Primary speaker:
Ryan Lahti, Technology Adoption Consultant, Education Commons, OISE
Additional speaker:
Dinushy Elamurugan, Technology Adoption Consultant, Education Commons, OISE
Description:
Many of us at U of T now use generative AI tools like ChatGPT and Gemini in our daily work. But what happens if someone accidentally shares sensitive student information with a chatbot? Are our leaders ready to respond?
In this session, we will share how we designed and ran a cyber security tabletop exercise for senior leaders, using a scenario of an AI-related insider data breach. Our aim was not technical training but to encourage open, practical conversations about risk, responsibility, decision-making and digital trust in today’s AI landscape.
We will present this session as a case study:
- First, we will talk about the increasing risk of insider threats and accidental data exposure that can lead to serious cyber security breaches.
- We will give a short walkthrough of the tabletop scenario to show how we set up the exercise and how the situation unfolded in real time.
- We will share what we learned from the session, including how leaders responded, the challenges that came up, where our strengths and weaknesses emerged and any unexpected insights.
- We will also discuss how OISE is using available tools and awareness programs to lower the risk of AI-related incidents.
- We will explain how this exercise helped OISE test and improve its incident response plan.
- Finally, we will share a toolkit with templates, planning materials and tips to help you run a tabletop exercise in your own department.
You will leave with a practical model for involving leaders in real conversations about AI risk and insider threats, and a way to move from abstract policy discussions to real-world readiness.
