Security engineers and CISOs
Agent-assisted code review, threat models, detection rules, alert triage and phishing analysis with checks at every step, plus how to secure the agents themselves: prompt injection, exfiltration, MCP supply chain, permissions and sandboxing.
For Security engineers, AppSec and SOC analysts, detection engineers and CISOs
Review more code and triage more alerts, without letting your own agents become the breach
- An agent security pass on every pull request before a human reviewer spends time on it
- Threat models drafted from design docs in an hour, then argued over by people
- Sigma rules that ship with a passing check and tested true and false positive cases
- Alerts triaged with evidence and a disposition, with containment left to people
- Secrets blocked before they reach a file or a commit, on every write
- A written threat model and an enforced control set for the coding agents your company runs
On this page
- Where AI helps in this job
- Start in 15 minutes
- The tools security teams use
- Members only: Workflow: agent-assisted code security review
- Members only: Workflow: a threat model from a design doc
- Members only: Workflow: detection rules with tests
- Members only: Workflow: alert triage and phishing analysis
- Members only: Securing the agents themselves
- Members only: A skill for security analysts
- Members only: Guardrails and hooks
- Members only: Routines that run without you
- Members only: Prompt ladder for security engineers
- Members only: Measure it
- Members only: Risks and what not to automate
AI gives security teams two jobs. The first is reach: more code reviewed, more alerts triaged, faster threat models and detection rules. The second is new attack surface: every coding agent in your company reads untrusted text, holds credentials and can run commands. This page covers both, with the prompts, the hook and the controls to copy.
Where AI helps in this job#
| Task | What AI does well | What you still own |
|---|---|---|
| Code security review | Follows data from input to sink and flags injection, missing authorization, secrets and unsafe deserialization with file and line | Confirming exploitability, severity and the fix |
| Threat modeling | Drafts assets, trust boundaries, data flows and STRIDE threats from a design doc | Which threats matter for your business and risk appetite |
| Detection engineering | Drafts Sigma or SIEM queries from a technique or a threat report, plus test events | Tuning against your telemetry and owning the false positives |
| Alert triage | Summarizes the alert, gathers read-only evidence and proposes a disposition | The disposition and every containment action |
| Phishing analysis | Reads headers and body, checks SPF, DKIM and DMARC results, spots lookalike domains and pressure tactics | Borderline verdicts and what you tell the user |
| Vulnerability management | Explains a CVE, checks whether the vulnerable code is reachable, drafts the upgrade | Risk acceptance and patch priority |
| Policies and standards | Drafts policy text, maps controls to frameworks, rewrites for plain language | Approval, legal review and enforcement |
| Security questionnaires | Drafts answers from your policies and past answers, with citations | Accuracy: nothing reaches a customer unchecked |
| Incident reports | Builds the timeline from logs and chat and drafts the report | Root cause, regulatory notifications and disclosure |
AI is weakest where security is hardest. It reports plausible findings it cannot prove, misses business-logic flaws that need product knowledge, cites CVE and ATT&CK IDs that do not exist, and knows nothing about vulnerabilities published after its training. The content you analyze is often hostile: a phishing email, an alert field or a malicious repository can carry instructions aimed at the model. Treat every finding as a lead to verify, and every input as data, not instructions.
Start in 15 minutes#
Remove customer data, credentials and internal hostnames before you paste anything into a consumer chat app. Use an enterprise plan whose terms exclude your data from training.
Prompt
Security review of a diff
Review this diff for security vulnerabilities: [PASTE DIFF] For each finding give: the vulnerability class with its CWE number, the file and line, how attacker-controlled input reaches it, the preconditions an attacker needs, the severity with one sentence of reasoning, and the fix. Only report issues you can tie to specific lines. If you find nothing, say "no findings" instead of listing general advice.
Good output names lines and a concrete path from input to the dangerous call. Open each cited line yourself, and ask "what input would trigger this?" for anything vague.
Prompt
Phishing analysis from headers and body
Analyze this reported email for phishing. Do not visit any link. Headers: [PASTE FULL HEADERS] Body: [PASTE BODY, WITH LINKS DEFANGED LIKE hxxps://example[.]com] Check: the Authentication-Results for SPF, DKIM and DMARC; From versus Reply-To and Return-Path; lookalike or newly registered-looking domains, including punycode; urgency, payment or credential requests; and link text that differs from the link target. Give a verdict (phishing, suspicious, legitimate), your confidence, and the three strongest pieces of evidence, each quoted from the headers or body.
Good output quotes the header lines it relies on. Check the Authentication-Results yourself; a model can misread which domain passed DMARC.
Prompt
Draft a policy section in plain language
Draft the section of our acceptable use policy that covers AI coding assistants. Cover: which tools are approved, which data classes may and may not go into them, human review before merging, secrets, and how to report a problem. Plain language, under 400 words, written for engineers.
Good output is short and specific enough to enforce. Compare it with your data classification policy, and have legal review it before you publish.
The tools security teams use#
- Claude Code has
/security-reviewfor the current branch, the security-guidance plugin that reviews code as Claude writes it, the Claude Security plugin (/claude-security) for a multi-agent scan of a repository or a set of changes, and Code Review for pull requests on Team and Enterprise plans. A managed Claude Security service is available on the Enterprise plan. Anthropic'sclaude-code-security-reviewGitHub Action also exists, but its README warns it is not hardened against prompt injection, so run it only on pull requests from trusted authors. - GitHub Copilot Autofix proposes fixes for CodeQL alerts on pull requests and the default branch under GitHub Advanced Security. GitHub notes a fix can introduce new vulnerabilities, so review each one.
- OpenAI Codex Security is an application security agent that validates findings in isolated environments. On GitHub, comment
@codex security review. - Microsoft Security Copilot includes the Phishing Triage Agent in Defender, which resolves false positives itself and leaves true positives open for an analyst. It needs Security Copilot capacity and Defender for Office 365 Plan 2.
- Google Security Operations has Gemini features for natural-language search, YARA-L rule drafting, case summaries and a triage and investigation agent.
- Deterministic tools still carry the load: gitleaks for secrets, OSV-Scanner for dependencies, CodeQL or Semgrep for static analysis, Sigma for portable detections. Agents work best reading their output.
Workflow: agent-assisted code security review
Members only below this line
Get the full Security engineers and CISOs playbook free
What you get on this page:
- 4 step-by-step workflows
- 12 prompts
- 1 skill
- 1 hook
- 1 routine
Also in the members part
- Workflow: a threat model from a design doc
- Workflow: detection rules with tests
- Workflow: alert triage and phishing analysis
- Securing the agents themselves
- A skill for security analysts
- Guardrails and hooks
- Routines that run without you
- Prompt ladder for security engineers
- Measure it
- Risks and what not to automate
Sources
Checked against these on 13 Oct 2026.
- Claude Code security (opens in a new tab)code.claude.com
- Configure the sandboxed Bash tool (Claude Code) (opens in a new tab)code.claude.com
- Control MCP server access for your organization (Claude Code) (opens in a new tab)code.claude.com
- Scan your codebase for vulnerabilities (Claude Security plugin) (opens in a new tab)code.claude.com
- Catch security issues as Claude writes code (security-guidance plugin) (opens in a new tab)code.claude.com
- Claude Code hooks reference (opens in a new tab)code.claude.com
- Automate work with routines (opens in a new tab)code.claude.com
- anthropics/claude-code-security-review (opens in a new tab)github.com
- OWASP Top 10 for LLM Applications 2026 (opens in a new tab)genai.owasp.org
- OWASP Top 10 for Agentic Applications 2026 (opens in a new tab)genai.owasp.org
- MCP security best practices (opens in a new tab)modelcontextprotocol.io
- MITRE ATLAS (opens in a new tab)atlas.mitre.org
- CISA and partners: careful adoption of agentic AI services (opens in a new tab)cisa.gov
- gitleaks (opens in a new tab)github.com
- OSV-Scanner (opens in a new tab)github.com
- Sigma rules specification (opens in a new tab)github.com
- sigma-cli (opens in a new tab)github.com
- Splunk search command: Boolean evaluation order (opens in a new tab)help.splunk.com
- Responsible use of Copilot Autofix for code scanning (opens in a new tab)docs.github.com
- Microsoft Defender: Phishing Triage Agent (opens in a new tab)learn.microsoft.com
- Gemini in Google Security Operations (opens in a new tab)docs.cloud.google.com