Security incidents combine the worst writing conditions — time pressure, legal exposure, incomplete facts — with the highest cost of a wrong sentence.
Tier: Core · Hands-on time: ~35 minutes
AI reliably cuts drafting time for status updates, exec briefings, and containment checklists; it just as reliably invents comforting phrases ("no evidence of data access") that a lawyer, a regulator, or an attacker's timeline will later contradict. This playbook sets up the drafting scaffolding before you need it, with a hard human gate on every send and every containment action.
This playbook is about drafting and coordination. Forensics conclusions, legal language for regulator notifications, and disclosure decisions are not AI tasks — they are counsel-and-IR-lead tasks that consume your drafts.
Before any incident: build the scenario pack. For your top 4–5 scenario classes, have AI draft a containment checklist (isolate, preserve evidence, revoke, rotate, verify) and comms skeletons per audience (engineering, exec, client, status page). Review with your security lead; store in the incident tool. Under pressure you will edit, not compose.
During: draft only from the facts log.
Security incident in progress. Attached: timestamped facts log and
current hypothesis list (marked as hypotheses).
Draft an internal update for engineering leadership:
- What is CONFIRMED (only from the facts log, with timestamps)
- What is SUSPECTED (clearly labeled, from the hypothesis list)
- Containment actions taken and in progress
- What we need from readers (access, decisions, staffing)
Rules: no speculation beyond the hypothesis list; no reassuring claims
of absence ("no data was accessed") unless the facts log explicitly
states the evidence for absence; no attribution guesses.
Strip the comfort phrases. Before the approver sees it, scan the draft for the classic hallucinated reassurances: "no evidence of", "we have confirmed that no", "limited to". Each survives only if the facts log backs it verbatim. This 60-second pass is the highest-value edit in security comms.
Adapt per audience, one source of truth. Generate exec, client, and status-page variants from the same internal update — never drafted independently, or their inconsistencies become the story. Client/regulatory text goes through legal; the AI can maintain a diff table showing exactly what each audience is and is not being told.
Run containment as checklist-with-approvals. The scenario checklist becomes the live tracker: AI keeps it updated from the war-room channel (done/blocked/awaiting-approval per item), but every containment action — revoking keys, isolating workloads, blocking egress — is executed by a named human after IR-lead approval. No agentic execution during security incidents.
After: draft the security postmortem with claim verification. Assemble the facts log, chat transcript, and actions into a blameless postmortem draft; then verify claim-by-claim against artifacts (same discipline as reliability postmortems, higher stakes). The verified timeline also feeds any regulatory clock — India note: CERT-In's 6-hour reporting window for covered incident types makes the pre-built templates and facts-log discipline operationally decisive.
The most dangerous AI output in a security incident is a fluent sentence claiming absence of compromise — absence claims require evidence of absence, logged and cited.
In security incidents AI compresses drafting time, not decision time — the facts log in, labeled uncertainty out, human signature on everything that moves.