A school-district team runs vulnerability scanners to find missing patches, then asks AI to rank findings using internet exposure of student portals. What is the sound use of AI in that workflow?

Sound Domain 7 use of AI in vulnerability workflows keeps scanner-validated findings as the evidence base and uses AI to help prioritize by municipal exposure context—such as internet-facing student portals—under human review. A school-district team that runs scanners to find missing patches and then asks AI to rank findings using portal exposure is illustrating prioritization with context, not replacement of scanners, not auto-exploitation, and not public dumping of vulnerability details. That pattern pairs scanner truth with contextual ranking and governance appropriate for student-data and education environments.

Discarding scanner output for AI-invented CVE numbers fails because hallucinations are not validated findings. Automatically exploiting the top AI-ranked item without change control fails safe municipal operations and authorization. Publishing the full unedited student-portal vulnerability list to social media fails confidentiality and can endanger students and district systems under a false ‘transparency’ banner.

Exam caveat: look for human review, scanner validation, and exposure-based prioritization. Reject options that invent CVEs, auto-pwn, or overshare.

Operational check for school districts: keep scanner exports authoritative, let AI propose rankings by exposure only as advisory, require analyst/change-control approval before remediation testing, never auto-exploit, and share vulnerability details only on approved internal channels with need-to-know—not social media.