Museum district IT is planning the annual cybersecurity tabletop exercise. How should they treat AI-specific risks?
Select an answer to reveal the explanation.
Short Explanation
Tabletops aren’t only for ransomware anymore—deepfakes and prompt injection belong on the same playbook. Practice the weird AI day so the real one isn’t your first rehearsal.
Full Explanation
Museum district IT should treat AI-specific risks as in-scope for the annual cybersecurity tabletop by including scenarios such as deepfakes, prompt injection, and generative misinformation alongside classic threats. Tabletops rehearse decision-making under stress; modern civic cultural institutions face both ransomware-style events and AI-enabled deception or abuse against public trust, collections messaging, and staff assistants. Folding those scenarios into the same exercise builds muscle memory for verification, communications, and escalation when the incident is synthetic or prompt-driven rather than purely malware-driven.
Excluding AI entirely because tabletops only cover ransomware freezes the exercise design in an outdated threat model and leaves the museum unpracticed for deepfake or chatbot abuse days. Replacing all network monitoring with a single chatbot for incident response abandons necessary detection telemetry and invents an unsafe dependency. Assuming AI threats only apply to private-sector retailers, not museums, ignores that civic and cultural brands are frequent targets for misinformation and trust attacks.
Exam caveat: including AI scenarios expands the tabletop; it does not mean dropping classic malware, phishing, or backup-recovery drills. Operational check: add at least one deepfake or prompt-injection inject to the annual exercise, define verification channels for public statements, and capture after-action items for AI-specific playbook updates.