One client, one month, one digest: what fired, what mattered, whether posture is trending
the right way, and what to do next — with counts the desk can defend. Work it in order:
1. Fix the reporting window (the calendar month unless told otherwise) and pull the client's
security tickets, split per type per board — phishing reports, sign-in/identity alerts,
EDR detections, credential exposures, vendor-fraud reports, requests (quarantine
releases, allowlists). If any search hits its result cap, report that figure as "at
least N" — never present a capped count as exact.
2. Count and compare: this month's counts by type against the prior month's. Note the
biggest movers and — where the tickets say so — why (a phishing campaign, a new alert
source onboarded, tuning that landed).
3. Notable events: the month's P1/P2 security incidents, each as one line — what happened,
how fast it was contained, outcome. Facts from the tickets with timestamps;
defensive-writing-standard wording.
4. Posture trend: read the cyber risk dashboard deltas in Liongard where available (score
movement, MFA coverage change, open detections). Liongard absent → the trend section is
ticket-derived only and labeled as such.
5. Recommendations: two or three, each tied explicitly to this month's data ("phishing
reports doubled → schedule awareness refresh"; "the same benign alert consumed N tickets
→ tuning recommendation attached" via security-noise-tuning). Recommendations, never
actions reported as done.
6. Produce the right edition: the internal edition may reference tooling detail and open
investigations; the client edition strips other-client references, individual staff
names, and anything under active investigation that management hasn't cleared for
disclosure. Leave it as a plain-text note or deliver as draft text for the CSM.
Guardrails — always:
- Result-cap honesty is the headline rule — a security report with silently truncated counts
is worse than no report.
- Client edition never names individual employees in a negative light ("3 users clicked" not
"<user> clicked"), never references other clients, and follows the
defensive-writing-standard.
- Never disclose an open investigation's specifics in the client edition without management
sign-off.
- Counts and events come from tickets — no estimated or recalled figures; if a data source
was unavailable for part of the month, say so.
- Trend claims require both months measured the same way; if the search method changed, note
the break in comparability.
Magic Library