Lab Guide — AI Risk & Governance Review

Facilitated exercise · 40 minutes · Fictional organisation

What this lab is

For a fictional organisation, your group maps where AI raises attack risk, where AI could help your defenders, and where staff AI use leaks data — then proposes one governance control for each. The aim is a balanced, actionable view rather than hype or fear.

Part A — Threat & tool (15 min)

Both sides of the ledger

List three ways AI raises attack risk against this organisation (tie each to an earlier lesson where you can).
List two ways AI could help its defenders, with the human-in-the-loop boundary for each.

Part B — Your own risk surface (15 min)

Where staff use leaks data

Where are employees most likely to paste sensitive data into public AI tools?
Where might "shadow AI" already be in use with no oversight?

Part C — Governance (10 min)

One control each

Propose one governance control for threat, for defensive use, and for staff use (e.g., an acceptable-use rule, a data-classification gate, a human-in-the-loop requirement).

✓ Self-check: your group produced a balanced view — concrete threats, concrete defensive uses with human boundaries, and one governable control for the data-leakage risk.