01
Establish exploitability here
The CVE isn't the environment.
Made for people in Technology
Call Severity and Next Steps on a Vulnerability Without Theater
30 min
Intermediate
Technology
Career outcome:
Avoid Professional Risk
Translate a scanner or report finding into exposure, urgency, and owners.
We'll use them to write your prompt.
Completed ✓
Make Your Play
Give us the situation. We’ll build the prompt.
CVSS without context creates either panic or shrug.
Your answers save as you type.
What you'll do
This is the plan inside your prompt. Add your details first. Then follow these steps with ChatGPT or Claude.
02
Call severity for this org
Internal scale, not theater.
03
Recommend fix, mitigate, or accept
Accept is a real option if signed.
04
Write the engineer-facing note
They need the next command, not a TED talk.
Make Your Play
Call Severity and Next Steps on a Vulnerability Without Theater
Tell us what the prompt needs to know
Start with the questions below. Each answer personalizes the playbook and builds the prompt you’ll use at the end.
Your situation
Source, component, claimed issue.
0/10000
Where it runs, internet vs internal, who can send input.
0/10000
Service owners and freeze dates.
WAF, auth, not reachable, already patched in some envs.
0/10000
This playbook was updated. Review your inputs before copying.
What you'll do
Check a step when you finish it.
01
Establish exploitability here
The CVE isn't the environment.
02
Call severity for this org
Internal scale, not theater.
03
Recommend fix, mitigate, or accept
Accept is a real option if signed.
04
Write the engineer-facing note
They need the next command, not a TED talk.
Fill in the fields above to generate your prompt preview.
Assembled prompt
Beginner instructions
Fill the fields with this week’s real details. Incomplete notes beat invented polish.
Run the assembled prompt, answer follow-ups with specifics, then copy the deliverable into your own doc and verify names and numbers.
Advanced instructions
Add constraints the model can’t see: politics, licensing, cash timing, union rules, or family bandwidth.
After the first pass, ask it to attack the weakest assumption in the draft.
Use this when
A scanner, researcher, or bug bounty just landed, and engineering wants to know if this is this week or this quarter.
You'll need
- The finding
- How we use it
- Who can patch
- Compensating controls
You'll get
- A a severity call, blast radius, and a fix/mitigate/accept recommendation you can use without rewriting it from scratch.
By the end of this playbook
You will have:
- A a severity call, blast radius, and a fix/mitigate/accept recommendation you can use without rewriting it from scratch.
Examples
Progress 1 of 4