Automate security training follow-up
Follow up phishing simulations while the event is still fresh. Track required training by role, remind people about unfinished modules, and give owners a record of completion.
Tools for awareness and training
MCP servers for the tools used in these examples.
Okta
GmailAutomation examples and starter prompts
Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.
Follow up phishing simulations with training
Build me a phishing follow-up automation in Tracecat. After each phishing simulation, record who reported, who ignored, and who clicked in a table. Send reporters a thank-you in Slack, assign clickers the refresher module in Vanta, and track completion with two reminders before escalating to managers. Report the trend by department each quarter. First help me understand how this maps to PR.AT-01 and why reinforcement timing matters more than training content. Ask me which simulation tool we use and how results export. Talk me through keeping the tone helpful so reporting rates go up, not down.
Track role-based training coverage
Build me a training coverage tracker in Tracecat. Map specialized roles to required training: engineers with production access, admins of security tools, and finance staff who approve payments, derived from Okta group memberships. Compare against completion records in Vanta, chase gaps in Slack, and keep an auditable coverage table per role. First help me understand how this maps to PR.AT-02 and why role-based requirements beat one generic course. Ask me which roles carry specialized risk in our org. Talk me through what happens when someone changes roles and their requirements shift.
Send context-aware security nudges
Build me a nudge automation in Tracecat. When a user triggers a low-severity policy event, a risky OAuth grant, a file shared externally, or a password reuse alert, send them a short Slack note explaining what happened and the two-line version of the policy, with a link to the full one. Log acknowledgments and surface repeat patterns to the security team instead of punishing one-offs. First help me understand how this maps to PR.AT-01 and why teaching at the moment of the event outperforms annual training. Ask me which policy events fire often enough to be worth nudging. Talk me through keeping nudges rare enough that people still read them.
NIST CSF 2.0 mapping: PR.AT
Official NIST category: Awareness and Training. The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks
The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.
- PR.AT-01AT-2AT-3
Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources
- Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)
- Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole
- Periodically assess or test users on their understanding of basic cybersecurity practices
- Require annual refreshers to reinforce existing practices and introduce new practices
- PR.AT-02AT-3
Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data
- Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties
- Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles
- Require annual refreshers to reinforce existing practices and introduce new practices
Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.
Build your own security automation
Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.