Library › Cybersecurity AI › Software developers

Turn a pentest finding into a dev ticket

  • For Software developers
  • You practice Asking for a format you can use
  • Time about 5 minutes

About this exercise

Turn this finding from your authorized pentest into a ticket for the team. Exactly 5 numbered lines: Title, Severity, Affected, Fix, Done when. Titles start with the service in brackets, like '[billing-service]'. Use your team's severity scale, not the tester's rating. 'Done when' must be a check someone can run. Plain text, under 120 words.

Common mistakes when you ask AI for this

  • Copying the tester's rating. The AI keeps 'HIGH', which doesn't map to your team's scale. Try: Say: "Use our scale: S1, S2 or S3 as defined."
  • Over-scoping the fix. The AI repeats the tester's 'rewrite the authorization layer' suggestion. Try: Add: "Fix only the PDF endpoint, matching the JSON endpoint's ownership check."
  • Fuzzy scope. The AI lists both invoice endpoints as affected. Try: Ask: "Affected: only the endpoint the finding proves."
  • Ignoring the title convention. The AI writes a long descriptive title your board can't sort by service. Try: Say: "Title starts with [billing-service]."
  • No ticket shape. The AI writes a report with headings instead of ticket fields. Try: Give the fields: "Exactly 5 numbered lines: Title, Severity, Affected, Fix, Done when."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 120 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 90 words total."

What a strong prompt includes

  • Gives the ticket fields
  • Uses your severity scale
  • Asks for a testable done line
  • Says exactly how many
  • Sets a word limit

Practice this now ↑

Related exercises