---
name: executive-briefing-generator
description: >
  Turn a technical incident, triage batch, or vulnerability finding into a plain-English
  executive/CISO-facing briefing. Use this skill whenever a user asks to "write this up for
  leadership", "make a CISO summary", "explain this to execs", "board-ready summary", or asks
  to translate an already-triaged technical incident into non-technical language. Also trigger
  when a user says the audience is "leadership", "the board", "execs", or "non-technical
  stakeholders" for security content. Do not use this for the initial technical triage itself —
  run the appropriate triage/investigation skill first, then use this skill to translate the
  result. If no technical detail exists yet, ask what happened before drafting.
---

# Executive / CISO Briefing Generator

Translates already-triaged technical findings into the plain-English, business-impact framing
that a CISO or board actually reads — without losing the facts that matter.

---

## Workflow Overview

```
1. Confirm the source material  →  2. Strip jargon, extract business impact  →  3. Frame risk
   in business terms  →  4. Render executive-format briefing
```

---

## Step 1 — Confirm the Source Material

This skill translates; it doesn't investigate. If the user hasn't already provided a triaged
incident, vulnerability finding, or investigation result (from this conversation or pasted in),
ask what happened rather than fabricating technical detail. If a prior report exists earlier in
the conversation, reuse it — don't re-run enrichment.

---

## Step 2 — Strip Jargon, Extract Business Impact

For each technical fact, translate it into a business-relevant equivalent:

| Technical fact | Business translation |
|---|---|
| "Lateral movement via SMB to 12 hosts" | "The attacker moved from one machine to twelve others on our network" |
| "C2 beacon over DNS TXT records" | "The compromised system was quietly phoning home to the attacker" |
| "RCE, CVSS 9.8, unauthenticated" | "An attacker could take full control of this system remotely, without needing a password" |
| "Data exfil to S3 bucket, 40GB" | "Roughly 40GB of data — the equivalent of [concrete comparison] — left our network" |

Never drop the underlying fact; just carry it in plain language. Keep exact figures (dollar
amounts, record counts, timeframes) — executives want the number, not the acronym.

---

## Step 3 — Frame Risk in Business Terms

Address, briefly and explicitly:

- **What happened** (2–3 sentences, no jargon)
- **What's at risk** — customer data, regulatory exposure, operational downtime, revenue,
  reputation — whichever actually applies; don't list all five reflexively
- **What's been done already** (containment, patching, notification if applicable)
- **What's still open** and what decision, if any, is needed from leadership
- **Likely follow-up questions** a board member would ask, answered pre-emptively where possible

Do not speculate on regulatory or legal obligations (breach notification thresholds, disclosure
timing) — flag that Legal/Compliance should weigh in rather than asserting a position yourself.

---

## Step 4 — Render Executive Briefing

This is a document deliverable — use the `docx` skill if the user wants a Word document to
circulate, or render as a clean HTML/markdown artifact for in-chat or email use. Ask which if
unclear from context (e.g., "for the board deck" implies a doc; "quick Slack update" implies
inline text).

Structure, regardless of format:

1. **Headline** — one sentence, the "so what"
2. **What happened** — plain language, 2–3 sentences
3. **Business impact** — bulleted, concrete, no acronyms
4. **Current status** — contained / ongoing / resolved, with a one-line timeline
5. **What we need from leadership** (if anything) — a decision, budget, or awareness-only
6. **Appendix** (optional, collapsible/separate page) — the technical detail, for anyone who wants
   to go deeper, clearly marked as optional reading

Keep the main body under one page equivalent. Executives read the headline and business impact;
everything else is there in case they ask.

---

## Handling Edge Cases

**User wants this before containment is confirmed**: Say clearly that status is "ongoing,
containment in progress" rather than implying resolution — an exec briefing that overstates
confidence is worse than a technical one that hedges correctly.

**Multiple unrelated incidents in one ask**: Produce a short briefing per incident rather than
merging them into one narrative; execs track separate issues separately.

**User asks for spin/minimization of severity**: Push back — translate accurately to plain
language; don't understate impact to make a briefing more comfortable to deliver.

**No business-impact info available (pure technical finding, no known data/customer exposure)**:
Say "no confirmed customer or data impact at this time" rather than omitting the question
entirely — the absence of impact is itself something leadership wants stated, not implied.