A city red-team report uses AI after an authorized range exercise. What is the most appropriate use of AI in that after-action workflow?
Select an answer to reveal the explanation.
Short Explanation
AI as a filing clerk for 'what worked against which Defender knob' is great after a city range drill. AI as an unsupervised wrecking ball on production ASR—or a public how-to dump—is not. Harden from the summary; keep humans in charge.
Full Explanation
After an authorized city red-team range exercise, AI is most appropriately used as an after-action analysis aid: summarizing and grouping which evasion classes worked against which Defender features so civic teams can harden controls. That use stays inside the exercise charter, accelerates structured lessons learned, and produces actionable mapping (for example, which mutations bypassed which ASR rules or signature packs) without expanding attack surface on production.
Auto-publishing raw evasion steps to the public transparency portal discloses techniques without defensive value to residents and can aid real adversaries. Silently disabling production ASR based on an AI summary is unauthorized change and increases city risk. Replacing human authorization review with unsupervised AI decisions to retest production removes accountability and violates typical municipal ROE and change control.
Exam caveat: the stem asks for the most appropriate AI use in the after-action workflow—analysis and grouping for hardening—not autonomous production changes or public dump of evasion tradecraft.
Operational check: feed sanitized range results into an AI summarizer under city AI acceptable-use rules, have humans validate the mapping, then open tracked hardening tickets (rule enables, path coverage, detection content) with change-board approval. Keep raw exploit detail in controlled repositories, not public portals.