A security team retrains its cloud threat-detection model weekly using an external indicator feed that it subscribed to from an unverified source. A reviewer warns that the feed could be manipulated to make the model ignore certain attacker behavior. Which control best addresses this risk?

Data poisoning attacks manipulate training data so a model learns attacker-chosen behavior, such as treating specific malicious activity as benign. A threat-detection model retrained on an unverified external feed is exposed because the feed's content is accepted without knowing who produced it or whether it is accurate. Data source validation and verification addresses this: confirm the source's identity and reputation, verify integrity through signatures or hashes, check records for consistency, anomalies and label quality, and quarantine or reject data that fails before it influences training. Retraining more often does not dilute poisoned data; it gives a manipulated feed more frequent influence over the model. TLS protects the feed only in transit, ensuring nobody alters it on the way; it says nothing about whether the source itself supplied accurate or malicious records. Lowering the alert threshold increases noise across the board while leaving the poisoned behavior learned as normal, so the targeted blind spot remains. Exam caveat: the 2026 outline lists data source validation and verification under AI and ML, and the same concern appears in data protection of AI and ML data sets. Operational check: maintain a record of approved training sources with their verification method, and compare model detection rates on a trusted holdout set after each retraining.