A county after-action review finds an AI agent overstated severity by ignoring compensating firewalls documented beside the scan. What calibration lesson applies?
Select an answer to reveal the explanation.
Short Explanation
A hole behind a locked gate is not the same as a hole on the sidewalk. Teach the AI about the firewall notes next to the scan, or severity theater takes over the after-action.
Full Explanation
A county after-action finding that an AI agent overstated severity by ignoring compensating firewalls documented beside the scan teaches calibration discipline. AI contextualization must be calibrated with compensating civic network controls documented alongside scan evidence—segmentation, WAF, allowlists, jump-host requirements—so residual risk reflects reachability, not CVE strings alone. Otherwise leadership funds severity theater instead of true exposure reduction.
Always inflating severity so leadership funds every finding regardless of firewalls wastes scarce county budgets and erodes trust when owners prove non-reachability. Deleting firewall documentation from the knowledge base so AI never softens ratings intentionally blinds the model to compensating controls. Treating compensating controls as irrelevant once any CVE string appears ignores how municipal defense-in-depth actually reduces exploitability.
Exam caveat: severity contextualization is not the same as closing a finding. Controls may lower priority or change urgency while patching still remains tracked to policy.
Operational check: include approved network-control docs in the RAG corpus; require AI rationales to cite both plugin evidence and control references; have humans spot-check high-severity items for missed compensating controls before executive reporting.