Public-health security’s annual plan still budgets zero hours for RAG and vector-database threat reviews. What roadmap update is needed?
Select an answer to reveal the explanation.
Short Explanation
If the roadmap never mentions RAG or vector stores, GenAI risk is invisible. Budget real review hours. Antivirus-only plans, “embeddings are harmless,” and lobby art do not cover the platform.
Full Explanation
Public-health security roadmaps must budget time for GenAI platform threats, including RAG and vector-database reviews. Vector stores and retrieval pipelines introduce poisoning, cross-tenant retrieval leakage, insecure embeddings pipelines, over-privileged index access, and prompt-driven data exfiltration paths that classic workstation antivirus planning never covers. Adding GenAI platform coverage—including RAG and vector-store threat reviews—makes those risks visible and funded.
Replacing all security work with a single antivirus signature update for workstations collapses modern platform risk into endpoint malware hygiene. Assuming vector stores are risk-free because they store “only embeddings” ignores that embeddings and metadata can still encode sensitive content and enable retrieval abuse. Funding only a lobby sculpture named after the chatbot is theatrical spend unrelated to threat coverage.
Exam caveat: “embeddings aren’t plaintext” does not mean “no confidentiality or integrity risk.” Operational check: put RAG/vector threat-review hours on the annual security plan, assign an owner, and produce findings for index ACLs, data provenance, and retrieval abuse tests before expanding the public-health assistant’s corpus.