Skip to content
AI Security

Interview question · Security Foundations & Threat Modeling

A product team wants to ship an LLM feature next week, and the security review is not done. What do you do?

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

mediumNewPreparation tags: Anthropic, OpenAI, GoogleUpdated Nov 2026

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A team plans to ship an AI summarisation feature next week and has not asked for a security review.

  1. Should you block the launch?
  2. What decides the risk?
  3. What would you check in a day?
  4. What if you find a real issue?
  5. How do you avoid this next time?
  6. How would you handle the situation?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackExplain an AI security risk to a CISO: the impact, the options, the residual risk and the decision you need.Next in this trackWalk through the incident response lifecycle using a leaked API key as the example.Next in this trackThreat-model a password-reset flow.
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.