# IDR-003: Identify use cases leading to elevated risk behavior.


- Area: AI Detection & Response

- Verification: Proof of value
- OWASP adoption tier: AT0–AT4
- Formerly: VAL-005
- URL: /r/IDR-003

**Acceptance criteria:** Surface the use cases and teams that require additional training on safe usage principles.

**Why it matters:** Repeat exposure and under-use point to where risk reduction or enablement will pay off.

**How to verify:** High-risk use cases and the associated users are identified in a pilot.

**OWASP adoption context:** Risky use and repeat exposure patterns can appear across the listed employee AI settings; low use is not itself proof of risk or failure.

**Mappings:**
- NIST CSF 2.0: DE.CM-03; NIST AI RMF: MEASURE 3.1; SOC 2: CC7.2; ISO 27001: Cl. 9.1, A.8.16 — Team-level risky-use and recurring-exposure patterns provide findings for usage monitoring, AI-risk tracking and evaluation against responsible-use/security objectives. Under-use alone is an enablement signal rather than a security anomaly; assessment and intervention remain necessary beyond surfacing patterns.
ISO/IEC 27001: Confirm the need for monitoring and choose the interventions to apply.
- ISO 42001: A.6.2.6 — Observed risky-use and recurring-exposure patterns provide ongoing operational-monitoring findings for in-scope AI systems or controls. Under-use alone is an enablement signal; surfacing patterns does not establish responsible-use objectives or complete assessment and intervention.