An AI-powered anomaly detection system at a hospital has been operational for 45 days. In the last 3 days, it has generated 2,400 alerts — 10x the rate of the previous 6 weeks. Investigation reveals the hospital just completed a major EHR system migration that required all staff to access systems outside their normal patterns. What does this situation BEST illustrate about anomaly-based detection?

A security team deploys an AI code vulnerability scanner on all web applications before deployment. The scanner flags a function as a SQL injection vulnerability at 0.93 confidence. The development team lead says: “The confidence is high enough — deploy the fix automatically without review.” Why is this approach problematic?

The difference between a true positive and a false negative in an intrusion detection context is best described as:

Which of the following accurately describes the relationship between AI security tools and human oversight?

I. AI security tools should be used to automate routine high-volume detection tasks (reviewing millions of log entries, scanning code, scoring emails), while human analysts handle contextual judgment and response decisions.
II. Once AI security tools are properly configured, human oversight is no longer required because AI accuracy exceeds human accuracy at scale.
III. Human oversight is most critical when AI makes consequential recommendations such as blocking traffic, isolating systems, or deploying code fixes — errors in these actions have direct operational impact.

A company’s AI-powered SOAR platform is configured to automatically isolate any workstation that triggers three simultaneous anomaly conditions. The platform correctly isolated a workstation last Tuesday, preventing a ransomware spread. Today, it isolated the IT director’s workstation during a legitimate after-hours maintenance window she had not registered with the SOAR exception system. Which statement BEST describes both events?