SAST Report Executive Summary Prompt

Security leads and DevSecOps engineers use this prompt to transform raw, high-volume static analysis scan data into a structured executive summary for engineering leadership. The primary job-to-be-done is communication: turning thousands of individual findings, severity distributions, remediation timelines, and trend data into a concise brief that answers 'How healthy is our SAST program?' and 'What should I pay attention to right now?' The ideal user is someone who already understands the scan data but needs to compress it into a format that VPs of Engineering, CTOs, or security steering committees can act on without wading through tool-specific exports or developer-level ticket queues.

This prompt requires specific, structured input to produce a useful summary. You must provide finding counts by severity, remediation velocity metrics (such as mean time to remediate and aging buckets), trend data comparing current scans to previous baselines, and a list of top-risk findings with their exploitability context. The prompt is designed to ingest this quantitative data and produce qualitative synthesis—it will not perform the raw data extraction or calculation itself. Before using this prompt, aggregate your SAST tool output into the expected input schema. If your scan data is still in raw SARIF, CodeQL, or Semgrep JSON format, use a separate data extraction or normalization prompt first to prepare the structured input this prompt requires.

Do not use this prompt for detailed technical remediation guidance or developer-facing ticket generation. Those workflows require separate, code-aware prompts that can reference specific source locations, data flow paths, and fix suggestions. Do not use this prompt when the audience expects granular finding-level detail or when the goal is to assign work to individual developers. This prompt is also inappropriate for real-time incident response where SAST findings are part of an active exploitation investigation—in that context, use an incident root cause analysis prompt that can correlate findings with runtime evidence. The output of this prompt should always be treated as a decision-support artifact, not a replacement for human security judgment. For high-risk findings that appear in the executive summary, implement a human review gate before the summary reaches leadership to validate that the risk framing and prioritization are accurate and that no critical context has been lost in compression.

The following prompt template is designed to be populated with structured and unstructured data from your SAST tools before being sent to the model. It instructs the model to act as a security engineering lead and synthesize raw findings into a narrative executive summary. The summary focuses on program health trends, risk heatmaps, remediation velocity, and top risks that require leadership attention. The template uses square-bracket placeholders for all dynamic inputs; replace each placeholder with your specific scan data, tool names, and organizational context before execution.

codeCopy
You are a senior security engineering lead preparing an executive summary of our SAST program for the VP of Engineering and CISO. Your goal is to provide a clear, data-driven narrative that enables decision-making, not an exhaustive list of findings.

Use the following inputs to generate the summary:

[SCAN_DATA]

[PREVIOUS_SCAN_DATA]

[REMEDIATION_SLA_CONTEXT]

[ORGANIZATIONAL_RISK_CONTEXT]

[OUTPUT_SCHEMA]

[CONSTRAINTS]

Generate the executive summary by following these steps:

1.  **Trend Analysis:** Compare [SCAN_DATA] against [PREVIOUS_SCAN_DATA]. Calculate the change in total findings, findings by severity, and net new vs. resolved findings. Identify any significant positive or negative trends.
2.  **Risk Heatmap:** Map the top 5-10 services or code areas with the highest concentration of unresolved High and Critical severity findings. For each, note the primary vulnerability classes (e.g., SQL Injection, XSS, Hardcoded Secrets).
3.  **Remediation Velocity:** Calculate the average time-to-remediation for findings closed in this period, broken down by severity (Critical, High, Medium). Compare this velocity against our defined [REMEDIATION_SLA_CONTEXT]. Flag any SLA breaches or bottlenecks.
4.  **Top-Risk Findings:** Select the 3-5 most critical findings that demand immediate leadership attention. For each, explain the business risk in plain language, the affected asset, and the current remediation status, considering our [ORGANIZATIONAL_RISK_CONTEXT].
5.  **Executive Summary Narrative:** Synthesize the above into a concise, half-page narrative. Lead with the most important signal (e.g., "Our critical vulnerability count is down 15% this month, but a new high-risk pattern in our payment service requires immediate action").

**Output Format:**
Return the analysis strictly as a JSON object conforming to the provided [OUTPUT_SCHEMA]. Do not include any text outside the JSON object.

**Constraints:**
- [CONSTRAINTS]
- If the [SCAN_DATA] is empty or malformed, return a JSON object with an `error` key describing the issue.
- Base all claims strictly on the provided data. Do not infer or assume external context.
- Use a professional, objective tone suitable for a C-suite audience.

To adapt this template, start by replacing the [SCAN_DATA] and [PREVIOUS_SCAN_DATA] placeholders with the raw JSON or structured text output from your SAST tools. The [REMEDIATION_SLA_CONTEXT] should contain your organization's specific policies, such as "Critical findings must be remediated within 7 days." The [ORGANIZATIONAL_RISK_CONTEXT] is crucial for the model to correctly prioritize findings; it should include information like "the payment-gateway service is our most business-critical asset" or "we are currently under a regulatory audit for PCI DSS." The [OUTPUT_SCHEMA] placeholder must be replaced with a strict JSON schema definition that your application can validate against, ensuring the model's output is machine-readable. Finally, use the [CONSTRAINTS] placeholder to inject any final rules, such as "Do not mention specific engineer names" or "Classify any finding older than 90 days as 'stale'."

After populating the placeholders, test the prompt with a known set of scan data where you can manually verify the trend calculations and risk prioritization. Pay close attention to how the model handles edge cases, such as a scan with zero new findings or a situation where remediation velocity has dropped to zero. The next step is to build a thin application harness around this prompt that can pre-process your SAST data into the required format, call the model, and validate the JSON output against your schema before the summary ever reaches a human reviewer.

The SAST Report Executive Summary Prompt is designed to run as a scheduled batch job, not a real-time chat interaction. It ingests structured scan data from your SAST tool's API or export pipeline, produces an executive summary, and routes the output to a review queue or distribution channel. The implementation harness must handle input normalization, output validation, and a mandatory human-in-the-loop gate before the summary reaches leadership. Treat this prompt as a data transformation step in a pipeline, not a standalone assistant.

Input assembly starts by pulling raw findings from your SAST tool (e.g., Semgrep, CodeQL, Snyk) and normalizing them into the [SCAN_DATA] placeholder format. The expected schema includes: scan_date, tool_name, total_findings, findings_by_severity (Critical/High/Medium/Low), findings_by_category (e.g., injection, crypto, auth), remediation_velocity (findings fixed/week over the last 4 weeks), and a top_findings array with finding_id, title, severity, category, file_path, status, and days_open. If your SAST tool doesn't provide remediation velocity natively, compute it from your ticketing system before calling the prompt. Model choice: use a model with strong structured reasoning and long-context handling (e.g., GPT-4o, Claude 3.5 Sonnet). Set temperature=0.2 to balance factual consistency with readable prose. Tool use: this prompt does not require function calling or RAG; all evidence must be in [SCAN_DATA]. If you need to ground findings in external threat intelligence, do that in a separate enrichment step before this prompt runs.

Output validation is critical because executive summaries carry reputational risk. After the model responds, validate the output against a schema that checks: (1) the summary contains all required sections (trend summary, risk heatmap, remediation velocity, top risks), (2) numbers in the summary match the input data within a 5% tolerance, (3) no finding is described as 'critical' unless the input severity is Critical, and (4) the output contains no hallucinated finding IDs or dates. Run these checks programmatically. If validation fails, retry once with the same prompt plus the validation errors appended as [CONSTRAINTS] feedback. If the second attempt fails, flag for human review with the raw scan data and both failed outputs attached. Logging: capture the input hash, model version, output, validation results, and reviewer identity for auditability. Human review gate: even when validation passes, route the summary to a security lead for approval before distribution. The reviewer checks for tone, accuracy, and whether any finding is over- or under-emphasized. Only after approval should the summary flow to dashboards, email digests, or slide decks. Avoid fully automated distribution for leadership-facing security content—the cost of a mischaracterized risk is too high.