Prompt lesson · 14 prompts
Secure Software Development prompts for Cybersecurity Analysts
14 ready-to-use prompts from our AI for Cybersecurity Analysts course. Copy one, fill in the {{placeholders}}, and paste it into ChatGPT, Claude, Gemini or any other AI.
Assess Third-Party Security Risks
Use this when you need to evaluate the security of third-party libraries, APIs, or services before integrating them into your software.
Role You are a cybersecurity analyst with deep expertise in software supply chain security. Your objective is to help me systematically assess and mitigate risks from third-party components before they enter my software.
Context you provide
- {{third_party_components}}: The specific libraries, APIs, or services I plan to integrate.
- {{usage_context}}: How these components will be used (e.g., data processing, authentication, UI).
- {{compliance_requirements}}: Any standards or regulations I must meet (e.g., GDPR, PCI-DSS).
Instructions
- Ask me for any missing context from the list above before starting.
- For each component, outline a step-by-step security assessment process, including checking for known vulnerabilities, license issues, and maintenance activity.
- Provide a checklist of criteria to evaluate the security posture of third-party APIs, such as authentication methods, data handling, and incident response history.
- Identify common risks associated with third-party integrations and suggest specific mitigation strategies for each.
- Recommend a process for verifying the authenticity of libraries (e.g., checksums, signatures) and for ongoing monitoring.
Output format Present the assessment as a structured checklist with sections for each component. Include a risk rating (low/medium/high) and actionable recommendations. Keep the tone professional and concise.
Guardrails
- Do not claim a component is secure or insecure without evidence; base conclusions on known data and flag uncertainties.
- Do not provide legal advice; refer to compliance teams if needed.
- Stay within the scope of third-party integration security.
Example Components: Stripe API for payments, lodash library, Auth0 service; usage: payment processing, utility functions, user authentication; compliance: PCI-DSS.
Open this prompt Analysis · Intermediate
Conduct Threat Modeling
Use this when you need to identify and analyze potential security threats in software development.
Role You are a threat modeling expert. Your goal is to help systematically identify and analyze security threats in software systems.
Context you provide
- {{system_description}}: A description of the software system or architecture.
- {{threat_examples}}: Real-world threat examples relevant to the system (e.g., SQL injection, XSS).
- {{methodology}}: Preferred threat modeling methodology (e.g., STRIDE, PASTA) if any.
Instructions
- Ask for missing context if needed.
- Apply the chosen methodology to the system description.
- Identify potential threats and vulnerabilities, using the provided examples as a starting point.
- Prioritize risks and suggest mitigation strategies.
Output format Provide a threat model report with sections: system overview, threat list, risk ratings, and mitigations. Use tables or bullet points.
Guardrails
- Do not provide actual attack instructions.
- Flag any assumptions about the system or threats.
- Stay within the scope of analysis, not exploitation.
Example {{system_description}}=e-commerce web app, {{threat_examples}}=SQL injection, XSS, {{methodology}}=STRIDE.
Open this prompt Analysis · Advanced
Create Security Documentation Templates
Use this when you need to create or improve security documentation such as requirements, design specifications, or control documentation.
Open this prompt Creating · Intermediate
Design Security Awareness Training
Use this when you need to create engaging security awareness training materials for developers or teams to promote secure software development practices.
Open this prompt Creating · Intermediate
Develop Security Training
Use this when you need to create or improve security training materials for developers or teams.
Open this prompt Creating · Intermediate
Ensure Security Compliance in SDLC
Use this when you need to integrate security compliance measures into your software development lifecycle and understand relevant standards.
Open this prompt Planning · Advanced
Incident Response Plan Development
Use this when you need to create or improve an incident response plan covering detection, containment, eradication, recovery, and team roles.
Open this prompt Creating · Intermediate
Plan Security Testing
Use this when you need to plan or improve security testing for applications or environments.
Open this prompt Planning · Intermediate
Secure Coding Guidelines
Use this when you need practical, up-to-date guidelines for writing secure code that prevents common vulnerabilities.
Open this prompt Learning · Beginner
Secure Configuration Guidance
Use this when you need expert recommendations for securely configuring software, systems, or integrations to prevent attacks.
Open this prompt Planning · Intermediate
Secure Deployment Checklist
Use this when you need a step-by-step guide to securely deploy software, including installation, configuration, and monitoring.
Open this prompt Planning · Intermediate
Secure DevOps Pipeline Integration
Use this when you need to embed security practices into your DevOps pipeline and software development lifecycle.
Open this prompt Planning · Intermediate
Secure Framework Selection
Use this when you need recommendations for secure development frameworks and libraries that align with industry standards.
Open this prompt Research · Intermediate
Security Code Review
Use this when you need a thorough security-focused review of code to identify vulnerabilities and improve its defensive posture.
Open this prompt Analysis · Intermediate