. No names.\"","checks":["r2"]},{"title":"A long report","why":"The AI adds tables and commentary.","fix":"Be exact: \"Exactly 4 numbered lines.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in an email they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for the math","patterns":["math","show","of 200","%"]},{"label":"Uses the target","patterns":["10%","target","over"]},{"label":"Ends with one action","patterns":["next:","one (action|next step)","single"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(line|item)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A CISO wants numbers they can check against the target, and one next step. Ask the AI to show the math and to list only what's over target.","rubricLabels":["Line 1 shows 20 of 200 = 10% overall, and line 3 shows 80 of 200 = 40% reported","Line 2 names only Sales as over target with its math (9 of 60 = 15%), and does not list Support (10%) or other departments as over","Line 4 starts 'Next:' with one action (the Sales new-hire refresher in November, or company-wide Q1 training), and no line names individual people"]}