During citywide AI asset discovery, the SOC finds departmental chatbots that never appeared in the central inventory. What recon finding does this primarily represent?
Select an answer to reveal the explanation.
Short Explanation
Shadow AI is the office microwave nobody put on the facilities list—still drawing power, still a surprise during inspection. Untracked departmental bots are recon findings that widen the city's attack surface until they're inventoried and governed.
Full Explanation
During citywide AI asset discovery, departmental chatbots absent from the central inventory primarily represent unmanaged or shadow AI assets that expand the municipal attack surface. Shadow AI typically lacks centralized logging, identity integration, change control, data-handling review, and inclusion in red-team or SOC monitoring scope. Recording these systems as recon findings is the first step toward ownership assignment, policy alignment, and risk acceptance or remediation—core outcomes of municipal AI reconnaissance.
Sanctioned departmental chatbot pilots recorded in municipal procurement workflows fails conceptually: discovery of unlisted bots shows they are not recorded as sanctioned procurement items.
Approved model endpoints cataloged in the central configuration database fails because the unlisted chatbots prove the configuration database does not yet capture all departmental AI endpoints, and governance requires more than cataloged model endpoints.
Vendor API dependencies covered by routine third-party risk reviews fails because those reviews do not register internally built, unlisted departmental chatbots, and asset discovery must still capture them directly.
Exam caveat: Shadow-AI / unmanaged-asset findings are a recurring recon theme. Prefer options that update inventory and governance over assuming that procurement workflows, central configuration catalogs, or third-party risk reviews already account for shadow AI.
Operational check: register each discovered bot with owner, data classification, integrations, and logging status; bring them into the AI asset register and monitoring; and decide retain/retire/harden under change control rather than leaving them as invisible departmental experiments.