報告撰寫實戰演練

## Executive Summary
 
[Client Name] engaged [Red Team Name] to conduct an AI security assessment
of [system name] from [start date] to [end date]. The assessment focused
on [testing categories] using [methodology description].
 
### Key Findings
 
The assessment identified **[N] findings**: [X] Critical, [Y] High,
[Z] Medium, and [W] Low severity. The most significant findings include:
 
1. **[Critical finding title]** -- [One sentence impact description].
   An attacker could exploit this to [specific business impact].
 
2. **[High finding title]** -- [One sentence impact description].
   This vulnerability allows [specific business impact].
 
3. **[High finding title]** -- [One sentence impact description].
 
### Overall Risk Assessment
 
The [system name] currently presents a **[HIGH/MEDIUM/LOW]** risk level.
[2-3 sentences explaining why, in business terms].
 
### Priority Recommendations
 
1. **Immediate** (within 1 week): [Action] to address [Critical finding]
2. **Short-term** (within 1 month): [Action] to address [High findings]
3. **Medium-term** (within 3 months): [Action] for defense-in-depth

### Finding [ID]: [Descriptive Title]
 
**Severity:** Critical | High | Medium | Low | Informational
**Category:** Prompt Injection | System Prompt Extraction | Tool Abuse | Content Policy Bypass | Data Exposure | ...
**CVSS Score:** [if applicable]
**Status:** Confirmed | Needs Verification
 
#### Description
 
[2-4 sentences describing the vulnerability in plain language.
What is it? Why does it exist? What is the root cause?]
 
#### Impact
 
[What could an attacker achieve? Express in business terms.
Include scope: how many users affected, what data exposed, etc.]
 
#### Steps to Reproduce
 
1. Navigate to [target endpoint]
2. Send the following request:
 

**Severity: High**
 
**Justification:** This finding is rated High rather than Critical because:
- The data exposed (system prompt) does not directly contain customer PII
- However, the system prompt reveals business logic and connected tool names
  that significantly reduce the effort required for further attacks
- An attacker with the system prompt can craft targeted injection attacks
  with much higher success rates

## Remediation Roadmap
 
### Immediate (Within 1 Week)
| Finding | Action | Effort | Owner |
|---------|--------|--------|-------|
| FINDING-001 (Critical) | Add anti-injection clause to system prompt | 2 hours | AI Team |
| FINDING-003 (Critical) | Restrict order_lookup to current user only | 4 hours | Backend Team |
 
### Short-Term (Within 1 Month)
| Finding | Action | Effort | Owner |
|---------|--------|--------|-------|
| FINDING-002 (High) | Deploy ML-based input filter | 2 weeks | Security Team |
| FINDING-004 (High) | Implement output scanning | 1 week | AI Team |
 
### Medium-Term (Within 3 Months)
| Finding | Action | Effort | Owner |
|---------|--------|--------|-------|
| FINDING-005 (Medium) | Migrate to defense-in-depth architecture | 4 weeks | Platform Team |
| FINDING-007 (Medium) | Implement conversation monitoring | 3 weeks | Security Team |

## Data Handling
 
- Report: Encrypted copy retained for [X] months per contract terms
- Evidence: Destroyed [X] days after report delivery
- Test accounts: Credentials rotated or accounts deleted
- Local data: Secure wipe of engagement directory