Library › Cybersecurity AI › IT and security teams

Label the red flags in a user-reported phishing email

Practice: Asking for a format you can use. About 5 minutes.

About this exercise

A user reported this email to the SOC and you need a ticket note. Your team's format: a first line 'Verdict: Phishing', 'Verdict: Suspicious' or 'Verdict: Safe', then exactly 5 numbered lines, one per label in this order: Sender mismatch, Urgency, Link mismatch, Credential request, Risky attachment. Each line quotes the exact evidence from the email. Plain text, under 130 words.

Common mistakes when you ask AI for this

  • Asking a yes/no question. "Is this safe?" gets a long essay with headings and tips, not a ticket note. Try: Give the shape: "First line Verdict: Phishing, Suspicious or Safe, then exactly 5 numbered lines."
  • Letting the AI pick the labels. The AI invents its own categories, so notes from different analysts never match. Try: List them: "One line each, in order: Sender mismatch, Urgency, Link mismatch, Credential request, Risky attachment."
  • Flagging things that are fine. The AI calls every detail suspicious, including the real office address in the signature. Try: Add: "Quote only evidence from the email. The signature address and phone are real."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 130 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 100 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the ticket system they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Asks for a verdict line
  • Names the exact labels
  • Asks for quoted evidence
  • Says exactly how many
  • Asks for plain text

Practice this now ↑

Related exercises