Draft Patch Communications and Security Advisories with AI

AI drafts all three quickly and consistently, which is why this is a Foundation-tier task: the risk is a badly-worded advisory, not a shipped vulnerability. The discipline that keeps it professional is factual accuracy — every CVE, version number, severity, and date must be verified against source, because a wrong version in an advisory erodes exactly the trust the advisory needs.

When to reach for this

• •
  You've patched a vulnerability and need to communicate it — to customers, internal teams, or leadership — clearly and quickly.
• •
  You're producing several versions of one advisory for different audiences and want consistency without writing each from scratch.
• •
  You need a first draft that follows advisory conventions (affected versions, severity, remediation, workarounds) so nothing structural is missed.

The workflow

1. 1.

   Assemble the verified facts. CVE ID (if assigned), affected and fixed versions, severity and its basis, the actual impact, remediation steps, and any interim workaround. These are load-bearing; confirm each against source before drafting.

2. 2.

   Prompt for the audience-appropriate draft:

   Copy

   You are drafting a security advisory for a vulnerability we have fixed.
   Write a <customer-facing advisory / internal patch-now notice / exec
   summary> using ONLY the facts below — do not invent versions, dates, CVE
   numbers, or severity. If a field is missing, leave a clearly marked
   [TODO] rather than guessing.
   
   Structure: summary, affected versions, severity + basis, impact,
   remediation, workaround (if any), timeline.
   Tone: <calm and factual for customers / urgent and directive for ops /
   business-impact-focused for execs>.
   
   FACTS:
   - CVE: CVE-2026-XXXXX
   - Affected: 3.1.0-3.4.2 ; Fixed: 3.4.3
   - Severity: High (auth bypass, no user interaction)
   - Remediation: upgrade to 3.4.3
   

   Expected output: a structured advisory in the right register, with any unsupplied fact marked [TODO] rather than fabricated.

3. 3.

   Generate the audience variants from one fact set. Ask for all three from the same facts so severity and version numbers stay identical across them — inconsistency between the customer and internal versions is a credibility hit.

4. 4.

   Calibrate the severity language. Have the model justify the severity wording against the stated basis; adjust so urgency matches reality — neither alarmist nor minimizing.

5. 5.

   Fact-check against source, then route through the normal approval. Advisories are official communications; the AI draft is input to your existing review, not a bypass of it.

Verify before you trust it

• Verify every fact against source. CVE number, affected/fixed versions, dates, severity basis — check each against the ticket, the changelog, and the CVE record. A single wrong version number sends people to patch the wrong thing.
• Confirm no facts were invented. Models fill gaps helpfully and wrongly. Scan for any specific claim (a date, a version, a CVSS vector) you didn't supply — if it appeared without your input, delete or verify it.
• Confirm the severity is calibrated. Read it as a skeptical customer and as a rushed ops engineer — does the urgency match the actual impact? Over- and under-statement both cost you.
• Confirm consistency across variants. Diff the customer, internal, and exec versions for any factual disagreement. They must tell the same story at different depths.

Pitfalls

• Fabricated specifics. The failure mode of AI advisories is confident wrong versions or dates. Verify every number.
• Severity miscalibration. Alarmist advisories get ignored next time; minimizing ones get patches deferred. Calibrate deliberately.
• Inconsistent variants. Different severity or versions between audiences reads as sloppiness and undermines trust. Generate from one fact set and diff.
• Leaking exploit detail prematurely. A customer advisory that includes a working exploit or too-specific reproduction can arm attackers before customers patch. Keep public detail at the level needed to drive the upgrade.
• Skipping human approval. An advisory is an official statement; the draft accelerates it but does not replace sign-off.

Tools

• An LLM (Claude-class)drafts the structured advisory and the audience variants from a single verified fact set.
• CISA KEV catalogcheck whether the CVE is known-exploited; if it is, that belongs in the advisory and sharpens the urgency legitimately.
• EPSS (FIRST)exploitation-probability context to help calibrate how hard to push the patch timeline.

Client-safe variant

Advisories about a client's product disclose their vulnerabilities and sometimes unreleased fix details. Draft using only the facts cleared for the intended audience, and mark anything sensitive [TODO] for the client to fill rather than pasting embargoed detail into an external tool. Where the client bars public AI, run a local model for the drafting — advisory writing is pure text generation and needs no external feed. Route every draft through the client's own disclosure and legal review, never publish on their behalf, and confirm per-client tool approval before the first prompt.