The Security Operations Runbook
134 copy-paste AI prompts for defenders — threat models teams act on, incident response and breach communication, access reviews, vendor security questionnaires, tabletop exercises and awareness training people do not resent.
Key Capabilities & Features:
- •The Environment Primer: paste your systems, team size, regulatory context and what you are actually protecting once — every prompt after it writes for your situation
- •Defensive only — this covers protecting, detecting, responding and communicating, and contains no offensive tooling, exploit development or evasion material
- •Incident communication written for the phase where you do not yet understand what happened, which is when the first message has to go out
- •Phishing simulation designed without humiliation, because a programme that embarrasses people teaches them to hide clicks rather than report them
- •Policies written for the person doing their job rather than for an auditor, since the rule people route around is worse than no rule
- •134 prompts across 8 sections — threat modelling, incident response, breach & customer communication, access reviews & identity and more
- •Works with ChatGPT (GPT-5), Claude Opus 5 and Gemini 3.7 Flash — fill the bracket, paste, done
One-time payment • Lifetime access & future updates
What's Inside
8 modules134 promptsEvery module below is included in the single purchase.
- 1
Threat Modelling
20 promptsThreat models a team will actually act on rather than a diagram nobody revisits, scoping to one system at a time, and separating a plausible attacker from a theoretical one.
- 2
Incident Response
22 promptsThe first thirty minutes, roles assigned before you need them, evidence preserved while you are still containing, and deciding when an incident becomes a breach.
- 3
Breach & Customer Communication
20 promptsTelling customers something you do not yet fully understand, the notification that is honest without being reckless, regulator timelines, and the update nobody has to interpret.
- 4
Access Reviews & Identity
18 promptsReviewing who can reach what without it becoming an annual formality, the account belonging to someone who left, privilege that accumulated, and offboarding that actually removes access.
- 5
Vendor & Third-Party Risk
18 promptsSecurity questionnaires that ask useful questions, assessing a supplier honestly at your leverage, reading someone else's audit report, and the vendor you cannot say no to.
- 6
Tabletop Exercises
16 promptsScenarios that surface a real gap rather than confirming the plan, who must attend, running one without it becoming theatre, and writing up what actually failed.
- 7
Awareness & Phishing
12 promptsTraining people do not resent, phishing simulation done without humiliating anyone, making reporting easy and blameless, and what to do about the department that keeps clicking.
- 8
Policy That Gets Followed
8 promptsPolicies short enough to read, the rule people route around and why, exceptions handled openly, and writing for the person doing their job rather than for an auditor.
Test Workflow Execution in Your Browser
Verify actual prompt structure, token speed, and reasoning depth before downloading.
Frequently Bought Together
Technical Specifications
Architecture & System Overview
The organisations that handle a breach badly are almost never the ones that were surprised by it. They are the ones who had a plan in a document nobody had opened, and who spent the first four hours deciding who was in charge.
The Security Operations Runbook is a 134-prompt playbook covering threat modelling, incident response, breach and customer communication, access reviews and identity, vendor and third-party risk, tabletop exercises, awareness and phishing, and policy that gets followed.
Start with the Environment Primer — paste in your systems, team size, regulatory context and what you are actually protecting — and every prompt after it writes for your situation rather than for a company with a security operations centre.
This is a defensive toolkit. It covers protecting systems, detecting problems, responding to them and communicating about them. It contains no offensive tooling, no exploit development, and nothing about evading detection — and the prompts are instructed to decline those requests rather than answer them.
The incident communication section is written for the phase people find hardest: the first message, sent while you still do not know what happened. There is a way to be honest about uncertainty that maintains trust, and a way that either overclaims and has to be retracted or says so little that customers assume the worst. That message goes out before the investigation finishes, every time.
The awareness section refuses to humiliate anyone. A phishing programme that publishes names, or that treats clicking as a disciplinary matter, reliably produces employees who hide their mistakes — which is the opposite of what you need, since the value of a security-aware workforce is entirely in the speed of reporting.
Note: breach notification obligations, regulator timelines and what constitutes reportable personal data differ sharply by country and sector. The prompts help you prepare and draft, and flag every deadline as needing verification against your own regime rather than asserting one. This is not legal advice.
Compare with Similar AI Templates
| Specification | ||||
|---|---|---|---|---|
| Customer Rating | 4.91(11) | 4.91(43) | 4.93(45) | 4.91(38) |
| AI Models | GPT-5, Claude Opus 5, Gemini 3.7 Flash | GPT-5, Claude Opus 5, Gemini 3.7 Flash | GPT-5, Claude Opus 5, Gemini 3.7 Flash | GPT-5, Claude Opus 5, Gemini 3.7 Flash |
| Formats Included | PDF Prompt Playbook | PDF Prompt Playbook | PDF Prompt Playbook | PDF Prompt Playbook |
| Lifetime Updates | Yes | Yes | Yes | Yes |
| Creator Rating | Wren Ashcombe (98.9%) | Dr. Lucas Vance (99.2%) | Marcus Sterling (99.3%) | Elena Rostova (99%) |
Community Reviews & Ratings
Verified buyer ratings & prompt benchmarks
Write a Review
Sign in to leave a review for this system.
Verified User Feedback
The three-state message
Confirmed, investigating, not known — stated explicitly rather than blurred. We used it during a real incident and had nothing to retract afterwards, which I did not expect.
It flagged our minimising sentence
We had written 'a small number of accounts'. It said that reads as evasive without the number and it was right — our own board asked exactly that question in the next meeting.
Phishing simulation without the humiliation
We had been publishing departmental click rates. Reporting speed roughly tripled once we stopped, which is the metric that actually matters and the one we had never tracked.
Defensive only, and it means it
I asked about testing our own perimeter and it declined and told me to commission a scoped test. Consistent with the listing, and worth knowing if you wanted the other half.
Frequently Asked Questions
Does this cover penetration testing or ethical hacking?
No. It is defensive throughout — protecting, detecting, responding, communicating. There is no offensive tooling, no exploit development and nothing about evading detection, and the prompts are instructed to decline those requests. If you need a penetration test, commission one from qualified testers under a scoped engagement.
Is this legal advice on breach notification?
No, explicitly. Notification windows, which authority to tell, and what counts as reportable differ by country and sector and change. The prompts help you prepare and draft, and flag every obligation as requiring verification against your own regime and confirmation with counsel.
We have no dedicated security staff. Is this useful?
The Primer asks, and this is a common situation. Access reviews, vendor questionnaires, tabletops, awareness and incident communication are all achievable without a security team. Where a control genuinely needs dedicated staff, the prompts say so rather than proposing a version that does not work.
Does it overlap the Risk & Compliance toolkit?
Lightly. That one covers documentation — security policies, privacy mapping, audit findings — as compliance artefacts. This one is operational: threat models, live incidents, access, vendors and exercises. If your need is producing evidence for an auditor, that is the other toolkit.
How is it delivered?
You receive a PDF with all 134 prompts organized into 8 sections, delivered within 24 hours of purchase. No app or account required — copy a prompt, fill in the bracketed variables, and paste it into ChatGPT, Claude, or Gemini.
Can I use this for client work?
Yes. Your purchase includes a single-user commercial and personal license, so you can use every prompt in your own business or for client deliverables without restriction.