AI Prompts for Cybersecurity Analysts: Threat Hunting, IR, Audits

Published: July 2026 | 9 min read

Cybersecurity analysts face an asymmetric battle — attackers only need to find one gap, while you need to defend everything. AI can help you triage alerts faster, write incident response plans, assess vulnerabilities, and build threat models. But security prompts require precision: vague outputs can lead to missed threats or false confidence.

Threat Intelligence & Hunting

1. Threat Intelligence Brief

Role: Cyber threat intelligence analyst
Task: Create a threat intelligence brief for [organization/sector].
Sector: [Industry, size, geography, threat profile]
Time period: [last 24 hours / week / month]
Include:
1. Active Threats (3-5 current campaigns relevant to our sector)
   - Threat actor (name/alias, sophistication level, motivation)
   - TTPs (MITRE ATT&CK techniques used)
   - Indicators of Compromise (IPs, domains, hashes, behaviors)
   - Targeted systems/applications
   - Recommended detections (what to look for in our environment)
2. Vulnerability Alerts (newly disclosed CVEs relevant to our stack)
   - CVE ID, CVSS score, affected systems
   - Exploitation status (active exploit? PoC available?)
   - Patch availability and urgency
   - Workaround if patch is not ready
3. Sector Trends (what is the broader trend? are attacks increasing?)
4. Recommended Actions (top 3 things to do this week)
Format: Threat intel brief for the CISO and security team.
Constraint: All claims must have sources. No speculation presented as fact.

2. Threat Hunting Hypothesis Generator

Role: Threat hunting specialist
Task: Generate threat hunting hypotheses for [environment/sector].
Environment: [OS platforms, cloud, endpoints, network, applications]
Recent intelligence: [Any new TTPs, campaign info, or anomalies]
For each hypothesis:
1. Hypothesis statement (If [adversary behavior] is occurring, we would see [observable artifact])
2. MITRE ATT&CK technique reference (T-ID, tactic, technique)
3. What to look for (specific log sources, event IDs, fields, values)
4. Detection logic (Splunk/KQL/Sigma rule pseudo-code)
5. Data sources needed (which logs, which endpoints, which time range)
6. Expected false positive rate (and how to reduce it)
7. What a confirmed finding means (severity, escalation)
8. Next steps if hypothesis is confirmed
Generate 8-10 hypotheses covering: initial access, persistence, lateral movement, data exfiltration, credential access.
Format: Threat hunting playbook entry ready for execution.

3. Attack Surface Assessment

Role: Security assessment analyst
Task: Assess the attack surface of [organization/system].
Known assets: [External IPs, domains, web apps, APIs, cloud services, remote access]
For each asset category:
1. What is exposed? (specific assets, count)
2. What should NOT be exposed? (findings to investigate)
3. What version/firmware? (known vulnerabilities?)
4. Authentication required? (or open to internet?)
5. Last vulnerability scan date
6. Known issues (open CVEs, config weaknesses)
7. Risk rating (Critical/High/Medium/Low)
Assessment areas:
1. Internet-facing services (web, email, VPN, APIs)
2. Cloud exposure (public S3 buckets, open security groups, exposed services)
3. DNS (subdomain takeover, dangling records, spoofing risk)
4. Third-party/integrations (exposed vendor portals, API keys)
5. Remote access (VPN, RDP, SSH, remote desktop)
6. Wireless (if applicable)
Output:
1. Attack surface inventory with risk ratings
2. Top 5 immediate remediation actions
3. Recommendations for reducing exposure
Format: Attack surface report for security leadership.

Incident Response

4. Incident Response Plan Template

Role: Incident response planner
Task: Create an IR plan for [incident type — phishing, ransomware, data breach, DDoS, insider threat].
Incident severity levels: SEV1 (critical), SEV2 (high), SEV3 (medium), SEV4 (low)
IR phases:
1. Preparation (before: tools, contacts, runbooks, training)
2. Detection & Analysis (how we identify the incident, triage steps)
3. Containment (short-term: isolate, block; long-term: eradicate)
4. Eradication (remove malware, close vulnerabilities, reset credentials)
5. Recovery (restore from backup, verify integrity, monitor for recurrence)
6. Post-Incident Activity (lessons learned, reporting, improvements)
For each phase:
1. Actions (specific, step by step)
2. Who is responsible (role, not name)
3. Decision authority (who makes the call on containment, eradication, recovery)
4. Tools needed (specific software, access, permissions)
5. Communication (internal updates, external notifications, customer comms)
6. Documentation (what to record, where, template)
7. Timeline expectations (how fast should each phase happen)
Output: Complete IR plan document ready for team adoption.

5. Alert Triage Assistant

Role: SOC analyst (tier 2)
Task: Help triage this security alert.
Alert details: [Paste alert — source, type, severity, affected system, user, timestamp]
Initial assessment:
1. Alert type classification (true positive, false positive, benign true positive)
2. Severity assessment (based on asset value, impact, exploitability)
3. Related context (has this user/host triggered alerts before? is this normal behavior?)
4. Initial triage questions:
   - Is the affected system critical? (production? sensitive data?)
   - Is the user privileged? (admin? service account?)
   - Is the activity anomalous? (first time? unusual time? unusual location?)
   - Are there correlated alerts? (other systems showing similar activity?)
5. Next investigation steps (specific log queries, systems to check)
6. Containment recommendation (if severity is high, what to do NOW)
7. Escalation decision (does this need tier 3 / IR team?)
Output: Alert triage report with recommended actions.
Constraint: When in doubt, escalate. Do not dismiss an alert without evidence.

6. Phishing Analysis Workflow

Role: Email security analyst
Task: Analyze this suspected phishing email.
Email: [Paste headers, sender, subject, body, attachments, URLs]
Analysis steps:
1. Authentication check (SPF, DKIM, DMARC — pass/fail?)
2. Header analysis (originating IP, routing path, anomalies)
3. Sender analysis (display name vs actual address, domain age, reputation)
4. URL analysis (redirect chains, newly registered domains, typosquatting)
5. Attachment analysis (file type, hash check, sandbox recommendation)
6. Content analysis (urgency cues, credential harvest indicators, brand impersonation)
7. Infrastructure check (URL IPs, SSL cert, hosting provider, reputation)
8. Scope assessment (how many recipients? did anyone click?)
Output:
1. Verdict (Phishing / Spam / Safe — with confidence level)
2. Indicators of Compromise (IOCs to add to blocklists)
3. Actions taken (what we did, what still needs doing)
4. User communication (what to tell the recipient)
5. Prevention recommendations (what rules to add to prevent recurrence)
Format: Phishing analysis report for the SOC.

Vulnerability Management

7. Vulnerability Triage & Prioritization

Role: Vulnerability management analyst
Task: Prioritize this vulnerability scan results.
Scan data: [Paste or describe — CVEs, CVSS scores, affected assets, count]
Prioritization framework:
For each vulnerability:
1. CVSS base score
2. Asset criticality (what system is affected? how important?)
3. Exposure (is it internet-facing? internal only? needs auth?)
4. Exploitability (active exploit? PoC? weaponized? nothing?)
5. Business impact (what happens if exploited?)
6. Patch availability (fix available? workaround? nothing?)
7. Dependencies to patch (does patching require downtime? testing?)
Priority tiers:
- P1: Fix within 24 hours (actively exploited + critical asset + internet-facing)
- P2: Fix within 7 days (high CVSS + critical asset OR active exploit + non-critical)
- P3: Fix within 30 days (high CVSS + non-critical OR medium CVSS + critical)
- P4: Fix in next maintenance window (medium/low risk)
Output:
1. Prioritized vulnerability list
2. Patching plan with timeline
3. Exceptions/variances (where we accept risk, with justification and owner)
4. Metrics: total vulns, by severity, by asset, trend
Format: Vulnerability management report for security leadership.

8. Penetration Test Report Template

Role: Penetration testing report writer
Task: Create a penetration test report for [engagement scope].
Engagement: [Dates, scope, methodology, testers]
Executive Summary (for leadership):
1. Overall risk rating (Critical/High/Medium/Low)
2. Key finding: could we breach? how far did we get?
3. Top 3 risks that need immediate attention
4. Positive findings (what was secure)
Technical Findings:
For each finding:
1. Finding ID and title
2. Severity (Critical/High/Medium/Low/Info)
3. CVSS score (if applicable)
4. Affected system(s)
5. Description (what is the vulnerability?)
6. Proof of concept (steps to reproduce — sanitized)
7. Impact (what an attacker could do)
8. Remediation (specific, actionable fix)
9. References (CVE, OWASP, vendor advisory)
10. Re-test recommendation (when to verify the fix)
Appendix:
1. Methodology
2. Tools used
3. Raw scan data summary
Format: Professional pentest report suitable for client delivery.
Constraint: Proof of concept must be detailed enough to reproduce but sanitized to avoid script-kiddie use.

Security Operations & Compliance

9. Security Metrics Dashboard

Role: Security operations metrics analyst
Task: Design a security metrics dashboard for [audience].
Audience: [CISO / Security team / Board]
Metrics:
1. Operational: Mean time to detect (MTTD), mean time to respond (MTTR), alert volume, false positive rate
2. Vulnerability: Open vulns by severity, patch SLA compliance, oldest unpatched critical
3. Threat: Phishing emails blocked, malware blocked, blocked intrusion attempts
4. Compliance: Policy violations, failed audits, access review completion
5. Awareness: Training completion rate, phishing simulation fail rate
6. Incident: Open incidents by severity, days since last incident, incidents by type
For each metric:
1. Definition (exact formula)
2. Target (what good looks like)
3. Alert threshold (when to worry)
4. Data source
5. Trend direction (is up good or bad?)
6. Visualization type (trend, gauge, heatmap, number)
7. Frequency (real-time, daily, weekly, monthly)
Output: Dashboard specification ready for implementation.
Include: Board-level summary (3-5 metrics that tell the security story).

10. Security Awareness Training Plan

Role: Security awareness program manager
Task: Create a security awareness training plan for [organization].
Audience segments: All staff, developers, executives, IT/ops, new hires
For each segment:
1. Topics (what they need to know — segment specific)
2. Format (e-learning, live session, micro-learning, newsletter)
3. Frequency (onboarding, annual, quarterly, monthly)
4. Assessment (quiz, simulation, acknowledgment)
5. Metrics (completion rate, pass rate, repeat failures)
Core topics:
1. Phishing recognition and reporting
2. Password hygiene and MFA
3. Data handling and classification
4. Physical security (tailgating, clear desk)
5. Incident reporting (how, when, who)
6. Social engineering (phone, in-person, email)
7. Remote work security (VPN, home network, public WiFi)
8. Acceptable use policy
Special topics for developers:
1. Secure coding (OWASP Top 10)
2. Secret management (no keys in code)
3. Dependency security
Format: Annual training calendar with content plan for each segment.

11. Cloud Security Assessment

Role: Cloud security auditor
Task: Assess the security posture of [cloud account — AWS/GCP/Azure].
Assessment areas:
1. IAM (users, roles, policies — least privilege? MFA? key rotation? unused accounts?)
2. Network (security groups, NACLs, VPC peering, public exposure)
3. Storage (S3/bucket public access, encryption, lifecycle, access logs)
4. Compute (instance exposure, security groups, patching, hardening)
5. Database (encryption, public access, backups, audit logging)
6. Monitoring (CloudTrail, config rules, guard duty, alerts)
7. Compliance (CIS benchmarks, regulatory requirements)
8. Secrets management (how are secrets stored? rotation?)
9. Container/K8s (if applicable — image scanning, RBAC, network policies)
10. Cost/anomaly (any unusual spend that could indicate compromise?)
For each area:
1. Check (what to verify)
2. How to check (console, CLI, script)
3. Pass criteria
4. Risk if non-compliant
5. Remediation
Generate 40-50 checks.
Format: Cloud security assessment checklist ready for execution.

12. Tabletop Exercise Design

Role: Tabletop exercise facilitator
Task: Design a tabletop exercise for [scenario — ransomware, data breach, insider threat, supply chain attack].
Participants: [Roles — CISO, IR lead, legal, comms, IT, HR, exec]
Exercise design:
1. Scenario background (inject 1: initial situation)
2. Timeline (injects every 10-15 minutes, escalating severity)
3. Decision points (what choices do participants face?)
4. Expected outcomes (what good looks like, what bad looks like)
5. Observer/evaluator roles (who watches and takes notes)
6. Hotwash questions (debrief — what went well, what did not)
7. After-action report template (what to capture, who writes it)
Injects:
1. Initial detection (how do we find out?)
2. Escalation (it is worse than we thought)
3. Stakeholder pressure (media, customers, regulators asking questions)
4. Decision point (do we pay the ransom? do we shut down production?)
5. Resolution (what does recovery look like?)
Output: Complete tabletop exercise package with facilitator guide.
Format: Ready to run with 10-20 participants in a 2-hour session.

Best Practices

For more security and infrastructure content, see our ChatGPT prompts for DevOps engineers and AI prompts for system administrators.