AI Security Program Leadership and Communication
Domain 8 tests program leadership: how to build and run an AI security program, set risk appetite, assign roles, measure performance, and communicate with executives, engineers, regulators, and customers. Expect scenario questions on prioritization and stakeholder messaging.
Core rules and concepts
- Anchor the program in a documented risk appetite approved by executive leadership. Translate it into thresholds for model use, data sensitivity, autonomy, and third-party dependence.
- Define roles: accountable executive, AI risk owner, security architecture, privacy, legal, model owners, and incident response. Avoid unclear shared ownership.
- Use metrics that reflect risk reduction: percentage of AI systems inventoried, high-risk systems with completed assessments, mean time to patch model vulnerabilities, prompt-injection test pass rate, and incident recurrence.
- Third-party risk needs more than questionnaires: model provenance, security testing evidence, contractual notification, data-use terms, and exit/portability.
- Communication must be audience-specific: board wants business impact and risk tolerance; engineers want control requirements and test evidence; regulators want accountability and documentation.
Worked example
A board asks whether the company chatbot is 'safe.' The security lead presents: inventory coverage, risk tier, top three residual risks with owners, test results for prompt injection and data leakage, incident trends, and a decision request to fund per-user retrieval controls. The message avoids raw CVE counts and instead ties risk to customer trust and regulatory exposure. The board approves the control and sets a quarterly review trigger. The exam rewards business framing plus evidence, not reassurance.
Traps that cost marks
- Reporting technical metrics without business impact or risk acceptance.
- Treating AI security as an IT-only project with no executive sponsor.
- Overpromising 'safe AI' instead of stating residual risk.
- Running a third-party review that stops at the questionnaire.
- No feedback loop from incidents into training and architecture.