A SaaS-based LLM system has risks including prompt injection, data poisoning, and model exfiltration. What is the BEST way to ensure consistent risk treatment?

The correct answer is B. Implement an AI threat control matrix mapping threats to controls and assurance. Answer B is correct because an AI threat control matrix explicitly maps each identified threat (e.g., prompt injection, data poisoning, model exfiltration) to the specific controls designed to mitigate it, along with assurance mechanisms to verify those controls work. This…

AI Security Risk Management

Question

Options

AApply control baselines from a recognized industry standard
BImplement an AI threat control matrix mapping threats to controls and assurance
CFocus on post-deployment red teaming
DRely on vendor audit reports and SLAs

How the community answered

(34 responses)

A
12% (4)
B
68% (23)
C
3% (1)
D
18% (6)

Explanation

Answer B is correct because an AI threat control matrix explicitly maps each identified threat (e.g., prompt injection, data poisoning, model exfiltration) to the specific controls designed to mitigate it, along with assurance mechanisms to verify those controls work. This structured mapping ensures no threat is left unaddressed and provides consistent, repeatable risk treatment across the system. Option A (applying industry standard baselines) provides a useful starting point but is generic and may not address LLM-specific threats in sufficient depth. Option C (post-deployment red teaming) is reactive and occurs too late in the lifecycle for consistent preventive treatment. Option D (vendor audit reports and SLAs) is a third-party assurance mechanism, not an internal risk treatment strategy.

Topics

#AI Risk Management#Threat Control Matrix#Consistent Risk Treatment#LLM Security

Community Discussion

No community discussion yet for this question.

Full AAISM Practice