Exercise 4: The False Confidence Check

Before you continue to Module 2, write down what this module did NOT cover. What AI-related threats do you think exist that weren't addressed here? What aspects of AI security do you know you don't understand? What attack types exist that this module didn't mention?

This question is the most important one. The purpose is to keep the ceiling visible. This course is a foundation. It's not comprehensive. It doesn't address nation-state threats, organizational security architecture, technical forensic analysis, or many other aspects of security.

Your answer to this question tells you where you need to be careful not to overestimate what you know. If you write down "I have no idea how organizations actually detect and respond to breaches," that's exactly right — this course doesn't cover it, and you should be cautious about making decisions that assume you understand incident response. If you write down "I know generative AI is involved in attacks somehow but I don't really understand how," that's also exactly right — that's a gap you've identified, and that gap affects your threat model.

Write down three things you know you don't know about AI security. Don't worry about the length. The point is to map the edge of your knowledge, because that edge is where your overconfidence would be most dangerous.

What You've Built

You now have three concrete pieces: a personal threat model identifying the attack vectors most relevant to you, verification processes for the requests you actually receive, and a clear picture of what you don't know. That's your foundation. Module 2 takes this foundation and applies it specifically to data sharing with AI tools. Everything in Module 1 is about how threats have changed. Module 2 is about what you actually control — where your data goes and who has access to it.

Module Deliverable

Before moving to Module 2, you should have written down:

✅ A personal threat model: the two to three attack vectors most relevant to your specific situation, and your initial response plan for each.

If you don't have this, go back. The rest of the course builds on this foundation, and the foundation needs to be your specific situation, not a generic threat landscape.

Connecting Forward

Module 2 moves from threats to your specific data exposure: what you're sharing with AI tools, what those tools do with it, and how to make informed decisions about what belongs in cloud AI and what doesn't. You'll take the threat model you built here and apply it to the most immediate risk most people face: unthinking data sharing with tools they haven't evaluated.