AI › Module 9 › Lesson 2
Severity Triage
Severity triage literacy — risk score, user impact, exploitability literacy, effort — rank `$AI_LAB` finding backlog.
Visual · t32_severity_triage
Severity triage = named ranking rows. $AI_LAB. Original Cyberlium.
Opening
Not every AI finding ships today — name triage factors on YOUR lab backlog before drowning the team in low-severity noise.
Severity triage literacy names: severity score category, user/data impact stub, exploitability literacy (without public kit — from eval context), fix effort estimate, compensating control category, and guard regression risk. Analyst ranks five `$AI_LAB` findings from Modules 6–8 — documents priority order with one-line rationale each — without reprioritizing to skip data-leak rows, without claiming 'accept all critical' without note, without unauthorized prod emergency change. Cyberlium teaches defender triage vocabulary — ordered backlog for mentor review. Refused: hiding critical findings, priority fraud, prod change without RoE. Lab row: prioritized finding list five items with rationale column.
1. Priority factors
Severity, user impact, exploitability literacy, effort, compensating control — five ranking anchors.
Data leak + high user impact typically outranks cosmetic — document rule.
Command guide
Try these commands — Priority factors
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/); NIST AI RMF (https://www.nist.gov/itl/ai-risk-management-framework); OpenAI safety (https://openai.com/safety). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Backlog discipline
Each row links Module 6–8 finding ID — traceable to evidence pack.
Compensating control requires owner stub and review date UTC.
3. Refused
No priority fraud; no skip sensitive disclosure row without documented accept.
Triage supports fix order — not finding suppression.
4. What you ship: prioritized AI finding backlog
Five findings ranked + rationale each + NEVER hide critical line.
5. What you record before the next lesson
Prioritized AI finding backlog path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Rank prompt-injection data-leak finding last because 'lab only so ignore.'
Right
Prioritized backlog from `$AI_LAB` findings. Next: Responsible Disclosure.
Mission: prioritized AI finding backlog
1) Name five triage factors. 2) Rank five lab findings. 3) Rationale column per row. 4) Write NEVER hide critical line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Compensating control — minimum note?”
Knowledge Check
APPLY: Severity triage uses:
Multiple choice
Knowledge Check
APPLY: True or False: Ignoring data-leak because lab is OK.
True or False
Knowledge Check
APPLY: Triage factors include:
Multiple choice