Turns your raw incident notes into a concise summary for executives and senior leadership who need the facts without the technical detail. Use it after containment, when leadership needs to understand what happened, what you did, and what comes next.
YOUR ROLE ·AUDIENCE ·INCIDENT SUMMARY ·CURRENT STATUS ·STATUS DATE ·BUSINESS IMPACT ·ACTIONS TAKEN ·NEXT STEPS
## Context
You are assisting a [YOUR ROLE, e.g., security analyst, incident commander, CISO] preparing a written summary of a security incident for [AUDIENCE, e.g., the executive team, the CIO, the board]. The audience does not need technical depth. They need business impact, status, and next steps. Incident details: [INCIDENT SUMMARY, timeline, affected systems, what was confirmed, what is still under investigation]. Current status: [CURRENT STATUS, e.g., contained, ongoing, remediated]. Business impact: [BUSINESS IMPACT, e.g., service degradation, data exposure, no known customer impact]. Actions taken: [ACTIONS TAKEN]. Next steps: [NEXT STEPS].
## Task
Write a one-page executive incident summary. Include:
- A plain-language headline stating what happened and when.
- A status line: contained, ongoing, or remediated, as of [STATUS DATE].
- Business impact: what was affected, for how long, and who was involved.
- What the team did: three to five bullet points, plain language, no jargon.
- What happens next: two to four next steps with owners and target dates where known.
- A statement of what is still unknown or under investigation, if applicable.
## Standards
- Under 400 words. No technical jargon without a plain-language translation.
- Do not state systems are secure, clean, or fully remediated unless I stated that above.
- Do not name CVEs (Common Vulnerabilities and Exposures), IOCs (Indicators of Compromise), log data, hostnames, or specific vulnerabilities unless I provided them.
- Do not characterize intent or attribution unless I stated confirmed findings.
- Match the tone to the audience: calm, factual, and action-oriented.
- Do not invent impact figures, affected user counts, or data exposure details I did not supply.
- If any named input is missing or ambiguous, ask before drafting.
BEFORE YOU RUN IT
- Confirm the incident timeline, affected systems, and current status from your ticketing system or incident log, not from memory.
- Gather business impact details: affected services, duration, and whether any customer or employee data was involved.
- Confirm all technical artifacts (IOCs, CVEs, hostnames, log data) come from your own tools and systems, not from the AI.
- Review next steps with the incident commander or team lead before pasting them as final.
- Redact credentials, internal IP addresses, customer data, and anything classified or under legal hold before pasting per your org policy.
- Confirm whether the incident is still under investigation and what, if anything, cannot be disclosed yet.
VERIFY BEFORE IT LEAVES YOUR HANDS
- Every impact figure, affected system name, and duration matches your incident documentation exactly. Do not rely on the AI to restate numbers accurately.
- No CVEs, IOCs, or specific vulnerability names appear unless you supplied them. If they do, remove them.
- The status line matches reality: do not let the AI restate an ongoing incident as contained.
- No attribution or intent language appears unless you have confirmed findings from forensics or law enforcement.
- Next steps name real owners and achievable dates, not placeholders the AI invented.
- No credentials, customer PII (personally identifiable information), or internal network details leaked into the output.
- Have a second team member read the draft before it goes to leadership.
Sample output
Sample output. Generated by AI from sample inputs:
Security Incident Summary
Prepared for: Executive Team
Date: June 13, 2026
What Happened
On June 11, Northwind Technologies detected unauthorized access to the WEB-APP-03 server hosting the company's customer portal. The access was identified at 2:14 AM and the team began response within 20 minutes.
Status: Contained as of June 12, 6:00 PM.
Business Impact
The customer portal was offline for approximately 14 hours (2:30 AM to 4:30 PM on June 12). No other systems were affected. Our initial review found no evidence that customer records were accessed or exported. That review is ongoing.
What the Team Did
- Isolated WEB-APP-03 from the network within 20 minutes of detection.
- Rotated all service account credentials associated with the portal.
- Preserved system logs and memory images for forensic review.
- Stood up a backup portal instance to restore customer access by 4:30 PM.
- Notified legal and compliance teams on June 12 at 9:00 AM.
What Comes Next
- Forensic review of WEB-APP-03 to determine scope of access. Owner: Security team. Target: June 17.
- Legal assessment of notification obligations. Owner: General Counsel. Target: June 16.
- Patch and harden portal infrastructure before bringing WEB-APP-03 back to production. Owner: IT Operations. Target: June 20.
What We Do Not Know Yet
The forensic review is still in progress. We will update leadership once we have findings on how access was gained and whether any data was affected.
CUSTOMIZATION Adjust the word count and section depth based on your leadership audience: a CEO may want three paragraphs, while a board packet may need a structured one-pager with an attached timeline. For incidents involving potential legal notification obligations, have legal review the draft before it goes out. Veterans transitioning into security roles can use this format for any briefing where leadership needs facts without technical detail, similar to a battle-damage assessment.
Turns your incident timeline and technical notes into a one-page executive brief for leadership after a security incident. Use it within 24 hours of containment, when executives need the facts without the noise.
INCIDENT TITLE ·DETECTION DATE AND TIME ·CONTAINMENT DATE AND TIME ·AFFECTED SYSTEMS ·INCIDENT NARRATIVE ·DETECTION METHOD ·RESPONSE ACTIONS ·CURRENT STATUS ·BUSINESS IMPACT ·NEXT STEPS
## Context
You are a security communications assistant helping an IT or cybersecurity team lead draft a post-incident executive brief. The audience is senior leaders: they need to understand what happened, what the organization did, what the current status is, and what comes next. They do not need raw log data or packet-level detail.
Incident summary provided by the responder:
- Incident title: [INCIDENT TITLE]
- Date and time detected: [DETECTION DATE AND TIME]
- Date and time contained: [CONTAINMENT DATE AND TIME]
- Systems affected: [AFFECTED SYSTEMS]
- What happened (responder summary): [INCIDENT NARRATIVE]
- How it was detected: [DETECTION METHOD]
- Actions taken: [RESPONSE ACTIONS]
- Current status: [CURRENT STATUS]
- Known business impact: [BUSINESS IMPACT]
- Immediate next steps: [NEXT STEPS]
## Task
Draft a post-incident executive brief with these sections: What Happened, How We Detected It, What We Did, Current Status, Business Impact, What Comes Next. Add a brief header line with the incident title, date, and classification (for example, Confidential).
## Standards
- One page. Under 450 words.
- Plain language. No unexplained technical acronyms.
- State only facts the responder supplied. Do not infer impact, escalation, root cause, or remediation that is not in the inputs.
- Do not state or imply that systems are now secure or that data was not exfiltrated unless the responder explicitly confirmed those conclusions from evidence.
- Do not fabricate CVE (Common Vulnerabilities and Exposures) identifiers, attacker attribution, IOC (Indicator of Compromise) values, or technical findings not present in the inputs.
- If data exfiltration status is unknown, say so plainly.
- Current Status must end with the name and title of who the executive can contact for updates.
- What Comes Next lists actions with owners and target dates if the responder supplied them; otherwise, leave owner and date as blanks for the reader to fill.
- Tone: direct, calm, factual. No panic language. No minimizing.
If any input is missing or ambiguous, especially business impact or current status, ask before drafting.
BEFORE YOU RUN IT
- Incident timeline with detection time, escalation time, and containment time
- List of affected systems and services, from your own asset inventory or ticketing system, not inferred by the AI
- Written summary of response actions taken, who took them, and when
- Known business impact: services down, data at risk, regulatory triggers, customer-facing effects
- Confirmed current status from your team, including any open containment or investigation actions
- Data handling: redact credentials, API keys, internal IP ranges, personal data (Personally Identifiable Information), and anything classified before pasting, per your organization's policy
VERIFY BEFORE IT LEAVES YOUR HANDS
- Every affected system named in the brief matches your actual asset list, not an AI guess
- No CVE identifiers, IOC values, attacker attribution, or malware names appear unless you supplied them and have verified them from your tools
- Impact statements confirmed against actual service records or customer reports, not inferred from the incident type
- Data exfiltration status is accurately stated: confirmed, ruled out, or unknown, never assumed
- Next steps and owners confirmed with the people named before the brief is distributed
- Containment and detection times checked against your ticketing system or incident log, not from memory
- Brief reviewed by the incident commander or CISO (Chief Information Security Officer) before it goes to executives
Sample output
Sample output. Generated by AI from sample inputs:
POST-INCIDENT EXECUTIVE BRIEF
Incident: Unauthorized Access to Finance File Share | June 11, 2026 | Confidential
What Happened
On June 10 at 11:42 PM, an attacker used a compromised employee account to access the Finance shared drive on file server FIN-FS-02 at Northwind Industrial. The account belonged to an employee who had clicked a credential-harvesting link in a phishing email earlier that day. The attacker browsed and downloaded files for approximately 47 minutes before the session was terminated.
How We Detected It
Northwind's security monitoring platform flagged an after-hours login from an unfamiliar geographic location. The alert was escalated to the on-call security analyst at 12:14 AM on June 11.
What We Did
The analyst disabled the compromised account at 12:19 AM and terminated the active session. The incident response team was assembled at 12:45 AM. The Finance file share was taken offline at 1:03 AM for forensic preservation. A password reset was forced for all accounts in the Finance organizational unit.
Current Status
Contained as of June 11, 1:03 AM. Forensic review of file access logs is in progress to determine what data the attacker downloaded. Systems are operational. Contact for updates: Maria Chen, CISO, [email protected].
Business Impact
Finance shared drive was offline for approximately 3 hours. No customer-facing systems were affected. The scope of any data exposure is not yet confirmed and is under active investigation.
What Comes Next
- Complete forensic review of file access logs. Owner: Incident Response Team. Target: June 13.
- Notify legal and compliance regarding potential data exposure. Owner: CISO. Target: June 12.
- Mandatory phishing awareness training for all Finance staff. Owner: HR and IT Security. Target: June 20.
- Present full post-incident report to leadership. Owner: CISO. Target: June 18.
CUSTOMIZATION If your organization has a mandatory breach notification timeline under a regulation such as HIPAA (Health Insurance Portability and Accountability Act) or state law, add a compliance trigger field and a notification deadline to the What Comes Next section. For organizations with a security operations center, add the ticket or case number in the header. Adjust the classification marking to match your organization's labeling policy.