Facilitator Notes & Model Answers — Lesson 11
For instructors and self-study · Model view and rationale
Model AI threat / tool / governance table
| Lens | Examples | Governance response |
|---|---|---|
| Threat | Flawless phishing; real-time deepfakes; faster recon; lowered barrier | Verification rule (Lesson 09); phishing-resistant auth (Lesson 04); OPSEC (Lesson 05) |
| Tool | Detection/triage, summarisation, response acceleration | Adopt with human-in-the-loop on consequential decisions |
| Own risk surface | Data leakage into public tools; prompt injection; over-trusted output; shadow AI | Acceptable-use rules; data classification first; inventory and govern tools |
Why the poll answer is C (deepfake fraud + data leakage)
- A — autonomous AI malware: exists in limited forms but is not the dominant near-term risk for most organisations.
- B — AI-written zero-days: specialised and still relatively rare; not most orgs' day-to-day exposure.
- C — deepfake fraud + staff data leakage: the realistic, present-day damage — and both are governable with verification and acceptable-use rules.
- D — self-aware AI: science fiction, not a security plan.
Teaching point: govern the mundane, high-probability risks first. Leaders drawn to the dramatic answers under-invest in the controls that actually matter now.
Homework — what good looks like
Task 1
Strong guidelines are three memorable lines and explicitly forbid pasting client, personal, or classified data into public tools.
Task 2
The best answers keep a human accountable for a genuinely consequential decision (hiring, funding, disclosure), with AI clearly in an assisting role.
Task 3
Good answers name a realistic shadow-AI tool (a public assistant used for drafting) and a governance question about what data flows into it.