Which approach should an organization prioritize to effectively verify the security of its AI models?

The AAISM standard explicitly states that traditional penetration tests alone are insufficient for AI systems. Effective AI security testing requires:

• AI-specific threat modeling (e.g., data poisoning, prompt injection, model theft)

• Adversarial attack simulations (white-box, black-box, gradient-based attacks)

• Evaluation of robustness and manipulation resistance

Option B captures these requirements precisely.

Options A, C, and D do not address AI-specific attack vectors.