SECAI Core · phase 14 of 15 · noun
Playbook
A checklist of actions to perform to detect and respond to a specific type of incident.
The Explain card
- Plain English
- A playbook is a checklist of concrete actions for detecting and responding to one specific type of incident, step by step, so responders do not have to improvise.
- Example
- A prompt injection playbook lists: capture the offending prompt and response, check whether any tool calls executed, revoke the tokens the agent used, update the input filter, and file the case in the incident tracker.
- Why it matters
- Under pressure, people forget steps. A playbook makes responses consistent, auditable and fast, and it is the unit of work that automation tools later execute.
- Hook
- The recipe card on the fridge during the kitchen fire.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The security team followed the playbook after the monitoring dashboard flagged a sudden rise in prompt-injection attempts.
How it is built
- play root a performed drama, later a planned sports action
- book root a written collection of information
Where it came from
- Origin
- an English compound formed from play and book
- Entered the language
- 16th century
- What changed
- It first referred to a book of dramatic works, then to a sports strategy manual, and later to a procedural guide used in organizations and cybersecurity.
How it is spelled
- Pattern
- It is a closed compound written as one word.
- Pattern
- The full spellings of play and book remain visible in the compound.
Spelled like
- handbook
- textbook
- workbook
Broken into chunks
-
play
- playground
- playhouse
- playwright
-
book
- notebook
- storybook
- guidebook
What it sits beside
Same subject
- incident response
- prompt injection
- model monitoring
- containment
Same shape
- handbook
- rulebook
- workbook
operational documents
- playbook
- runbook
- checklist
closed compounds ending in book
- playbook
- notebook
- textbook
Where it sits in the deck
Phase 14: Incident Response, Evaluation, and Knowledge Bases
When detection fires, teams need structured response plans, scoring frameworks, and curated knowledge bases to triage, measure, and learn from AI security events.
