頂石專案:紅隊計畫設計

## Mission
 
The Helios AI Red Team exists to proactively identify and help remediate
security vulnerabilities in AI systems before they can be exploited by
adversaries or cause harm to customers, employees, or the organization.
 
The team accomplishes this through:
- Structured security assessments of AI systems across their lifecycle
- Pre-deployment security reviews that serve as quality gates for new AI launches
- Continuous automated testing of critical AI systems in production
- Incident response support for AI-specific security events
- Security guidance and threat intelligence for AI development teams
 
The AI Red Team is NOT responsible for:
- General application security testing (handled by the AppSec team)
- Infrastructure and network penetration testing (handled by the Pen Test team)
- AI model performance, fairness, or bias testing (handled by the AI Ethics team)
- Day-to-day security monitoring (handled by the SOC)
 
The team collaborates closely with all of the above groups and serves as
the AI security subject matter expert for the broader security organization.

| System | Risk Level | Regulatory | Data Sensitivity | Autonomy | Exposure | Priority |
|--------|-----------|------------|-----------------|----------|----------|----------|
| Loan Approval AI | Critical | OCC, ECOA | PII, financial | Decision-making | Customer-facing | P1 |
| Trading Advisor | Critical | SEC, FINRA | Financial | Autonomous | Internal | P1 |
| Customer Chatbot | High | PCI-DSS | PII, payment | Advisory | Customer-facing | P2 |
| Fraud Detection | High | SOX | Transaction data | Flagging | Internal | P2 |
| Code Gen Tool | Medium | None | Source code | Advisory | Internal | P3 |
| Doc Processing | Medium | SOX | Financial docs | Processing | Vendor | P3 |

## Year 1 Budget: $1,200,000
 
### Headcount (68% — $816,000)
- AI Red Team Lead: $210,000 (fully loaded)
- Senior AI Security Tester (x2): $380,000 ($190k each)
- Automation/Tooling Engineer: $180,000
- Recruiting costs: $46,000
 
### Tooling (15% — $180,000)
- Commercial AI security tools: $80,000
- Cloud infrastructure for testing: $50,000
- Open-source tool hosting and maintenance: $20,000
- Reporting and collaboration platforms: $30,000
 
### External Engagements (10% — $120,000)
- Specialist consultant engagements (2x): $100,000
- Third-party AI vendor assessments: $20,000
 
### Training and Development (5% — $60,000)
- Conference attendance (team): $25,000
- Training courses and certifications: $20,000
- Research time and lab materials: $15,000
 
### Operational Reserve (2% — $24,000)
- Unplanned expenses and contingency