Each scenario describes an AI security tool in use. Identify the specific failure mode, classify it as false positive or false negative, and determine what human oversight step would have prevented it.

Scenario 3: An AI code vulnerability scanner flags a function as a SQL injection vulnerability. The developer, trusting the AI completely, immediately rewrites the function using parameterized queries. The change breaks a critical reporting feature that relied on dynamic SQL generation for legitimate internal queries. Which failure occurred, and what should the developer have done differently?

You are a security consultant advising Maple Street Veterinary Clinic. They have just deployed three AI security tools. The clinic administrator asks you to explain what each tool does, what it cannot do, and what they still need to do themselves.

1. The administrator says: 'Now that we have Tool A, our staff doesn't need to worry about phishing anymore.' Is this correct? What should you tell her? (2 pts)

2. Tool B has been running for 5 days and has generated 847 alerts so far. Is this normal? What is likely happening? (2 pts)

3. Tool C flagged 3 vulnerabilities in the clinic's patient portal code. The developer fixed all 3 immediately and pushed the update to production. What important step was skipped? (2 pts)

Apply the complete AI defense framework to these harder scenario analysis questions.

Scenario 1: A hospital’s security team deploys an AI model for anomaly detection. After 3 months, they notice the model is generating very few alerts despite known security incidents occurring. Investigation reveals the model was trained during a period when the hospital was under a cyber attack — so the ‘normal’ baseline includes attack activity as part of normal behavior. What is this problem called and how is it fixed? (2 pts)

Scenario 2: Which statement MOST accurately describes why a Zero-Day exploit cannot be caught by a signature-based system on day one, but CAN potentially be caught by an anomaly-based system? (2 pts)

Scenario 3: A CISO says: 'Our AI security tools are fully automated and our security team can focus on other things.' Identify TWO specific risks this attitude creates. (2 pts)