AI Risk Leadership: A Graph-Based Decision Framework for Prioritizing AI Security Mitigations in Educational Organizations

Resumen de los autores

Educational leaders are increasingly expected to make decisions about artificial intelligence (AI) adoption, governance, and risk mitigation, often without clear methods for prioritizing competing technical, policy, and machine learning (ML) controls. Existing AI security frameworks such as MITRE ATLAS provide valuable taxonomies of adversarial techniques and mitigations, but they can be difficult for school leaders, technology directors, and instructional decision-makers to translate into actionable institutional priorities. This study presents a graph-based decision-support framework for helping educational leaders analyze and prioritize AI security mitigations across ML operations lifecycle phases. Using the MITRE ATLAS framework, we examine mitigation rankings produced by multiple graph algorithms spanning three categories: importance, structural weakness, and decision-making under attack. For each lifecycle phase, mitigation types, Cyber, Policy, and ML, were ranked and analyzed using nonparametric statistical tests and frequency-based methods. Across six lifecycle phases, we find that mitigation prioritization is not uniform. Rank-based analysis using Kruskal-Wallis tests reveals statistically significant differences in five phases (p < .05), while pairwise Mann-Whitney U comparisons identify phase-specific dominance relationships, including ML outperforming Cyber in Data Preparation phase and Cyber outperforming both Policy and ML in Monitoring and Maintenance phases. Frequency-based analysis using chi-square tests further demonstrates that dominant mitigation types are disproportionately represented in top-ranked positions in most phases. In contrast, no statistically significant differences are observed in the ML Model Evaluation phase, where mitigation types are more evenly distributed. Stratified analysis by graph algorithm category shows that mitigation dominance varies not only by lifecycle phase but also by the structural objective of the evaluation method. These findings suggest that AI risk leadership in educational organizations should not rely on generic mitigation checklists. Instead, leaders should use lifecycle-aware and method-aware approaches to determine when Cyber, Policy, and ML controls are most relevant. The study contributes a practical decision-support approach for educational technology leaders seeking to move from broad AI risk awareness toward structured, evidence-informed mitigation planning.

Áreas y palabras clave

Cómo citar (APA 7)

Heverin, T. (2026). AI Risk Leadership: A Graph-Based Decision Framework for Prioritizing AI Security Mitigations in Educational Organizations. https://doi.org/10.35542/osf.io/ar9eu_v1