{"id":"sec-it-scan-remediation-owners","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Turn a scan report into a ranked fix list with owners","free":false,"task":"Turn this scan summary into the weekly fix list. Leave out anything marked accepted risk. Sort by your team's rule: internet-facing AND known exploited first, then any other known exploited, then the rest by CVSS score, highest first. Write exactly 5 numbered lines like '1. host - fix - Owner: name', using the owner table. Plain text, under 100 words.","materialLabel":"Scan summary and owner table (attached to your prompt automatically)","material":"Quarterly vulnerability scan - summary (Nov 3, 2026)\nNote: IDs below are made-up examples for training.\n\n1. legacy-ftp-01 (internal) | EXAMPLE-2026-0718 FTP server allows weak ciphers | CVSS 9.1 | Known exploited: No | Status: ACCEPTED RISK (CISO, Oct 2) until decommission on Dec 15\n2. vpn-gw-01 (internet-facing) | EXAMPLE-2026-0412 remote code flaw in VPN firmware 9.1, fix: upgrade to 9.3 | CVSS 9.8 | Known exploited: Yes\n3. hr-db-02 (internal) | EXAMPLE-2026-1177 database server missing October security update | CVSS 8.8 | Known exploited: No\n4. www-01 (internet-facing) | Old TLS 1.0 still enabled, fix: disable TLS 1.0 and 1.1 | CVSS 5.3 | Known exploited: No\n5. print-srv-01 (internal) | EXAMPLE-2026-0930 print spooler flaw, fix: apply vendor update | CVSS 8.8 | Known exploited: Yes\n6. mail-01 (internet-facing) | EXAMPLE-2026-2201 mail server denial-of-service bug, fix: upgrade to 4.2 | CVSS 7.5 | Known exploited: No\n\nOwner table\nvpn-gw-01: Priya Raman (Network)\nhr-db-02: Leo Park (Database)\nwww-01: Ana Ruiz (Web)\nprint-srv-01: Sam Okafor (Servers)\nmail-01: Sam Okafor (Servers)\nlegacy-ftp-01: Sam Okafor (Servers)","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":100}],"mistakes":[{"title":"Sorting by score alone","why":"The AI ranks by CVSS, so an internal flaw beats one attackers are already using.","fix":"Give the rule: \"Internet-facing and known exploited first, then known exploited, then CVSS highest first.\"","checks":["r1"]},{"title":"Keeping accepted risks","why":"The AI lists everything in the report, including the FTP server the CISO signed off on.","fix":"Add: \"Leave out anything marked accepted risk.\"","checks":["r0","numberedItems"]},{"title":"No owners","why":"The AI writes a fix list nobody owns, so nothing gets assigned.","fix":"Say: \"End each line with Owner: name from the owner table.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 100 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 75 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the team's tracker they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the sort rule","patterns":["known exploited","internet-facing","cvss","sort","order"]},{"label":"Drops accepted risks","patterns":["accepted risk","leave out","exclude","skip"]},{"label":"Asks for owners","patterns":["owner"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(line|item|fix)","exactly (5|five)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"The AI will sort by the biggest number unless you give it your team's rule. Spell out the sort order, what to drop, and where owners come from.","rubricLabels":["legacy-ftp-01 (accepted risk) is not in the list","The order is vpn-gw-01, print-srv-01, hr-db-02, mail-01, www-01","Each line names a fix and the correct owner from the table (vpn-gw-01 Priya Raman, print-srv-01 Sam Okafor, hr-db-02 Leo Park, mail-01 Sam Okafor, www-01 Ana Ruiz)"]}