The Security Incident Report Template That Gets Budget Approved, Not Filed and Forgotten

Security people speak in TTPs, CVEs, and MITRE ATT&CK techniques. Executives speak in downtime, regulatory exposure, customer trust, and cost. Before writing a word of the report, do this translation exercise for every significant finding:

Technical: 'The attacker achieved persistence via a scheduled task running a PowerShell one-liner that beaconed to a C2 every 10 minutes for 23 days before detection.'

Business translation: 'An unauthorized party had undetected access to our network for 23 days. During that period they had access to [list the systems they touched]. If they had exfiltrated the customer data in those systems, we would be looking at GDPR Article 83 fines of up to 4% of global annual revenue, plus notification costs estimated at $X based on [X] affected records at the industry average of $7.91 per record.'

That second version gets attention. The first version gets filed.

Section 1: What happened (3 sentences maximum)

Lead with the plain-English summary. Who detected it, when, what was affected, and whether data left the building. This is the only section every executive will read in full, it needs to give them the complete picture in under 60 seconds.

Example: 'On [date], our SIEM flagged unusual outbound traffic from a finance department workstation. Investigation confirmed a credential phishing attack had compromised one employee account on [date, X days earlier]. The attacker accessed [specific systems listed]. No data exfiltration was confirmed; however, the attacker had read access to [specific data types] for [X] days.'

Section 2: Business impact (the critical section)

This is where most reports fail. Populate every line with real numbers or documented estimates.

• Downtime: [X hours] of [system name] downtime during investigation and containment. Estimated operational cost: $[X] based on [revenue/hour or hourly labor cost of affected teams].
• Data at risk: [X records] of [data classification, PII, PHI, financial] were accessible to the attacker. Estimated notification cost if exfiltration confirmed: $[X]. Regulatory exposure: [specific regulation and potential fine range].
• Recovery costs: [X hours] of security team time at average loaded cost of $[X]/hour = $[X]. External forensics: $[X] if engaged. Total incident cost to date: $[X].
• Insurance: [Did this trigger a reportable claim? Yes/No. Policy deductible: $X.]
• Reputational: [Customer notification required? Yes/No. Press release required? Yes/No.]

For near-misses where no breach occurred, include a counterfactual cost box:

'Had the attacker exfiltrated the [X] customer records they had access to, estimated costs would have been: notification $[X], regulatory fines $[X], forensics $[X], legal $[X], reputational: [describe]. Total: $[X]. The cost of the controls that detected and contained this incident: $[X]/year.'

That last line is how you justify your security budget in a single paragraph.

Section 3: How it happened (one page maximum)

The technical timeline, written in plain English with jargon defined on first use. Use a table format: Date/Time | What Happened | How We Know. End with a single sentence identifying the root cause.

Example root cause: 'The attacker gained initial access by sending a credential phishing email that bypassed our email security gateway. The employee completed an MFA prompt that they believed was legitimate, a technique called MFA fatigue where attackers spam approval prompts until a user approves one.'

Section 4: What we're doing about it (the ask)

This is the decision section. Structure it as a table with three columns: Action | Cost | Risk Reduced | Status. For example: Deploy phishing-resistant MFA (FIDO2) at $X/year eliminates MFA fatigue attack class and needs approval; Email security gateway upgrade at $X/year catches 94% of credential phishing and needs approval; User awareness training at $X/year reduces click rate from X% to target X% and has been implemented.

Never list more than five actions. If you have more, prioritize by risk reduction and include an appendix. Decision fatigue kills budget requests.

Section 5: Compliance and legal (if applicable)

• GDPR/CCPA/HIPAA notification requirements and deadlines
• Law enforcement notification (FBI IC3 if ransomware)
• Cyber insurance claim status
• Board notification requirement under your company's incident response policy

Before (technical, gets ignored): 'CVE-2024-21413 was exploited via a malicious Office document attachment. The attacker established persistence using a scheduled task (T1053.005) and used Cobalt Strike for C2 communications over HTTPS to avoid detection. Lateral movement was observed via PsExec to three additional hosts.'

After (business-framed, gets action): 'An attacker exploited a known vulnerability in Microsoft Office to gain access to one employee's computer. Over the following 8 days, they moved to three additional computers, including two in the finance department, while communicating with external servers disguised as normal web traffic. The attacker had access to our accounts payable system, payment card processing credentials, and the finance shared drive containing [X] vendor banking records during this period.'

The technical details belong in the appendix for your security team. The executive summary gets the business version every time.

Every experienced CISO I've talked to says the same thing: the reports that generate immediate budget approval are the ones that show the cost of what almost happened next to the cost of the control that would prevent it.

'This attack cost us $47,000 in labor and $22,000 in forensics. Phishing-resistant MFA would have prevented it. Annual cost: $8,400.'

That math works every time.