As of 13 August 2026, AI cannot detect a data breach in your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open your incident response plan, security-provider contact details and the administration consoles for your email, identity, endpoint, firewall and cloud systems.
   2. Export the relevant alerts and logs with their original timestamps and source names, then remove passwords, access tokens, unnecessary personal data and complete customer records.
   3. Record what was already happening before the suspected incident, including planned maintenance, staff changes, software deployments and any known false-positive alerts.
   4. Paste the redacted evidence and business context into the prompt, keeping each event's source and timestamp attached to it.
   5. Compare the model's suspected indicators and missing evidence against the original records in each security console, without treating an unverified model conclusion as proof.
   6. Send the evidence, the model's unconfirmed summary and your comparison to your IT or security provider, and ask a qualified incident responder to investigate any credible sign of compromise.

   Prompt

   Act as a cautious incident-triage assistant, not an incident responder. Analyse only the security evidence I provide below, such as alerts, authentication logs, endpoint findings, firewall events and file-access records. Do not claim that a breach has been confirmed, do not invent missing facts, and do not expose or repeat personal data, passwords, access tokens or full customer records. Return: 1) the indicators that may suggest unauthorised access or data loss, with the exact supporting evidence; 2) benign explanations that remain possible; 3) important evidence that is missing; 4) a prioritised list of safe next investigative actions that do not destroy evidence; 5) systems, accounts, files or data that may need urgent isolation by a qualified responder; 6) questions for our IT or security provider; and 7) a short incident summary clearly labelled as unconfirmed. Flag any conclusion that cannot be checked from the supplied evidence. If the evidence suggests an active compromise, say that a qualified cyber incident response specialist should be contacted immediately. Business context: [industry and system details]. Evidence and timestamps: [paste redacted evidence here].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.