# Post-Incident Executive Brief

Turns your incident timeline and technical notes into a one-page executive brief for leadership after a security incident. Use it within 24 hours of containment, when executives need the facts without the noise.

## Prompt

## Context
You are a security communications assistant helping an IT or cybersecurity team lead draft a post-incident executive brief. The audience is senior leaders: they need to understand what happened, what the organization did, what the current status is, and what comes next. They do not need raw log data or packet-level detail.

Incident summary provided by the responder:
- Incident title: [INCIDENT TITLE]
- Date and time detected: [DETECTION DATE AND TIME]
- Date and time contained: [CONTAINMENT DATE AND TIME]
- Systems affected: [AFFECTED SYSTEMS]
- What happened (responder summary): [INCIDENT NARRATIVE]
- How it was detected: [DETECTION METHOD]
- Actions taken: [RESPONSE ACTIONS]
- Current status: [CURRENT STATUS]
- Known business impact: [BUSINESS IMPACT]
- Immediate next steps: [NEXT STEPS]

## Task
Draft a post-incident executive brief with these sections: What Happened, How We Detected It, What We Did, Current Status, Business Impact, What Comes Next. Add a brief header line with the incident title, date, and classification (for example, Confidential).

## Standards
- One page. Under 450 words.
- Plain language. No unexplained technical acronyms.
- State only facts the responder supplied. Do not infer impact, escalation, root cause, or remediation that is not in the inputs.
- Do not state or imply that systems are now secure or that data was not exfiltrated unless the responder explicitly confirmed those conclusions from evidence.
- Do not fabricate CVE (Common Vulnerabilities and Exposures) identifiers, attacker attribution, IOC (Indicator of Compromise) values, or technical findings not present in the inputs.
- If data exfiltration status is unknown, say so plainly.
- Current Status must end with the name and title of who the executive can contact for updates.
- What Comes Next lists actions with owners and target dates if the responder supplied them; otherwise, leave owner and date as blanks for the reader to fill.
- Tone: direct, calm, factual. No panic language. No minimizing.

If any input is missing or ambiguous, especially business impact or current status, ask before drafting.

## Variables

- INCIDENT TITLE
- DETECTION DATE AND TIME
- CONTAINMENT DATE AND TIME
- AFFECTED SYSTEMS
- INCIDENT NARRATIVE
- DETECTION METHOD
- RESPONSE ACTIONS
- CURRENT STATUS
- BUSINESS IMPACT
- NEXT STEPS

## Input checklist

- [ ] Incident timeline with detection time, escalation time, and containment time
- [ ] List of affected systems and services, from your own asset inventory or ticketing system, not inferred by the AI
- [ ] Written summary of response actions taken, who took them, and when
- [ ] Known business impact: services down, data at risk, regulatory triggers, customer-facing effects
- [ ] Confirmed current status from your team, including any open containment or investigation actions
- [ ] Data handling: redact credentials, API keys, internal IP ranges, personal data (Personally Identifiable Information), and anything classified before pasting, per your organization's policy

## Verification checklist

- [ ] Every affected system named in the brief matches your actual asset list, not an AI guess
- [ ] No CVE identifiers, IOC values, attacker attribution, or malware names appear unless you supplied them and have verified them from your tools
- [ ] Impact statements confirmed against actual service records or customer reports, not inferred from the incident type
- [ ] Data exfiltration status is accurately stated: confirmed, ruled out, or unknown, never assumed
- [ ] Next steps and owners confirmed with the people named before the brief is distributed
- [ ] Containment and detection times checked against your ticketing system or incident log, not from memory
- [ ] Brief reviewed by the incident commander or CISO (Chief Information Security Officer) before it goes to executives

## Sample output

Sample output. Generated by AI from sample inputs:

POST-INCIDENT EXECUTIVE BRIEF
Incident: Unauthorized Access to Finance File Share | June 11, 2026 | Confidential

What Happened
On June 10 at 11:42 PM, an attacker used a compromised employee account to access the Finance shared drive on file server FIN-FS-02 at Northwind Industrial. The account belonged to an employee who had clicked a credential-harvesting link in a phishing email earlier that day. The attacker browsed and downloaded files for approximately 47 minutes before the session was terminated.

How We Detected It
Northwind's security monitoring platform flagged an after-hours login from an unfamiliar geographic location. The alert was escalated to the on-call security analyst at 12:14 AM on June 11.

What We Did
The analyst disabled the compromised account at 12:19 AM and terminated the active session. The incident response team was assembled at 12:45 AM. The Finance file share was taken offline at 1:03 AM for forensic preservation. A password reset was forced for all accounts in the Finance organizational unit.

Current Status
Contained as of June 11, 1:03 AM. Forensic review of file access logs is in progress to determine what data the attacker downloaded. Systems are operational. Contact for updates: Maria Chen, CISO, mchen@northwindindustrial.com.

Business Impact
Finance shared drive was offline for approximately 3 hours. No customer-facing systems were affected. The scope of any data exposure is not yet confirmed and is under active investigation.

What Comes Next
- Complete forensic review of file access logs. Owner: Incident Response Team. Target: June 13.
- Notify legal and compliance regarding potential data exposure. Owner: CISO. Target: June 12.
- Mandatory phishing awareness training for all Finance staff. Owner: HR and IT Security. Target: June 20.
- Present full post-incident report to leadership. Owner: CISO. Target: June 18.

## Customization notes

If your organization has a mandatory breach notification timeline under a regulation such as HIPAA (Health Insurance Portability and Accountability Act) or state law, add a compliance trigger field and a notification deadline to the What Comes Next section. For organizations with a security operations center, add the ticket or case number in the header. Adjust the classification marking to match your organization's labeling policy.

---

From The IT & Cybersecurity Library at vetslearn.com/libraries/it-cyber