# Analyze security threats and vulnerabilities

Identifies vulnerabilities and threats and builds a prioritized remediation plan.

- Topic: Software Development
- Framework: RCTFVV
- Level: Advanced
- Tags: Analyze, Plan, Fill-in Template, Step-by-step
- Source: https://www.thinkwithprompt.com/prompts/analyze-security-threats-and-vulnerabilities

## Prompt

```text
Role: Act as a security engineer assessing security risk for a system or a set of findings.

Context: Scope (component, service, or finding list from a scan/pen test): [SCOPE]. Architecture, trust boundaries and data sensitivity: [ARCHITECTURE_DATA]. Existing controls: [CONTROLS]. Threat model context (who might attack, from where): [THREAT_CONTEXT]. Constraints on remediation (change windows, compatibility, resourcing): [CONSTRAINTS]. Framework / rating scale to use: [FRAMEWORK].

Goal: Give the team a clear, prioritised view of the real security risk and a remediation plan sequenced by risk reduction per unit of effort.

Task: Produce: (1) the threats / vulnerabilities identified, each with the affected asset, the attack path, exploitability, impact (confidentiality/integrity/availability and blast radius), and an overall rating on the given scale; (2) which are realistically exploitable given the existing controls and threat context vs theoretical; (3) a remediation plan - fix, mitigation, or accepted risk per item, with owner, effort, and the residual risk; (4) quick wins that reduce risk immediately; (5) detection/monitoring to add.

Constraints: Rate risk on the provided scale and justify each rating. Do not include exploit code or step-by-step attack instructions - describe the class of weakness and the fix. Distinguish confirmed issues from suspected. Respect the change constraints in sequencing.

Examples: Finding row: 'Asset: [service] API. Weakness: missing authz check on [endpoint]. Path: authenticated low-priv user calls it directly. Exploitability: high. Impact: read other tenants' data (confidentiality, cross-tenant). Rating: Critical. Fix: enforce tenant scoping in [layer]; owner [team]; effort M; residual: low.'

Format: Sections: Findings (table, ranked) | Realistic vs theoretical | Remediation plan (table) | Quick wins | Detection to add. ~700 words.

Verification: State the assumptions behind each exploitability rating and flag findings that need validation (e.g. confirm the control is actually absent) before remediation is scheduled.

Validation: Pressure-test the top finding as an attacker with only the stated access: does the attack path actually work end to end? If a control blocks it, re-rate and re-sequence.
```

## What to fill in

- SCOPE
- ARCHITECTURE_DATA
- CONTROLS
- THREAT_CONTEXT
- CONSTRAINTS
- FRAMEWORK
- service
- endpoint
- layer
- team

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.