Leveraging AI to Review and Strengthen Your Incident Response Plan: A Proof of Concept

Leveraging AI to Review and Strengthen Your Incident Response Plan: A Proof of Concept

Speakers: John Hollenberger, Proactive Consultant, Fortinet

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=B1EkkEDP_U8

Overview

In an era where cyber attackers evolve at an unprecedented pace, often leveraging artificial intelligence themselves, traditional methods for reviewing and updating Incident Response Plans (IRPs) are proving to be critically slow and inadequate. John Hollenberger, a Proactive Consultant at Fortinet with two decades of experience in incident response and security operations, presented a compelling proof of concept at FIRSTCON exploring how AI can serve as a force multiplier to address this widening gap. His talk, "Leveraging AI to Review and Strengthen Your Incident Response Plan," demonstrated the potential for AI to augment human efforts, enhancing the speed, coverage, and consistency of IRP evaluations.

Hollenberger highlighted a fundamental challenge: IRPs, despite being vital, are frequently outdated, manually reviewed at best annually, and often fail under the intense pressure of a real incident. This manual, time-intensive, and subjective process leaves organizations vulnerable, as their defensive strategies cannot keep pace with dynamic threats. The proof of concept aimed to test the hypothesis that AI can identify gaps in IRPs faster and more consistently than manual reviews alone, providing a much-needed acceleration in preparedness.

The significance of this research lies in its practical application of emerging AI capabilities to a critical cybersecurity domain. By evaluating popular Large Language Models (LLMs) like Google Gemini, Microsoft Copilot, and ChatGPT against a real-world IRP and a recognized standard (NIST 800-61R3 and CSF 2.0), Hollenberger offered tangible insights into AI's strengths, limitations, and the crucial role of human oversight. The findings underscore that while AI is not a replacement for human expertise, it can be an invaluable tool for proactively strengthening an organization's defensive posture, ensuring IRPs are robust and ready for the next attack.

Background

▶ Watch: The core problem: Outdated, manual incident response plans (0:55)

The core problem addressed by Hollenberger's talk is the inherent disparity between the speed of attacker evolution and the sluggish pace of incident response plan (IRP) evaluation. As Hollenberger succinctly put it, "IRPs look good until they don't." His extensive experience as a proactive consultant reveals a common organizational failing: IRPs are often reviewed annually at best, with many organizations neglecting them for four or five years. This neglect leads to plans that are outdated, not tailored to current people, processes, and technology, and ultimately prone to failure during high-pressure, high-stakes incidents characterized by incomplete data, cognitive overload, time compression, and cross-team coordination friction.

Current IRP review processes are predominantly manual, making them time-intensive, subjective, and heavily dependent on individual expertise. This human-centric approach struggles to keep pace with attackers who are constantly evolving their tactics, techniques, and procedures (TTPs), increasingly leveraging AI themselves. The gap identified is clear: "plans are evaluated slower than attackers evolve."

This is where AI enters the picture as a potential force multiplier. Hollenberger emphasized that the goal is not to replace humans but to augment them. AI can offer significant advantages in terms of speed, enabling rapid reviews; coverage, ensuring comprehensive analysis against standards; and consistency, reducing subjectivity across multiple reviews or organizations. The proof of concept sought to explore how AI could review IRPs against established frameworks, specifically NIST 800-61R3 (Guide for Incident Response), which increasingly aligns with the NIST Cybersecurity Framework (CSF) 2.0. This alignment allows for a structured, standardized approach to evaluating the completeness and effectiveness of an IRP, moving beyond subjective human interpretation to a more objective, AI-assisted assessment.

Key Findings

▶ Watch: Challenges in AI mapping: inconsistent results across tools (9:00)

The proof of concept successfully demonstrated that AI can indeed identify gaps in Incident Response Plans faster and more consistently than manual reviews alone, thereby validating Hollenberger's hypothesis. However, the findings also highlighted significant nuances and critical considerations for adopting AI in this domain.

First, AI significantly accelerates the review process. Once prompts are engineered and evaluation criteria are defined, an AI model can review an entire IRP in minutes, a task that would take a human reviewer hours or even days, especially when cross-referencing against detailed frameworks like NIST 800-61R3 and CSF 2.0. This speed allows for more frequent and proactive assessments, ensuring IRPs remain relevant.

Second, AI increases coverage and reduces blind spots. Unlike human reviewers who might inadvertently miss details or struggle with cognitive overload when sifting through lengthy documents, AI can process the entire plan comprehensively. This thoroughness helps uncover gaps that might otherwise go unnoticed, providing a more robust assessment.

Third, different AI models yield varying results. Hollenberger's comparison of Google Gemini, Microsoft Copilot, and ChatGPT (all free versions) revealed distinct performance characteristics. While all tools recognized NIST 800-61R3 and mapped to CSF 2.0, they differed in the number of identified requirements, the level of detail in their findings, and their overall assessment quality. ChatGPT provided an overall assessment summary and a maturity level, identifying 22 gaps. Microsoft Copilot was the most detailed, offering organized findings, identifying strengths and weaknesses, and providing direct citations from the plan, leading to 17 distinct gaps. Google Gemini was generally the weakest performer, providing high-level findings with less detail and identifying only 9 gaps. Notably, Gemini even fabricated a CSF ID (IM.G1/2 instead of IM1/O2) initially, underscoring the need for human validation.

Fourth, prompt engineering is crucial for effective AI utilization. The initial attempts revealed that generic prompts were insufficient. Hollenberger had to refine his prompts to specifically ask for mappings to CSF IDs and use proper terminology to elicit meaningful and structured outputs from the AI models. This iterative tuning process is essential to maximize the utility of these tools.

Finally, AI can generate actionable recommendations for improvement. Beyond identifying gaps, the AI models were able to provide language to update the IRPs, suggesting new sections or modifications. ChatGPT, for instance, proposed adding seven new sections covering review processes, approval, versioning, and governance. This capability positions AI not just as an analytical tool but also as a generative assistant for strengthening IRPs.

In summary, the key findings confirm AI's potential as a powerful assistant for IRP review, offering speed and comprehensive coverage. However, they also underscore that AI tools are not monolithic; their effectiveness varies, and human expertise remains indispensable for prompt engineering, output validation, and ultimately, decision-making.

Technical Deep Dive

▶ Watch: Comparing gaps identified by different AI tools (17:00)

The technical core of Hollenberger's proof of concept revolved around a structured methodology designed to evaluate the efficacy of AI in reviewing Incident Response Plans against established cybersecurity frameworks.

Methodology and Data Preparation:

Hollenberger began by obtaining an anonymized IRP. Recognizing the sensitivity of such documents, he responsibly sourced a publicly available IRP from a university, then meticulously sanitized it. This involved removing the university's name, personal information, phone numbers, and any other potentially sensitive data to ensure privacy and prevent inadvertent data leakage when feeding the plan into public AI models.

The next critical step was prompt engineering. As anyone who has extensively used LLMs knows, the quality of the output is directly proportional to the quality of the input prompt. Hollenberger had to iteratively adjust his prompts to guide the AI models toward the desired evaluation criteria and output format. The goal was to ensure each solution measured the IRP against specific requirements and presented findings in a structured, actionable manner.

Evaluation Criteria and Tools:

The primary evaluation standard chosen was NIST 800-61R3, the latest guide for incident response. Hollenberger also focused on its alignment with the NIST Cybersecurity Framework (CSF) 2.0, which provides a comprehensive, risk-based approach to cybersecurity management. The tools selected for this assessment were the free versions of Google Gemini, Microsoft Copilot, and ChatGPT.

Initial AI Performance and Prompt Refinement:

Hollenberger's initial query to the AI models was "list all instant response plan requirements for NIST 800-61R3." Encouragingly, all solutions quickly mapped to CSF 2.0, indicating a baseline understanding. However, the initial outputs varied significantly:

• ChatGPT provided 10 high-level categories with sub-bullets. It only included specific CSF IDs (e.g., ID.AM-1) when explicitly prompted to do so.
• Microsoft Copilot initially offered a more comprehensive list, eventually providing 49 specific requirements when prompted for CSF IDs and verbiage.
• Google Gemini listed six core functions with general sub-bullets and initially provided only 14 specific requirements. Notably, Gemini also exhibited a significant flaw by identifying a made-up CSF ID (IM.G1 and IM.G2) instead of the correct IM1 and O2, highlighting the necessity of human validation.

This variability underscored the need for standardization. To ensure consistency in the subsequent review, Hollenberger elected to use a common set of controls. He took 41 controls identified by ChatGPT and added 8 specific "detect" controls from Microsoft Copilot, resulting in a total of 50 controls against which the IRP would be reviewed. These controls covered all functions from Govern down to Recover, aligning with the comprehensive scope of CSF 2.0, which is a key update from the older NIST 800-61R2's focus on preparation, detection, analysis, and recovery.

Manual Pre-Assessment:

Before feeding the IRP into the AI models, Hollenberger conducted a quick manual review to establish a baseline of known gaps. This revealed several high-level issues in the sample IRP:

• Identification of key stakeholders but no defined roles and responsibilities.
• Absence of incident severity levels, meaning all incidents would be handled identically.
• No clear escalation or communication paths.
• Missing testing, training, or update requirements for the plan itself.

Detailed Tool Comparison for Gap Identification:

The core of the technical deep dive involved presenting the anonymized IRP to each AI tool and asking it to review against the standardized 50 controls.

• ChatGPT: Provided an overall assessment summary, including a "maturity level" (e.g., intermediate), strengths, and key gaps. It broke down gaps into subcategories and identified missing items for each control. ChatGPT found 22 total gaps. Hollenberger cautioned that AI's prioritization of these gaps might not align with an organization's specific risk appetite.
• Google Gemini: Jumped directly into mapping and identified gaps based on categories only, without subcategories. Findings were often clumped into long sentences, and it found the fewest gaps, totaling 9.
• Microsoft Copilot: Stood out for its organization, breaking findings down by control family and subcategory. It identified both strengths and weaknesses in the plan and was the most detailed in gap identification, providing 17 distinct gaps. A significant advantage of Copilot was its ability to provide direct quotes or citations from the IRP as evidence to support its findings, enhancing credibility and ease of human validation.

For example, when reviewing the requirement for periodic review and approval of the IRP, all three tools identified this gap, but with varying levels of detail and presentation. Copilot, with its citation feature, clearly showed the absence of this language in the original document.

AI's Role in Gap Remediation:

Hollenberger then explored if AI could not only identify gaps but also suggest concrete language to update the IRP.

• ChatGPT provided a thorough addition, proposing seven new sections covering review processes, approval, versioning, control, governance, and compliance.
• Google Gemini suggested an annual review cycle, ad hoc updates, approval authority, version control, and distribution.
• Microsoft Copilot included ownership and accountability, review frequency, and other relevant sections.

While all tools offered valid contributions, their approaches differed, suggesting that human interpretation and selection of the most appropriate AI-generated content remain essential. This technical exploration underscores that AI is a powerful, yet nuanced, tool for IRP enhancement, demanding careful prompt engineering, critical evaluation of outputs, and ultimately, human decision-making.

Demo / Proof of Concept

▶ Watch: Critical risk considerations for using AI with sensitive data (22:20)

The entire presentation by John Hollenberger serves as a comprehensive proof of concept demonstrating the practical application of AI in incident response plan review. While there wasn't a live, interactive demo in the traditional sense, Hollenberger meticulously walked the audience through his methodology, showing screenshots and detailed comparisons of the outputs from three prominent AI models: Google Gemini, Microsoft Copilot, and ChatGPT.

The process began with the selection of a publicly available, anonymized Incident Response Plan. This plan was then systematically fed into each of the AI tools. The core of the demonstration involved showing how Hollenberger engineered his prompts, starting with broad questions about NIST 800-61R3 requirements and then refining them to specifically request mapping to CSF 2.0 IDs and detailed gap analysis.

Hollenberger presented side-by-side comparisons of the AI outputs, illustrating the differences in how each tool identified, categorized, and described gaps. For instance, he showed how ChatGPT provided a high-level summary including a "maturity level" and prioritized gaps, while Google Gemini offered more concise, category-based findings. Microsoft Copilot was highlighted for its superior organization, detailed gap identification, and crucially, its ability to provide direct citations from the original IRP to support its findings. This visual evidence from Copilot, showing specific language (or lack thereof) from the plan, was a key aspect of the demonstration, proving the AI's ability to ground its analysis in the actual document content.

Furthermore, the proof of concept extended beyond just identifying deficiencies. Hollenberger demonstrated how he then prompted the AI models to generate updated language to fill the identified gaps within the IRP. He showed examples of how each tool proposed new sections or modifications, such as adding review processes, approval mechanisms, or specific language for annual updates. This demonstrated AI's capability not just for analysis but also for proactive content generation, significantly accelerating the remediation phase of IRP enhancement.

The "demo" aspect was effectively conveyed through these visual examples and detailed explanations of the inputs and outputs, providing a clear understanding of how an organization could replicate this process to leverage AI for strengthening their own incident response capabilities.

Defensive Implications

▶ Watch: AI's capability to review against latest cyber threats (28:00)

The findings from Hollenberger's proof of concept carry significant implications for cybersecurity defenders, offering both opportunities and critical considerations for integrating AI into their incident response planning.

Augmenting Human Capabilities: The most immediate defensive implication is the ability of AI to act as a force multiplier for human analysts. By automating the initial, time-consuming review of IRPs, security teams can achieve faster, more consistent, and comprehensive assessments. This allows for more frequent plan reviews, ensuring IRPs remain current with evolving threats and organizational changes, rather than being outdated documents pulled out only during an incident. AI can help reduce blind spots that human reviewers might miss due to the sheer volume of information or cognitive biases.

Proactive Plan Strengthening: AI's capacity to not only identify gaps but also propose concrete language for updates means defenders can proactively strengthen their IRPs. This includes adding sections for new threat types (e.g., Ransomware-as-a-Service, supply chain incidents), integrating identity and cloud into detection and response, or enhancing communication protocols. This moves organizations from a reactive stance to a more proactive one in their preparedness.

Standardization and Compliance: Leveraging AI against frameworks like NIST 800-61R3 and CSF 2.0 allows organizations to ensure their IRPs are aligned with industry best practices and regulatory requirements. AI can perform pre-checks for compliance validation and maturity assessments, helping organizations identify areas needing improvement before formal audits.

Critical Considerations and Risks:

However, integrating AI for IRP review is not without its challenges and risks, which defenders must carefully address:

1. Data Sensitivity: Incident response plans often contain highly sensitive information about an organization's infrastructure, personnel, and response strategies. Feeding this data into public LLMs poses a significant risk of data exposure and confidentiality breaches. Defenders must understand what the AI tool retains and for how long. The ideal solution for sensitive data would be to utilize private LLMs deployed within the organization's secure environment.
2. Output Reliability and Validation: As demonstrated by Google Gemini fabricating a CSF ID, AI outputs are not infallible. Defenders must maintain human oversight and validation of all AI-generated findings and recommendations. Just like a vulnerability scanner might flag false positives, an AI might misinterpret text or provide inaccurate suggestions. Human expertise is essential to interpret results, distinguish valid gaps from false ones, and ensure proposed changes fit the organization's unique context and risk appetite.
3. Prompt Engineering Expertise: Effective use of AI requires skilled prompt engineering. Defenders need to learn how to craft precise queries that elicit relevant and structured information. This involves tuning prompts based on the specific AI tool being used and the desired output.
4. AI Governance and Policy: Organizations need to establish clear policies surrounding AI usage. This includes defining which AI tools are approved, what types of data can be processed, and for what purposes. Clear boundaries for AI's role in decision-making must be established, reinforcing that humans ultimately own the outcome of incident response.
5. Humans in the Loop: Hollenberger emphatically stated that "humans are still needed." AI cannot replace human decision-making, interpretation of results, or the acceptance of organizational risks. AI informs the response, but humans must own the outcome. This means building processes that keep humans involved in reviewing AI outputs, making final decisions on plan updates, and managing the overall incident response strategy.

Implementation Guidance for Defenders:

Hollenberger provided practical advice for safe adoption:

• Start Small: Pilot AI review with a small section of the IRP.
• Define Criteria Early: Clearly establish what the plan is being reviewed against (e.g., NIST 800-61R3, CSF 2.0).
• Tune Prompts: Iteratively refine AI prompts during the pilot phase.
• Validate Outputs: Always manually review AI findings for accuracy.
• Anonymize Data: Use anonymized data, especially with public LLMs.
• Document Decisions: Record why specific changes were made or rejected.
• Understand the Platform: Research how the chosen AI platform handles data and its terms of service.

By carefully navigating these opportunities and challenges, defenders can leverage AI to significantly enhance their incident response readiness, ensuring their plans are robust, current, and capable of withstanding the increasingly sophisticated attacks of today's threat landscape.

Key Takeaways

• AI augments, not replaces, human expertise: AI serves as a powerful force multiplier, significantly accelerating IRP reviews and increasing coverage, but human oversight and validation remain indispensable for decision-making and interpreting results.
• Different AI models vary in performance: Tools like ChatGPT, Microsoft Copilot, and Google Gemini offer distinct capabilities, levels of detail, and accuracy. Defenders must evaluate and select AI tools based on their specific needs and be aware of their limitations (e.g., Gemini's fabricated CSF ID).
• Prompt engineering is critical for effective results: To obtain meaningful and structured outputs, users must invest time in refining and tuning AI prompts, tailoring them to both the specific AI tool and the desired evaluation criteria (e.g., mapping to CSF IDs).
• Data sensitivity and AI governance are paramount: Organizations must carefully consider the confidentiality of IRP data when using AI, understanding data retention policies of public LLMs and establishing internal policies for AI usage to prevent inadvertent data exposure.
• AI facilitates proactive IRP strengthening: Beyond identifying gaps, AI can generate actionable language and propose new sections to update IRPs, helping organizations align with current threat trends (e.g., Ransomware-as-a-Service, supply chain risks) and compliance standards.
• Safe adoption requires a structured approach: Implement AI by starting small, defining clear evaluation criteria, validating outputs, anonymizing sensitive data, and maintaining clear boundaries for AI's role while keeping humans in the loop for critical decisions.

About the Speaker(s)

John Hollenberger is a seasoned cybersecurity professional with approximately 20 years of experience in the industry. He currently serves as a Proactive Consultant at Fortinet, focusing on helping organizations strengthen their security posture before incidents occur. His extensive background includes significant time spent in proactive incident response, as well as roles as an IT Director and in security operations. This diverse experience provides him with a comprehensive understanding of the challenges organizations face in preparing for and responding to cyber incidents, making him a credible voice on topics such as incident response planning and leveraging emerging technologies like AI.