Introduction: How ChatGPT-5.5 Enhances Cybersecurity Workflows

ChatGPT-5.5 accelerates cybersecurity work by transforming ambiguous inputs (logs, alerts, control narratives, ticket notes) into consistent, structured, and actionable outputs (queries, timelines, mappings, playbooks). Its strengths for security use cases include:

• Rapid normalization and summarization: Converts heterogeneous telemetry (e.g., Windows Event Logs, firewall flows, EDR telemetry) into a unified schema you define. This speeds up triage and threat-hunting queries by removing format inconsistencies.
• Pattern synthesis at scale: Surfaces relationships across indicators, users, hosts, and techniques; maps observations to frameworks like MITRE ATT&CK and NIST, flagging coverage gaps with clear rationales.
• Specification-first outputs: Produces results in strict formats (JSON, CSV, KQL/SPL/SQL, or markdown tables) you can pipe into SIEMs, ticketing systems, or orchestration workflows without heavy post-processing.
• Context-aware reasoning: Incorporates your environment constraints (network segments, identity providers, EDR features, data retention limits) to propose realistic actions, not vendor-generic steps.
• Iterative refinement: Supports tight feedback loops for hunts, playbooks, and remediation advice—update input constraints or sample data to progressively improve precision and reduce noise.
• Secure documentation generation: Drafts evidence requests, chain-of-custody logs, and audit narratives aligned to frameworks (SOC 2, ISO 27001, PCI DSS), reducing manual compliance burden.

Use these prompts to standardize how your team asks the model for deliverables. Where a task demands deterministic output (e.g., parsable JSON, exact query syntax), the prompts require strict schemas, version tags, and validation steps to minimize ambiguity. Where human judgment is critical (e.g., APT attribution or zero-day risk decisions), the prompts force explicit assumptions and confidence scoring to keep decisions auditable.

To deepen prompt-writing skills, see The 2026 Prompt Library: 7 Templates for Prompt Engineering, explore broader security use cases at How to Build an AI Agent with GPT-5.4 in 2026, and browse complementary templates in 35 ChatGPT-5.5 Prompts for Supply Chain Managers.

How to Use These Prompts Effectively

• Define scope and schemas up front: Provide exact fields, time windows, and environment labels (e.g., [PROD], [DEV], [PCI]) so outputs remain immediately actionable.
• Constrain outputs: Require JSON keys, table columns, code blocks, and versioned sections (e.g., Output_Schema_v1). Reject free-form prose for operational deliverables.
• Pin assumptions: Add environment assumptions and data limitations (e.g., log retention = 30 days, EDR coverage = 85% Windows endpoints) to prevent overreach.
• Iterate with deltas: Supply samples or summarized stats (top talkers, error rates) and request only next-step artifacts (queries, filters, playbook diffs) rather than redoing full outputs each round.
• Demand validation: Instruct the model to self-check syntax against the target system (KQL/SPL/SQL naming) and to flag uncertain fields for your review.
• Red-team the answer: Ask for alternative hypotheses, counter-evidence, and false positive risks. Require confidence scoring with rationale.
• Operationalize safely: Never treat suggestions as auto-executable. Validate in non-production, peer-review changes, and add guardrails (change approvals, canary testing).

Section 1: Threat Hunting (7 Prompts)

Context:
- Environment: [YOUR_ENVIRONMENT_NAME], time window: [START_TIMESTAMP] to [END_TIMESTAMP], timezone: [TZ].
- Log sources: [YOUR_LOG_SOURCE_LIST] (e.g., Windows Security, Sysmon, EDR, firewall, DNS, proxy, IAM).
- Known constraints: [DATA_RETENTION], [KNOWN_LOG_GAPS], [CRITICAL_ASSETS_LIST].

Task:
- Normalize the provided sample log excerpts and metadata into a single events schema.
- Enrich with:
  1) hostname-to-asset criticality (use [CRITICAL_ASSETS_LIST]),
  2) internal/external IP classification (CIDRs: [INTERNAL_CIDRS]),
  3) geo-IP (if external),
  4) MITRE ATT&CK technique guesses (top 2 with rationale),
  5) related entities (user, process, parent, hash, domain).
- Identify top 5 suspicious patterns warranting hunts and produce SIEM queries.

Inputs:
- Sample logs (delimited by <LOG>...</LOG>). If missing, ask for samples or operate with placeholders.
- SIEM dialect: [KQL|SPL|SQL|CUSTOM].

Output (strict):
1) Output_Schema_v1 (JSON):
{
  "events": [
    {
      "ts": "ISO8601",
      "source": "string",
      "host": "string",
      "user": "string|null",
      "process": {"name":"string|null","pid":"int|null","ppid":"int|null","hash":"string|null"},
      "net": {"src_ip":"string|null","src_port":"int|null","dst_ip":"string|null","dst_port":"int|null","proto":"string|null","direction":"ingress|egress|internal"},
      "asset_criticality": "LOW|MEDIUM|HIGH|CRITICAL",
      "ioc_hits": ["string"],
      "mitre": [{"technique":"Txxxx","name":"string","rationale":"string"}]
    }
  ],
  "enrichment_notes": ["string"]
}
2) Suspicion_Findings_v1 (table):
- Pattern
- Evidence (event references)
- Risk (LOW/MEDIUM/HIGH/CRITICAL)
- ATT&CK (TIDs)
- Next Steps (brief)
3) Queries_v1: 5 SIEM queries in [KQL|SPL|SQL|CUSTOM], each with a one-sentence intent.

Constraints:
- Do not invent fields you cannot infer; use null.
- If technique mapping is uncertain (<40% confidence), omit it and state why in enrichment_notes.
- Validate query syntax keywords for the selected dialect; flag any uncertain function names.
- Keep PII minimal; mask usernames to first initial + 3 chars (e.g., j-doe → j-doe).

Provide: JSON block, table, and code blocks only; no prose.

Context:
- IOC list: [YOUR_IOC_LIST] (domains, IPs, URLs, SHA256).
- Sources: SIEM: [YOUR_SIEM_NAME], EDR: [YOUR_EDR_NAME].
- Timeframe: [LOOKBACK_WINDOW_DAYS] days.
- Critical assets: [CRITICAL_ASSETS_LIST].

Task:
- Correlate IOCs across SIEM and EDR.
- Produce:
  a) a de-duplicated hit list with context,
  b) hit quality scoring,
  c) queries to expand pivots (parent process, DNS NXDOMAIN, related certs),
  d) immediate containment recommendations if hits touch CRITICAL assets.

Scoring rubric (IOC_Hit_Score_v1):
- Exact hash match on process binary = 1.0
- Domain in DNS + process with suspicious parent (powershell/cscript/wscript) = 0.8
- IP in netflow + outbound to rare ASN (<1% daily baseline) = 0.7
- URL in proxy with HTTP 302 chain and uncommon UA = 0.6
- Domain-only with no process linkage = 0.3

Output (strict):
1) Correlated_Hits_v1 (JSON):
[
  {
    "ioc": "string",
    "type": "IP|DOMAIN|URL|SHA256",
    "sources": ["SIEM|EDR|DNS|PROXY|NETFLOW"],
    "first_seen": "ISO8601",
    "last_seen": "ISO8601",
    "hosts": ["string"],
    "users": ["string"],
    "score": 0.0-1.0,
    "evidence": ["string"],
    "critical_asset_involved": true|false
  }
]
2) Pivot_Queries_v1: 6 queries (dialect tags: [KQL]/[SPL]/[EDR_DSL]) with comment lines (# intent).
3) Containment_Steps_v1: bulleted, ordered by risk, with asset names and owners from [CRITICAL_ASSETS_LIST].

Constraints:
- No free text; use JSON, queries, bullets.
- If an IOC is multi-label (e.g., both IP and domain), list both entries explicitly.
- Flag any IOC collisions with internal IPs/CNs.

Context:
- Intel inputs: [REPORT_TITLES_AND_SNIPPETS] (vendor, ISAC, open-source).
- Campaign focus: [SECTOR/REGION], suspected actor(s): [ACTOR_GUESS_OR_UNKNOWN].
- Data sources available: [DNS|HTTP|TLS|EMAIL|O365|OKTA|EDR|PROXY|NETFLOW|CLOUDTRAIL], lookback: [DAYS].

Task:
- Extract concrete IOCs, TTPs, and infrastructure markers from the intel snippets.
- Normalize to ATT&CK (tactics, techniques, software).
- Propose a prioritized pivot plan for each data source above.

Output (strict):
1) Intel_Extracts_v1 (table):
- IOC
- Type (IP/DOMAIN/URL/HASH/CERT/SUBJECT)
- Source Report
- Confidence (Low/Med/High)
- Expiration (days)
- Notes (evasion, overlap)
2) ATTACK_Map_v1 (JSON):
{
  "tactics": ["TA0001", "..."],
  "techniques": [{"tid":"Txxxx","name":"string","evidence":"string"}],
  "software": [{"name":"string","id":"Sxxxx","links":["url"]}]
}
3) Pivot_Plan_v1 (per source):
- Source
- Query (with dialect tag)
- Expected Signal
- False Positive Risks
- Next Action if Hit

Constraints:
- Do not invent software IDs; if unknown, leave id null and add links null.
- Expire low-confidence IOCs in <=7 days unless corroborated.
- Highlight infrastructure reuse indicators (e.g., TLS cert hash, name server clustering).

Context:
- Entity type: [USER|HOST|SERVICE_ACCOUNT].
- Feature set to baseline (choose 6–10): [LOGON_HOURS], [SOURCE_COUNTRY], [PROCESS_TREE_DEPTH], [DNS_UNIQUENESS], [NETWORK_BYTES], [PARENT_SHELL], [EMAIL_SEND_RATE], [CLOUD_API_ACTIONS].
- Window: [BASELINE_DAYS] days baseline, outlier detection over [DETECTION_DAYS] days.
- Data sources: [YOUR_SIEM_DATASETS].

Task:
- Define a baseline model per feature with thresholds (p95/p99, MAD/Z-score, frequency minima).
- Detect top 10 outliers per entity.
- Generate queries to validate each outlier (triangulate across at least 2 data sources).

Output (strict):
1) Baseline_Model_v1 (table):
- Feature
- Method (p95|p99|MAD|Z|Count-Min)
- Threshold
- Rationale
2) Outliers_v1 (JSON):
[
  {"entity":"string","feature":"string","value":"number|string","threshold":"number|string","zscore_or_ratio":"number|null","supporting_events":["source:event_id"],"confidence":0.0-1.0}
]
3) Validation_Queries_v1: For each outlier, 2 queries in [YOUR_DIALECT] with comments describing expected corroboration.

Constraints:
- If baseline population < 30 samples, downgrade confidence and use p99 only.
- Exclude service accounts from logon-hour anomalies unless explicitly requested.
- Ensure features are monotonic or categorical before applying Z-score; otherwise use MAD or count-based heuristics.

Context:
- Event stream description: [EVENT_TYPES] (e.g., process creations 4688/Sysmon 1, registry mods 13, network connects 3).
- Known detections present: [DETECTION_CATALOG], coverage gaps: [GAP_LIST].
- Priority tactics to focus: [TAxxxx list].

Task:
- Map events to the most likely ATT&CK techniques/sub-techniques.
- Produce detection hypotheses with minimal viable analytics and test data requirements.

Output (strict):
1) ATTACK_Mapping_v1 (table):
- Technique (TID)
- Evidence Pattern (event IDs, fields)
- Confidence (Low/Med/High)
- Existing Detection (Y/N)
- Gap Notes
2) Analytics_v1 (per technique):
- Detection Logic (pseudo + [KQL/SPL] ready query)
- Required Fields
- FP Risks
- Test Data (commands/simulation ideas)
3) Coverage_Summary_v1 (JSON):
{"tactics":["TA0002"...],"techniques_total":N,"covered":N,"gaps":N,"new_rules_proposed":N}

Constraints:
- Only include techniques supported by at least one concrete evidence pattern you list.
- If an existing detection already covers the technique, propose an enhancement or validation case instead of duplicate logic.

Context:
- Seed host(s): [SEED_HOSTS] suspected compromised.
- Timeframe: [HOURS] hours around [INCIDENT_ANCHOR_TS].
- Data: 4624/4625 logons, 4672 special privileges, 4688 processes, 4769/4776 Kerberos/NTLM, Sysmon 3/10, workstation names, admin groups.

Task:
- Reconstruct potential lateral paths from seed hosts to other assets.
- Identify admin credential exposure and constrained delegation misuse.
- Output a graph-friendly edge list and high-risk steps.

Output (strict):
1) Lateral_Paths_v1 (CSV with headers):
source_host,target_host,method,account,ts,confidence,notes
2) High_Risk_Steps_v1 (table):
- Step #
- Evidence
- Risk
- ATT&CK (Lateral Movement/Privilege Escalation)
- Recommended Containment
3) Verification_Queries_v1: 5 queries to confirm each critical edge using alternative logs (e.g., 4776 vs 4769, Sysmon network vs firewall).

Constraints:
- Count RDP/SMB/WinRM/PSRemoting/RemoteServiceCreation distinctly in "method".
- If the same account appears across multiple methods within 15 min, raise confidence due to technique hopping.
- Mask service tickets but note S4U/S4U2Self anomalies when visible.

Context:
- Observed artifacts: [HOSTNAMES], [PROCESSES], [DOMAINS], [TLS_CERTS], [FILE_HASHES], [TTP_NOTES].
- Candidate actors: [ACTOR_LIST] (with public profiles/aliases).
- Scope: Hypothesis support only; no definitive attribution.

Task:
- Build competing attribution hypotheses across candidate actors.
- Score each using a transparent rubric based on infrastructure reuse, malware families, TTP overlap, timing, and targeting.

Rubric_v1 (0–5 per category; weights in parentheses):
- Infrastructure Reuse (0.25)
- Malware/Tooling Overlap (0.25)
- TTP Consistency by ATT&CK (0.20)
- Temporal/Geographic Consistency (0.15)
- Targeting Fit (0.10)
- Discriminator Signals (linguistic, compiler, lure themes) (0.05)

Output (strict):
1) Hypotheses_v1 (table):
- Actor
- Score (0–5 weighted)
- Evidence Highlights
- Conflicts/Gaps
- Confidence (Low/Med)
2) Evidence_Matrix_v1 (JSON):
{
 "evidence_items":[{"id":"E1","type":"DOMAIN|CERT|HASH|TOOL|TTP","value":"string","notes":"string"}],
 "actor_support":{"ActorA":["E1","E3"],"ActorB":["E2"]},
 "conflicts":[{"actor":"ActorA","reason":"string"}]
}
3) Next_Steps_v1: top 5 discriminators to collect (e.g., C2 header order, URL path patterns, mutex names).

Constraints:
- Avoid circular reasoning: weigh only evidence you explicitly enumerate.
- If two actors tie, mark confidence Low and emphasize discriminators rather than forcing a winner.

Section 2: Incident Response (7 Prompts)

Context:
- Alert type: [ALERT_CATEGORY] (e.g., suspicious PowerShell, impossible travel, privilege escalation).
- Source system: [SIEM/EDR/CLOUD_PROVIDER], alert fields: [FIELD_LIST].
- SLAs: P1 = [MINUTES], P2 = [HOURS].
- Environment constraints: [E.G., production change freeze, after-hours paging rules].

Task:
- Produce a stepwise triage playbook optimized for first responders.
- Include decision points, branching, and data collection queries/snippets.

Output (strict):
1) Triage_Playbook_v1 (numbered steps with branching labels A/B/C):
- Pre-checks (ownership, asset criticality)
- Validate alert fidelity (queries)
- Scope expansion
- Containment decision
- Documentation + ticket updates
2) Data_Collection_v1 (per tool):
- Tool
- Command/Query (ready-to-run)
- Expected Artifact
- Time Estimate
3) Decision_Tree_v1 (ASCII diagram) compact enough to paste in tickets.

Constraints:
- Use clear, minimal steps; avoid product marketing or vague advice.
- Cite specific fields from [FIELD_LIST] in validation steps.
- Include handoff criteria if playbook cannot proceed (e.g., missing EDR telemetry).

Context:
- Incident: [INCIDENT_SUMMARY].
- Asset classes: [ENDPOINT|SERVER|CONTAINER|CLOUD_ACCOUNT|DB|OT].
- Business constraints: [UPTIME_SLOA], [MAINTENANCE_WINDOWS], [REGULATORY_CONSTRAINTS].

Task:
- Propose containment strategies per asset class with blast-radius reduction options.
- Include reversible vs irreversible actions, with roll-back procedures and owner approvals.

Output (strict):
1) Containment_Matrix_v1 (table):
- Asset Class
- Action
- Reversible (Y/N)
- Preconditions
- Roll-back Steps
- Owner Approval Required
- Risk Tradeoffs
2) Network_Isolation_Recipes_v1:
- Segmentation rules (CIDR/proto/port) with justifications.
- Temporary exceptions for monitoring and IR tooling.
3) Validation_Checks_v1: Pre/post containment verification steps (telemetry checks, health checks).

Constraints:
- Use least-disruptive first; escalate only if indicators persist.
- Provide exact firewall/NSG rule patterns rather than “block suspicious traffic”.
- Note legal/regulatory impacts if containment affects evidence integrity.

Context:
- Case ID: [CASE_ID]; anchor event: [ANCHOR_EVENT] at [TS].
- Artifacts provided: [DISK_IMAGE|MEMORY_DUMP|EDR_EXPORT|WINDOWS_EVTX|LINUX_LOGS|CLOUDTRAIL].
- Timezone: [TZ]; clock skew known: [SKEW_MINUTES].

Task:
- Build a unified, deduplicated forensic timeline with event provenance.
- Mark inferred timestamps explicitly and separate them from observed ones.

Output (strict):
1) Timeline_v1 (CSV):
ts_utc,ts_local,source,host,user,event_type,detail,provenance(observed|inferred),artifact_ref
2) Gaps_v1 (table):
- Window
- Missing Source
- Impact (Low/Med/High)
- Suggested Collection
3) Keyfindings_v1 (bullets): 5–10 items each with evidence references.

Constraints:
- Correct timestamps for [SKEW_MINUTES] across sources; include both UTC and local.
- Never blend observed and inferred times; provenance must be explicit.
- If artifacts conflict, prefer sources with higher timestamp trust (order: EDR > kernel logs > app logs > user-adjustable logs).

Context:
- Incident type: [BREACH|OUTAGE|PHISHING|RANSOMWARE|DATA_EXFIL].
- Audience: [EXECUTIVES|CUSTOMERS|REGULATORS|EMPLOYEES].
- Disclosure requirements: [JURISDICTIONS], notification window: [HOURS/DAYS].
- Known facts vs hypotheses: [FACTS], [HYPOTHESES].

Task:
- Draft clear, factual communications tailored to each audience, separating facts from ongoing investigation items.
- Include Q&A and action items.

Output (strict):
1) Messages_v1 (per audience):
- Subject/Title
- Key Facts (bullets)
- What We Are Doing (bullets)
- What You Should Do (bullets)
- Timeline/Cadence
- Contact/Hotline
2) QnA_v1: 10 likely questions with concise, non-speculative answers.
3) Reg_Disclosure_Map_v1 (table):
- Jurisdiction
- Trigger
- Deadline
- Required Elements
- Owner

Constraints:
- No speculative statements; label uncertainties clearly.
- Ensure consistency across audiences while adjusting technical depth.
- Include legal review placeholder and approval chain before external release.

Context:
- Incident summary: [INCIDENT_SUMMARY], impact: [IMPACT_METRICS], dates: [START]-[END].
- Teams involved: [TEAMS], tools: [TOOLS], constraints: [CONSTRAINTS].

Task:
- Produce a PIR document structure that captures lessons learned and prioritizes durable fixes.
- Apply “Five Whys” and classify control failures (prevent/detect/respond).

Output (strict):
1) PIR_v1 (sections with numbered headings):
1. Executive Summary
2. Timeline (high-level)
3. Impact (quantified)
4. Root Cause Analysis (Five Whys)
5. Control Failures (Prevent/Detect/Respond)
6. What Went Well / What Didn’t
7. Action Items (RACI + due dates)
8. Metrics and Follow-up (leading/lagging)
2) Action_Items_v1 (table):
- Task
- Owner (R/A/C/I)
- Due Date
- Dependency
- Success Metric
3) Metrics_v1 (JSON):
{"time_to_detect":"hh:mm","time_to_contain":"hh:mm","time_to_recover":"hh:mm","false_positive_rate":"%","automation_coverage":"%"}

Constraints:
- Make action items “testable” with success metrics.
- Distinguish tactical patches vs systemic improvements; prioritize systemic fixes.
- Avoid blame language; focus on control and process improvement.

Context:
- Evidence types: [DISK_IMAGE|MEM_DUMP|LOG_EXPORT|CLOUD_SNAPSHOTS|EMAIL_EXPORT].
- Storage locations: [EVIDENCE_REPO], retention: [DAYS], encryption: [METHOD].
- Legal hold: [YES/NO], case ID: [CASE_ID].

Task:
- Generate preservation checklists and chain-of-custody records with unique IDs.
- Include hash verification steps and access controls.

Output (strict):
1) Preservation_Checklist_v1 (ordered steps per evidence type).
2) Chain_of_Custody_v1 (CSV):
item_id,case_id,evidence_type,collector,ts_acquired,hash_algo,hash_value,storage_location,access_list,notes
3) Verification_Steps_v1:
- Hash verify commands (per OS)
- Access control review
- Periodic integrity checks (cadence)

Constraints:
- Use deterministic item_id format: CASE-[CASE_ID]-[SEQ].
- Never store keys and evidence in the same system; flag if [EVIDENCE_REPO] includes keys.
- Require dual-approval before evidence transfer across regions.

Context:
- On-call rotations: [TEAM_ROTATIONS], coverage gaps: [GAPS], tools: [PAGING_TOOL].
- Incident severities: P1/P2/P3 definitions in your org: [SEVERITY_DEFS].
- Business hours: [START]-[END] [TZ], critical events: [CRITICAL_EVENTS_LIST].

Task:
- Define escalation triggers, timing, and paging rules with fallback.
- Include auto-escalation on no-ack, and comms channels.

Output (strict):
1) Escalation_Policy_v1 (table):
- Severity
- Trigger Conditions (concrete)
- Page Target (role/team)
- Ack Timeout
- Auto-Escalation Path
- Business Hours Differences
- Exceptions
2) Paging_Rules_v1 (JSON):
{"rules":[{"if":"condition","then":"action","timeout":"m","fallback":"action"}]}
3) Runbook_Snippets_v1: Command blocks or API calls for [PAGING_TOOL] to implement rules.

Constraints:
- Triggers must reference measurable events (e.g., alert name, event ID, threshold).
- Always define a human fallback if no on-call is set or tool fails.
- Include periodic test schedule and sample payloads for drills.

Section 3: Vulnerability Assessment (8 Prompts)

Context:
- Repo: [REPO_URL_OR_NAME], language(s): [LANGS], framework: [FRAMEWORK], critical components: [COMPONENTS].
- Scope: OWASP Top 10 [YEAR] items: [LIST]. Test type: static review only (no execution).
- SDLC gates: [PRE_COMMIT|PR|RELEASE].

Task:
- Review provided code snippets/diffs for Top 10 categories.
- Output findings with exact file:line references, proof-of-concept payloads where safe, and secure patterns.

Output (strict):
1) Findings_v1 (table):
- ID
- Category (OWASP)
- File:Line
- Evidence (code excerpt)
- Risk
- Exploit Scenario (concise)
- Recommended Fix (code)
2) Secure_Patterns_v1 (per framework):
- Anti-pattern → Secure pattern (with code)
- Library/Function recommendations (versions)
3) PR_Comments_v1: Inline-ready comments referencing commit/diff IDs.

Constraints:
- No destructive payloads; use harmless PoC strings (e.g., <svg onload=alert(1)> as indicator).
- If the snippet is incomplete, request additional context before rating risk.
- Prefer framework-native security controls over custom sanitization.

Context:
- SBOM format: [SPDX|CycloneDX], file: [PATH_OR_CONTENT].
- Runtime environ: [RUNTIME], deployment: [CONTAINER|VM|SERVERLESS], internet egress: [YES/NO].
- Risk sources to use: [NVD], [CISA KEV], [EPSS], [OSS_SCORECARD].

Task:
- Parse SBOM, normalize packages, match against vulnerability feeds and KEV.
- Calculate risk combining CVSS, EPSS, KEV presence, and runtime exposure.

Output (strict):
1) Vuln_Risk_v1 (table):
- Package@Version
- CVE
- CVSS
- EPSS
- KEV (Y/N)
- Runtime Exposure (Y/N)
- Fix Version
- Priority (P1–P3)
2) Exceptions_v1 (JSON): known false positives/exclusions provided by you (leave null if none).
3) Remediation_Plan_v1:
- Batching strategy (by service)
- Test impact notes
- Change window suggestions

Constraints:
- Deduplicate transitive deps; show highest-risk path.
- If Fix Version unknown, propose vendor tracking links and interim mitigations.
- Document assumptions on runtime exposure if not provided (flag clearly).

Context:
- Platform: [LINUX_DISTRO|WINDOWS|K8S|AWS|AZURE|GCP].
- Target baseline: [CIS_PROFILE_LEVEL] (e.g., Level 1 Server).
- Evidence: [CONFIG_EXPORTS], [COMMAND_OUTPUTS], [SCREENSHOTS_REFERENCES].

Task:
- Compare evidence to CIS controls.
- Produce gap list with remediation commands and verification steps.

Output (strict):
1) CIS_Gap_Analysis_v1 (table):
- Control ID
- Finding
- Evidence (line/ref)
- Risk
- Remediation (command/config)
- Verification
2) Exceptions_v1 (table):
- Control ID
- Business Justification
- Compensating Controls
- Review Date
3) Audit_Pack_v1 (JSON): {"files":["path"],"notes":["string"]}

Constraints:
- Reference exact CIS control IDs and version.
- Where multiple platform flavors exist, clearly tag the flavor in Remediation.
- If a screenshot is referenced, describe the exact setting seen (no vague mentions).

Context:
- API type: [REST|GraphQL|gRPC], base URL: [BASE_URL], auth: [OAUTH2|API_KEY|JWT|MTLS].
- Specs: [OPENAPI/GRAPHQL_SCHEMA], sensitive resources: [ENDPOINTS].
- Non-prod environment: [STAGING_URL] with test accounts [TEST_ACCOUNTS].

Task:
- Create a testing plan covering auth, input validation, business logic, and rate limiting.
- Provide specific test cases with request/response examples and expected outcomes.

Output (strict):
1) Test_Plan_v1 (table):
- Area
- Test Case
- Request (example)
- Expected Response/Status
- Risk
2) Abuse_Cases_v1: Business logic abuse scenarios (step-by-step).
3) Rate_Limit_Tests_v1: Scripts/snippets (curl/httpie) respecting safe limits.

Constraints:
- No destructive payloads or data exfil in tests; use synthetic data.
- Respect robots and ToS; confine to [STAGING_URL].
- Include negative tests for auth bypass and IDOR with explicit IDs.

Context:
- Cloud: [AWS|AZURE|GCP], accounts/projects/subscriptions: [LIST_IDS].
- Tooling: [CSPM_TOOL], IaC: [TERRAFORM|CLOUDFORMATION|BICEP].
- Known risks: [PUBLIC_BUCKETS|OVERPRIV_ROLES|EXPOSED_KEYS|DEFAULT_CREDs].

Task:
- Generate checks for critical misconfigs and queries to validate in logs.
- Include IaC guardrails and auto-remediation patterns.

Output (strict):
1) Misconfig_Checks_v1 (table):
- Control
- Detection Method (API/Log/IaC policy)
- Query/Policy (ready-to-use)
- Severity
- Auto-Remediation (Y/N)
- Roll-back
2) Least_Privilege_Roles_v1: Role templates with explicit permissions and justifications.
3) IaC_Policies_v1: Rego/Policy-as-code snippets with descriptions.

Constraints:
- Explicitly reference cloud-native services and API names.
- For auto-remediation, include pre-checks and idempotency notes.
- Map each check to a relevant framework tag (CIS, NIST, ISO) when applicable.

Context:
- Vulnerability: [CVE_OR_ZERODAY_PLACEHOLDER], product: [VENDOR/PRODUCT/VERSION], known exploits: [YES/NO/UNKNOWN].
- Exposure: [INTERNET_FACING_COUNT], [INTERNAL_COUNT], critical systems: [LIST].
- Constraints: [PATCH_AVAILABILITY], [MAINTENANCE_WINDOWS], [REGULATORY].

Task:
- Create a runbook for assessment, containment, detection, and remediation.
- Include temporary mitigations and validation steps.

Output (strict):
1) Runbook_v1 (sections):
- Assess (inventory, fingerprinting)
- Contain (network/app-layer)
- Detect (queries/signatures)
- Mitigate (config flags, WAF, feature toggles)
- Patch/Upgrade (plan)
- Validate (post-change checks)
2) Detection_Artifacts_v1:
- SIEM queries (dialect-tagged)
- EDR/YARA-like patterns (high-level if exact syntax unknown)
3) Risk_Comm_v1: Business summary with decision points and tradeoffs.

Constraints:
- Prioritize internet-facing systems; document risk acceptance if delays exist.
- Provide reversible mitigations where possible.
- Note monitoring blind spots and propose compensating detective controls.

Context:
- Vulnerability list: [CSV_OR_JSON_WITH_CVES], assets: [ASSET_LIST], maintenance windows: [SCHEDULE].
- Telemetry: exploit attempts seen [YES/NO], external exposure [YES/NO], business criticality mapping [ASSET_CRIT_MAP].

Task:
- Prioritize patching using CVSS, EPSS (latest), KEV, exposure, and business criticality.
- Output a ranked backlog with batching and due dates.

Output (strict):
1) Patch_Priority_v1 (table):
- CVE
- Asset(s)
- CVSS
- EPSS
- KEV (Y/N)
- Exposure (Ext/Int)
- Business Criticality
- SLA (date)
- Batch ID
2) Scheduling_Plan_v1: Group by ownership/team and window.
3) Exceptions_v1 (JSON): risk acceptances with expiry.

Constraints:
- If EPSS missing, estimate risk using analogs and flag as “EPSS-EST”.
- Assign tighter SLAs for KEV and external exposure.
- Optimize for minimal restarts per batch while hitting highest risk first.

Context:
- Domains: [DOMAINS], IP ranges: [CIDRS], cloud accounts: [CLOUD_IDS].
- Data sources: [DNS|CERT_TRANSPARENCY|SHODAN_EXPORT|CLOUD_ASSETS|REPO_SEARCH].
- In-scope: [YES/NO] for subdomains and subsidiaries; out-of-scope list: [EXCLUSIONS].

Task:
- Enumerate assets, classify exposure, identify risky services, and produce a deduped inventory.
- Highlight orphaned assets and shadow IT indicators.

Output (strict):
1) Inventory_v1 (table):
- Asset
- Type (Host|Service|Domain|Cert)
- Exposure (Ext/Int)
- Owner (if known)
- Risk Signal (port/service/banner)
- Last Seen
- Next Step
2) ShadowIT_Signals_v1: Heuristics (e.g., cert org mismatch, repo references, DNS NS anomalies).
3) Validation_Queries_v1: DNS/CT/Cloud APIs to confirm ownership.

Constraints:
- Deduplicate by FQDN, IP:port, and cert SAN; keep the richest record.
- Mark assets with no owner as “UNOWNED” and propose discovery paths.
- Respect out-of-scope exclusions strictly; list them separately if encountered.

Section 4: Compliance Automation (8 Prompts)

Context:
- SOC 2 Type: [TYPE_I|TYPE_II], Trust Services Criteria: [SECURITY|AVAILABILITY|CONFIDENTIALITY|PRIVACY|PROCESSING_INTEGRITY].
- Audit window: [START]-[END], systems in scope: [SYSTEMS], tools: [TOOLS].

Task:
- Generate an evidence request list mapped to SOC 2 CCs.
- Include collection owners, frequency, and acceptable artifact formats.

Output (strict):
1) Evidence_Requests_v1 (table):
- Control (e.g., CC7.1)
- Evidence Description
- Owner
- Frequency
- Format (screenshot/log/export/policy)
- Acceptance Criteria
2) Sample_Selection_v1: Sampling approach for Type II (size, method).
3) Evidence_Tracker_v1 (CSV):
control,item_id,owner,due_date,status,location,notes

Constraints:
- Use SOC 2 2017 (or specify your version) control identifiers.
- Avoid collecting redundant artifacts; reference reusability across controls.
- Include retention and access controls notes for evidence handling.

Context:
- Business processes: [PROCESS_LIST], systems: [SYSTEMS], data categories: [PERSONAL_DATA_CATEGORIES], geographies: [COUNTRIES].
- Legal bases: [CONSENT|CONTRACT|LEGAL_OBLIGATION|LEGITIMATE_INTERESTS], processors/controllers: [PARTIES].

Task:
- Build a Record of Processing Activities (ROPA) and data flow map.
- Identify cross-border transfers and DPIA candidates.

Output (strict):
1) ROPA_v1 (table):
- Process
- Purpose
- Data Categories
- Data Subjects
- Legal Basis
- Retention
- Recipients/Processors
- Transfers (Y/N + countries)
- Security Measures
2) Data_Flow_v1 (JSON):
{"nodes":[{"name":"System","type":"app|db|saas","geo":"country"}],"edges":[{"from":"A","to":"B","data":"category"}]}
3) DPIA_Candidates_v1: List with rationale and next steps.

Constraints:
- Use precise legal basis terms and tie each to a process.
- If retention unknown, flag and propose policy placeholders.
- Note SCCs or appropriate safeguards for transfers if applicable.

Context:
- PCI version: [PCI_VERSION], scope: [CDE_BOUNDARY_DESC], payment channels: [E_COMMERCE|POS|MOTO].
- Technologies: [P2PE|TOKENIZATION|SEGMENTATION], providers: [PSP|ACQUIRER].

Task:
- Map current controls to PCI requirements and identify gaps.
- Propose remediation steps and evidence collection for ROC/SAQ.

Output (strict):
1) PCI_Gaps_v1 (table):
- Req#
- Current State
- Gap
- Risk
- Remediation
- Evidence Needed
2) Scope_Map_v1: Narrative and diagram notes for CDE vs out-of-scope systems.
3) Compensating_Controls_v1: Structured per PCI guidance.

Constraints:
- Reference exact PCI requirement numbers and sub-requirements.
- Be explicit about segmentation evidence (configs, test results).
- If P2PE/Tokenization present, reflect reduced scope appropriately.

Context:
- Target framework: [CSF|800-53], profile: [CATEGORY/TIER|BASELINE], systems: [SYSTEMS_IN_SCOPE].
- Current policies/controls: [POLICY_LIST], metrics: [METRICS].

Task:
- Map current controls to target categories/controls.
- Identify maturity gaps and propose measurable improvements.

Output (strict):
1) Mapping_v1 (table):
- Control/Category
- Current Capability
- Gap
- Maturity (1–5)
- Improvement Objective
- Metric/KPI
2) Roadmap_v1 (quarterly):
- Milestone
- Owner
- Dependencies
- Budget Class (CapEx/OpEx)
- Risk Reduction Estimate
3) Metrics_Def_v1 (JSON): definitions and formulas.

Constraints:
- Use NIST identifiers (e.g., PR.AC-1, AC-2).
- Propose improvements that are evidenceable (log, ticket, config).
- Ensure metrics are automatable where possible.

Context:
- Audit type: [SOC2|ISO27001|HIPAA|SOX], auditor: [AUDITOR_NAME], fieldwork dates: [DATES].
- Internal owners: [LIST], evidence repositories: [LOCATIONS].

Task:
- Build a work-back schedule and checklist for audit readiness.
- Include mock interviews and artifact index.

Output (strict):
1) Calendar_v1 (table):
- Date
- Task
- Owner
- Duration
- Dependencies
- Artifact(s)
2) Interview_Prep_v1: Topics and likely questions per control domain.
3) Artifact_Index_v1 (CSV):
artifact_id,control,location,owner,version,notes

Constraints:
- Sequence tasks to de-risk critical path first.
- Include buffer time for evidence re-collection.
- Align artifact naming with auditor conventions.

Context:
- Policy type: [ACCESS_CONTROL|ACCEPTABLE_USE|VULN_MGMT|INCIDENT_RESPONSE|BACKUP|ENCRYPTION].
- Framework alignment: [SOC2|ISO27001|NIST], audience: [ALL_EMPLOYEES|ENGINEERING|OPS].
- Enforcement mechanisms: [TECHNICAL_CONTROLS], exceptions process: [PROCESS].

Task:
- Draft a concise, enforceable policy mapped to controls.
- Include roles/responsibilities and measurable requirements.

Output (strict):
1) Policy_v1 (sections):
- Purpose
- Scope
- Roles & Responsibilities
- Policy Statements (numbered, testable)
- Exceptions
- Enforcement
- References (control IDs)
2) Control_Map_v1 (table):
- Policy Statement ID
- Framework Control
- Evidence Type
- Owner
3) Procedures_Link_v1: Procedure topics and owners (separate from policy).

Constraints:
- Keep policy statements auditable and unambiguous.
- Avoid duplicating procedures within the policy; link them.
- Include an exceptions approval workflow with SLAs.

Context:
- Risk taxonomy: [STRATEGIC|OPERATIONAL|COMPLIANCE|SECURITY], scoring model: [LIKELIHOOD x IMPACT|FAIR], appetite: [STATEMENT].
- Existing register: [CSV_OR_JSON], review cadence: [CADENCE].

Task:
- Normalize risks, score them, and propose treatments and owners.
- Generate dashboards metrics.

Output (strict):
1) Risk_Register_v1 (table):
- Risk ID
- Title
- Category
- Likelihood (1–5)
- Impact (1–5)
- Score
- Treatment (Avoid/Reduce/Transfer/Accept)
- Owner
- Due Date
- Residual Score
2) Heatmap_Data_v1 (JSON): suitable for charting.
3) Review_Agenda_v1: Topics and decisions needed.

Constraints:
- Reference control gaps or incidents where applicable.
- If FAIR chosen, include ranges and notes on uncertainty.
- Expire accepted risks within a fixed window unless renewed.

Context:
- Vendor type: [SAAS|IaaS|Consulting|Payment Processor], data sensitivity: [LEVEL], integrations: [INTEGRATIONS].
- Questionnaires: [CAIQ|SIG|CUSTOM], evidence provided: [SOC2|ISO27001|PEN_TEST|SIG_RESULTS].

Task:
- Generate a right-sized questionnaire, scoring rubric, and follow-up evidence requests.
- Output contract clauses for key security requirements.

Output (strict):
1) Questionnaire_v1 (sections with 8–12 targeted questions each):
- Governance
- Access Control
- Secure SDLC
- Vulnerability Management
- Incident Response
- Business Continuity
- Data Protection & Privacy
- Subprocessors
2) Scoring_Rubric_v1 (table):
- Question
- Weight
- Scoring Guidance (0–5)
- Evidence Required
3) Followup_Requests_v1: Specific artifacts to request with acceptance criteria.
4) Contract_Clauses_v1: Security requirements (e.g., breach notification windows, encryption standards).

Constraints:
- Avoid boilerplate; tailor depth to [LEVEL] and [INTEGRATIONS].
- Prefer objective evidence (policies, logs, test reports) over narrative.
- Include a remediation plan template for “yellow” findings.

Conclusion: Building a Security Prompt Library

Treat these 30 prompts as seed templates for your internal prompt library. Standardize them in your knowledge base, pre-filled with your environment constants (SIEM dialect, log schemas, asset criticality tiers, control IDs, paging rules). Establish a change process: peer review prompts quarterly, tag versions (v1.x), and maintain a prompt-to-outcome traceability index so analysts can cite which template generated which artifact.

Operationalize the outputs by integrating them into pipelines: pipe JSON or tables into your SIEM, case management, CSPM, or GRC tools. For high-stakes tasks (containment, zero‑day mitigation), require a second reviewer to validate assumptions and commands before execution. Expand this library by capturing successful hunts, detections, PIR learnings, and control updates—then fold the improvements back into the prompts with tighter schemas and validation steps.

For further exploration and complementary templates, see 35 ChatGPT-5.5 Prompts for Supply Chain Managers and How to Build an AI Agent with GPT-5.4 in 2026. Keep prompts specific, contextual, and schema-driven; that discipline is what turns a general model into a dependable security copilot.