How to Use These Prompts

These prompts work with ChatGPT (GPT-4o), Claude, or any capable AI assistant. Replace bracketed placeholders with your specific details. Always verify AI outputs — especially for technical security content — against authoritative sources before acting on them.

Important: Never paste sensitive data, real IP addresses, actual credentials, or confidential incident details into public AI tools. Use anonymised or fictional examples when testing prompts.

Threat Research Prompts

Understand a threat actor:

"Explain the tactics, techniques, and procedures (TTPs) used by [threat actor name, e.g. APT40]. Map their known techniques to the MITRE ATT&CK framework and identify which Essential Eight controls would mitigate their most common attack vectors."

Research a malware family:

"Provide a technical overview of [malware name]. Include: how it spreads, persistence mechanisms, indicators of compromise (IOCs) to look for, and recommended detection and response steps for a Windows enterprise environment."

Understand a CVE:

"Explain CVE-[number] in plain language. What is the vulnerability, what systems are affected, what is the exploitability, and what is the recommended remediation? Include any known active exploitation in the wild."

Threat intelligence summary:

"Summarise the current threat landscape for Australian [sector, e.g. financial services / healthcare / critical infrastructure] organisations. Focus on the most active threat actors, common attack vectors, and recommended defensive priorities for 2026."

Incident Response Prompts

Draft an incident timeline:

"Help me draft an incident timeline for a [type of incident, e.g. ransomware / BEC / data breach] affecting [brief description of environment]. The incident was detected on [date]. Key events so far: [list events]. Format as a chronological timeline suitable for an incident report."

Generate a stakeholder communication:

"Draft a stakeholder communication for a [severity level] security incident affecting [systems/data]. The audience is [executive leadership / board / affected customers]. The incident involved [brief description]. We have taken the following containment steps: [steps]. Keep the tone professional and avoid technical jargon."

Incident response checklist:

"Generate an incident response checklist for a [type of incident] in an Australian organisation. Include phases: detection, containment, eradication, recovery, and lessons learned. Reference the ACSC's incident response guidance where relevant."

Post-incident report structure:

"Create a post-incident report template for a [type of incident]. Include sections for: executive summary, incident timeline, root cause analysis, impact assessment, containment and remediation actions, lessons learned, and recommendations. Format for an Australian enterprise audience."

Policy and Documentation Prompts

Draft a security policy:

"Draft a [policy name, e.g. Acceptable Use Policy / Password Policy / Remote Access Policy] for an Australian organisation with approximately [number] employees. The policy should align with the ACSC's Essential Eight and be written in plain English. Include: purpose, scope, policy statements, responsibilities, and review schedule."

Essential Eight gap analysis:

"I need to assess our organisation's Essential Eight maturity. For [mitigation strategy, e.g. Patch Applications], describe: what Maturity Level 1, 2, and 3 look like in practice, common gaps Australian organisations have at each level, and practical steps to move from Level [current] to Level [target]."

Control mapping:

"Map the following security controls to the ISO 27001:2022 Annex A controls: [list your controls]. For each control, identify the relevant ISO 27001 clause and note any gaps."

Security Awareness Training Prompts

Phishing awareness content:

"Write a security awareness article about phishing for non-technical employees at an Australian organisation. Cover: how to recognise phishing emails in 2026 (including AI-generated phishing), what to do if you receive a suspicious email, and how to report it. Keep it under 400 words and use plain language."

Security tip for internal newsletter:

"Write a short security tip (150 words) for an internal company newsletter. Topic: [e.g. password hygiene / MFA / safe remote working / social engineering]. Audience: general employees at an Australian organisation. Tone: friendly and practical, not alarmist."

Tabletop exercise scenario:

"Design a tabletop exercise scenario for an Australian [sector] organisation. The scenario should involve [attack type, e.g. ransomware / supply chain compromise / insider threat]. Include: initial trigger, escalation points, decision points for the team, and discussion questions for each phase. Duration: approximately 90 minutes."

Compliance Prompts

Privacy Act assessment:

"Help me assess whether a [type of data incident] constitutes an eligible data breach under the Australian Privacy Act 1988 (Notifiable Data Breaches scheme). The incident involved: [brief description]. What factors should I consider, and what are the notification obligations if it is eligible?"

SOCI Act obligations:

"Summarise the cybersecurity obligations for [asset class, e.g. data storage systems / financial market infrastructure] under Australia's Security of Critical Infrastructure Act 2018. What are the key requirements for incident reporting, risk management programs, and government assistance?"

Audit evidence request response:

"Help me draft a response to the following audit evidence request: [paste request]. Our current control is: [describe control]. Format the response to clearly demonstrate control effectiveness to an external auditor."

Tips for Better Results

• Be specific about your environment (cloud, on-premises, hybrid), industry, and regulatory context
• Ask for outputs in specific formats (tables, checklists, numbered steps) for easier use
• Follow up with "What are the most common mistakes when implementing this?" for practical depth
• Always have a subject matter expert review AI-generated security content before use