A Speaker Guide for Event Organizers and Planners
AI assistant scenario and restricted material exposure
Choosing a speaker? Use this resource to clarify the session brief; confirm facilitation and deliverables directly.
A fictional, discussion-only exercise for service owners, security teams and business leaders. No real incident or organization is represented.
Use synthetic data. Do not execute commands, test live access or contact external parties. The stages below are a suggested discussion sequence, not actual incident-response deadlines.
Starting situation
An internal AI assistant helps staff summarize approved documents. A user reports that a response appears to include a paragraph from a restricted planning file. The assistant recently received access to a new document connector. You do not yet know whether the text is authentic, who saw it or whether the source permissions were respected.
Stage one assess and preserve
The facilitator presents the report and asks the team to identify the incident lead. What facts must be preserved? Which logs, source versions and access records are available? Who is authorized to view them? Avoid copying sensitive material into an unrestricted chat or ticket merely to document the concern.
- What evidence distinguishes actual exposure from fabricated output?
- Which immediate measures are reversible and within existing authority?
- Who owns the affected business process if the assistant is paused?
Stage two revise the scope
New fictional information: the connector is used by two departments, and the access log is incomplete. A manager asks whether staff can continue using the assistant. Ask participants to state the uncertainty, the decision owner and the rationale for continuing, restricting or pausing use. Do not assume every response or every user is affected.
Stage three communicate responsibly
New fictional information: a colleague has described the concern as a confirmed breach. Draft a short internal update separating what is known, what is being investigated and when the next update is expected. Discuss who approves communications and which legal, privacy or contractual obligations need specialist review. Do not invent a universal notification deadline.
Stage four restore with evidence
The connector configuration has been corrected in the scenario. What tests and approvals are needed before restoration? How will the team verify permissions, check relevant outputs and monitor for recurrence? A successful configuration change alone does not establish that the original exposure has been understood.
Debrief
Record one gap in authority, one gap in evidence and one gap in continuity. Assign owners and verification dates. Do not give the team a numerical readiness grade based on this single exercise.
Source grounding
NIST SP 800-61 Revision 3, published April 2025, integrates incident response with cybersecurity risk management. These exercises and templates are original editorial aids, not official NIST exercises, certification or assurance of readiness.