AAISM case studies
AAISM · Put your knowledge to work in context.
The ISACA Advanced in AI Security Management (AAISM) is an AI-centric security management certification. ISACA describes it as "the first and only AI-centric security management certification," designed to help experienced IT professionals reinforce the enterprise's security posture and protect against AI-specific threats. Holders are expected to manage evolving security risk related to AI, implement policy, and ensure responsible and effective use across the organization. AAISM is aimed at practicing security managers rather than newcomers. Topics on this exam: AI Governance and Program Management, AI Technologies and Controls, and AI Risk Management. The AAISM case studies are 5 cases and about 2,973 words.
1Conditional Approval of a Vendor GenAI Pilot in Claims
A regional health insurer has 1,200 claims adjusters. The claims VP wants a 90-day pilot of a vendor-hosted generative AI assistant that drafts denial letters and summarizes medical policies. The vendor provides SOC 2 Type II and a 30-day data-retention commitment, but will not disclose training-data sources and offers only a 20% discount if the insurer opts out of prompt logging for model improvement. The AI governance committee has no approved model inventory entry, no DPIA, and no vendor risk tier for this use.
689 words, about 3 min2Computer-Vision Drift After a Resin Supplier Change
A medical-device manufacturer runs a computer-vision model on 12 injection-molding lines to detect surface defects. Each line produces about 40,000 units per shift. The model was validated at 0.7% false-negative rate and 1.1% false-positive rate on a held-out set from Supplier A. After Supplier B began supplying resin six weeks ago, quality engineers observed false negatives at 2.3% and false positives at 4.8%.
639 words, about 3 min3Adverse Impact in an HR Screening Model
A staffing firm uses a third-party ML model to rank applicants for warehouse supervisor roles. The vendor reports 92% overall accuracy and a 'bias-tested' claim. Internal audit sampled 4,000 applicants from the last year and found the selection rate for candidates aged 50+ was 18%, versus 22% for candidates under 30, an adverse impact ratio of 0.81. The model uses graduation year as a feature, and the vendor will not remove it because of contract terms.
632 words, about 3 min4Chatbot Misstatement and AI Incident Classification
At 09:10 on a Tuesday, a bank's customer-facing chatbot began telling customers that overdraft fees would be refunded automatically if they replied 'REFUND'. The bank has 2.4 million retail customers. The chatbot had been updated two days earlier with a new prompt template. By 11:30, 3,200 customers had received the incorrect statement; 14 posted screenshots on social media.
455 words, about 2 min5RAG Permission Bypass Over Sealed HR Documents
A law firm deploys a retrieval-augmented generation assistant over 50,000 internal documents across 8 practice groups. Document-level access controls are synchronized from the document management system every 24 hours. During a red-team test, a paralegal in the litigation group asked for 'all severance terms for departing partners' and the assistant returned a verbatim excerpt from a sealed HR memo. The memo had been moved to a restricted folder 10 hours earlier.
558 words, about 3 min