Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+17 more

    Incident Lessons Learned Review

    1

    Convert cyber incident evidence into blameless post-mortem reports, root cause analyses, and action trackers.

    $10

    30-day refund guarantee

    Secure checkout via Stripe

    0 installsSecurity scanned

    See it in action

    You say

    Facilitate a post-incident lessons learned review for a business email compromise that occurred last month. Initial access was via a phishing email that bypassed email filtering. Containment took 72 hours. Key stakeholders are the SOC, IT operations, and the CISO. Produce a blameless review report, improvement action tracker, and executive summary.

    Your agent does

    The skill produces a structured blameless post-incident review report covering incident scope and timeline, response performance metrics (MTTD, MTTI, MTTC, MTTR), root cause analysis using a five-whys methodology, a blameless review of what went well and what needs improvement, a prioritised improvement action tracker with placeholder owners and due dates, a playbook update requirement list, and a one-page executive summary suitable for CISO or board reporting. All ownership assignments and SLA targets requiring organisational confirmation are clearly marked as placeholders throughout.

    What you get

    Conduct 5-Why root cause analysis for security incidentsGenerate executive summaries of cyber tabletop exercisesConvert incident timelines into tracked remediation actionsIdentify gaps in IR playbooks and detection logic from real events

    About this skill

    Professional Defensive Post-Incident Reviews

    Transform chaotic incident data into structured, actionable intelligence. This skill facilitates deep-dive lessons learned sessions following cyber security incidents, near misses, or tabletop exercises. It moves beyond simple summarization, applying rigorous analysis methods to improve your organization's security posture.

    What it does

    • Evidence Synthesis: Consolidates incident timelines, logs, and stakeholder inputs into a single source of truth.
    • Blameless Analysis: Conducts root cause analysis (RCA) using 5-Whys or Fishbone methods, focusing on systemic improvements rather than individual fault.
    • Metric Generation: Calculates key performance indicators like MTTR and MTTC based on provided timestamps.
    • Actionable Outputs: Generates executive summaries, playbook update plans, and tracked action items with clear owners and validation criteria.

    Why use this skill

    Standard AI prompting often yields generic retrospective advice. This skill enforces strict defensive IR standards, ensuring outputs are evidence-based, tool-agnostic (unless specified), and audit-ready. It bridges the gap between technical recovery and executive reporting, ensuring that "lessons learned" actually result in updated playbooks and detection logic.

    How to install

    Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 3 months ago

    • One-time purchase, yours forever

    Listed3 months ago

    Frequently Asked Questions