During storm season, 311 experiences oversized prompt floods against its resident assistant. Which AI threat concern should vulnerability management address?

During storm season, oversized or high-volume prompt floods against a 311 resident assistant are availability threats: model or endpoint denial-of-service that degrades civic service when demand peaks. Vulnerability management should address capacity controls, rate limiting, abuse detection, and graceful degradation so residents retain channels for storm-related needs. Treating prompt floods as an AI availability concern works because generative endpoints consume compute per request; abusive volume is a continuity risk, not merely a performance curiosity.

Confidentiality threats such as sensitive resident data disclosure in assistant responses fail because the scenario describes oversized prompt volume knocking down the assistant, not leakage of resident data; the priority is keeping the endpoint available during peak demand. Integrity threats such as prompt injection manipulating storm shelter referral guidance fail because the described attack is abusive prompt volume causing denial-of-service, not altered or misleading outputs; the continuity risk is availability, not corrupted guidance. Privacy threats such as membership inference revealing resident service history from responses fail because the storm-season issue is prompt floods exhausting capacity, not inference attacks extracting service history from replies; availability controls are the relevant mitigation.

Exam caveat: availability controls must preserve equitable access—rate limits should distinguish abusive automation from surge of real residents where feasible. Operational check: set per-user and per-IP prompt rate limits, alert on anomalous token or request volume, rehearse storm runbooks that include AI endpoint scaling and fallback to human 311 queues, and verify dashboards remain online during load tests that simulate flood conditions.