AI › Module 9 › Lesson 2
Severity Triage
Severity triage literacy — risk score, user impact, exploitability literacy, effort — rank `$AI_LAB` finding backlog.
Visual · t32_severity_triage
Severity triage = named ranking rows. $AI_LAB. Original Cyberlium.
Opening
Not every AI finding ships today — name triage factors on YOUR lab backlog before drowning the team in low-severity noise.
Severity triage literacy names: severity score category, user/data impact stub, exploitability literacy (without public kit — from eval context), fix effort estimate, compensating control category, and guard regression risk. Analyst ranks five `$AI_LAB` findings from Modules 6–8 — documents priority order with one-line rationale each — without reprioritizing to skip data-leak rows, without claiming 'accept all critical' without note, without unauthorized prod emergency change. Cyberlium teaches defender triage vocabulary — ordered backlog for mentor review. Refused: hiding critical findings, priority fraud, prod change without RoE. Lab row: prioritized finding list five items with rationale column.
1. Priority factors
Severity, user impact, exploitability literacy, effort, compensating control — five ranking anchors.
Data leak + high user impact typically outranks cosmetic — document rule.
Command guide
Try these commands — Priority factors
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP LLM Top 10 — https://owasp.org/www-project-top-10-for-large-language-model-applications/ NIST AI RMF — https://www.nist.gov/itl/ai-risk-management-framework OpenAI safety — https://openai.com/safety
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
python3 - <<'PY'
priority = ['Critical: secret exfil from YOUR app with live API keys', 'High: tool plugin arbitrary code exec', 'Medium: echo-bot injection bypass in lab', 'Low: missing eval regression for toxicity']
print('AI finding severity triage (YOUR apps):')
for p in priority: print(f' - {p}')
PYCommand — copy this
cat > "$AI_LAB/findings/severity-triage.md" <<'EOF' # Severity Triage — map to OWASP LLM categories 1. LLM06 secret disclosure + LLM08 excessive agency 2. LLM01 prompt injection with tool access 3. LLM02 insecure output handling (XSS/code exec) 4. LLM03/LLM05 supply chain and poisoning drift Fix in YOUR authorized scope — never exploit stranger LLM apps EOF
Command — copy this
grep -E 'LLM0|YOUR authorized' "$AI_LAB/findings/severity-triage.md"
Primary tools to practice this lesson: grep, python3. Reference sites: OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/); NIST AI RMF (https://www.nist.gov/itl/ai-risk-management-framework); OpenAI safety (https://openai.com/safety). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Backlog discipline
Each row links Module 6–8 finding ID — traceable to evidence pack.
Compensating control requires owner stub and review date UTC.
3. Refused
No priority fraud; no skip sensitive disclosure row without documented accept.
Triage supports fix order — not finding suppression.
4. What you ship: prioritized AI finding backlog
Five findings ranked + rationale each + NEVER hide critical line.
5. What you record before the next lesson
Prioritized AI finding backlog path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Rank prompt-injection data-leak finding last because 'lab only so ignore.'
Right
Prioritized backlog from `$AI_LAB` findings. Next: Responsible Disclosure.
Mission: prioritized AI finding backlog
1) Name five triage factors. 2) Rank five lab findings. 3) Rationale column per row. 4) Write NEVER hide critical line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Compensating control — minimum note?”
Knowledge Check
APPLY: Severity triage uses:
Multiple choice
Knowledge Check
APPLY: True or False: Ignoring data-leak because lab is OK.
True or False
Knowledge Check
APPLY: Triage factors include:
Multiple choice