City incident response needs a structured way to classify an attack on a municipal LLM gateway. Which approach best supports AI threat assessment?

City incident response classifying an attack on a municipal LLM gateway is best supported by using an AI threat-modeling framework such as MITRE ATLAS-style tactics to map adversary behaviors against the gateway, prompts, models, and supporting services. That approach works because AI-specific tactics—prompt injection, model theft attempts, tool abuse, data poisoning paths, and gateway credential misuse—do not map cleanly to classic network-malware labels alone. Structured AI taxonomies give municipal responders a shared vocabulary for triage, hunting hypotheses, evidence collection, and after-action reporting so AI incidents are characterized consistently across departments. Using MITRE ATT&CK enterprise tactics such as credential access to classify adversary behaviors against the LLM gateway fails because enterprise tactics describe conventional host and network techniques while under-describing prompt, retrieval, and model-manipulation behaviors that dominate LLM-gateway attacks. Using OWASP LLM Top 10 categories such as prompt injection to classify adversary behaviors against the municipal LLM gateway fails because the Top 10 catalogs application weaknesses for secure development, not sequential adversary tactics across gateway, prompts, models, and tools needed for threat assessment. Using NIST AI Risk Management functions such as Govern and Map to classify adversary behaviors against the municipal LLM gateway fails because those functions guide governance and risk lifecycle management, not tactical classification of attacker methods, intent, or bypassed defenses.

Exam caveat: ATLAS-style mapping improves classification but does not replace full IR playbooks, chain-of-custody, or legal hold when resident data may be involved. Operational check: add an AI-technique field to the municipal IR ticket template, require analysts to tag LLM-gateway incidents with at least one AI tactic before closure, and sample closed tickets quarterly for taxonomy completeness.