AI security posture management (AI-SPM): what it checks and what it cannot test
AI security posture management (AI-SPM) is a category of tools that discover AI assets, build an AI bill of materials, and check configuration, identity, data exposure and attack paths around them. It reads your environment. It does not attack your application, so it cannot show whether a prompt injection chain or tool abuse path works. Use posture tools for inventory and hygiene, and an AI red team for exploitability.
AI security posture management (AI-SPM) is a category of security tools that find the AI assets in your environment and check how they are configured. It covers inventory, identity, data exposure and cloud attack paths. It reads your configuration and does not attack your application. That difference decides what AI-SPM can tell you and what it cannot. This page describes the category without ranking vendors, and shows how to pair it with AI red teaming.
What is AI security posture management?#
AI-SPM is posture management applied to AI assets: models, endpoints, AI services, datasets, pipelines and agents. It follows the pattern of cloud security posture management (CSPM), which compares cloud configuration against rules and reports gaps. Several vendors sell AI-SPM, and the scope differs by product, so compare features and not the label.
Microsoft's documentation is a sourced example of the scope. Its Defender for Cloud overview, last updated on 17 June 2026, says the Defender CSPM plan covers generative AI applications and AI agents (Preview) and lists these functions:
- Discovering the generative AI bill of materials (AI BOM), which includes application components, data and AI artifacts "from code to cloud".
- Built-in recommendations on identity, data security and internet exposure.
- Attack path analysis for AI workloads.
- Flagging externally reachable AI endpoints so teams can require strong authentication and least privilege identities.
The same page says that from 1 July 2026 agent-level discovery for some agents needs a separate Microsoft Agent 365 license. Packaging changes, so ask vendors what each license includes. We cite Microsoft because its documentation is public and dated. Other vendors may cover more or less, and we have not tested any product.
What does AI-SPM inventory and check?#
AI-SPM tools build an inventory and check it against configuration rules. The inventory is the most useful output for a security team that does not know where AI runs, because shadow AI use and forgotten test endpoints are common.
| Area | What a posture tool typically reports | Why it matters |
|---|---|---|
| Inventory | AI services, model deployments, vector stores, pipelines, agents, libraries | You cannot scope tests or risk work for assets you do not know about |
| AI BOM | Models, datasets, frameworks and their versions | Supports supply chain review (OWASP LLM04) |
| Identity | Over-privileged identities and keys on AI services | Limits the blast radius of a compromised model or agent |
| Network exposure | AI endpoints reachable from the internet, missing private endpoints | Reduces unauthorized use and cost abuse |
| Data exposure | Sensitive data sources connected to AI workloads | Shows where grounding or fine-tuning could leak data |
| Code and IaC | Misconfigured infrastructure code and vulnerable AI libraries in builds | Catches problems before deployment |
| Attack paths | Chains of misconfigurations that reach AI workloads | Prioritizes fixes by reachability |
These checks are useful hygiene and find real problems: a public endpoint with no authentication is a finding in any program. For a manual inventory method, see our AI security risk assessment.
What can AI-SPM not find?#
AI-SPM cannot show whether an attacker can make your application misbehave through its inputs. That behavior depends on prompts, retrieved content, tool design and business logic, which configuration scanning does not exercise. The category's own descriptions focus on discovery, configuration and attack paths in cloud infrastructure.
An example from a fictional app shows the gap.
Demonstration
This is a demonstration. No real customer system was tested.
Harbor Notes, a fictional note-taking app, runs an assistant on a managed model service. A posture tool reports a clean result: the endpoint is private, the identity has least privilege, no secrets sit in the repository, and the AI BOM lists approved models and libraries. The assistant can read a customer's notes and call an "email me a summary" tool. A shared note that contains hidden instructions makes the assistant email another customer's notes to an outside address. Every configuration check passed, and the application still leaks data.
Findings like this come from testing the running system with attack inputs. They include indirect prompt injection chains, tool abuse, cross-user retrieval leaks, output handling flaws and approval bypass. The OWASP LLM Top 10 2026 covers many of them. LLM01 is prompt injection, LLM03 is excessive agency, LLM09 is vector and embedding weaknesses including cross-tenant leakage, and LLM10 is improper output handling.
The UK NCSC wrote in December 2025 that prompt injection risk "cannot be fully mitigated with a product or appliance". The same applies to posture tools. They lower exposure and do not remove this class of risk.
AI-SPM vs AI red teaming: what each one tells you#
Use AI-SPM to learn what you have and how it is configured. Use AI red teaming to learn what an attacker can do with it. NIST AI 600-1 defines AI red-teaming as "a structured testing exercise used to probe an AI system to find flaws and vulnerabilities". Microsoft's AI Red Team paper says it aims to push beyond model-level benchmarks by emulating real-world attacks against end-to-end systems.
| Question | AI-SPM | AI red teaming |
|---|---|---|
| Main method | Discovery and configuration checks against rules | Attack attempts against the running system within a written scope |
| Typical output | Asset inventory, misconfiguration list, attack paths | Findings with evidence, impact and fix guidance |
| Finds | Public endpoints, over-privileged identities, vulnerable libraries, exposed data stores | Prompt injection chains, tool abuse, data leakage through the app, approval bypass |
| Runs | Often continuous or scheduled, depending on the product | Per engagement or per release |
| Needs | Cloud and code connectors, read permissions | Written scope and authorization, test accounts, a staging copy where possible |
| Weakness | Does not test application behavior | Covers only the assets and time in scope |
| Compare with | CSPM, vulnerability scanners | Penetration testing, see AI red teaming vs penetration testing |
For the method, see what AI red teaming is. For tools that help run tests, see AI red teaming tools.
How do you use both in one program?#
Run posture tooling first to get a reliable inventory, then use the inventory to scope tests, and feed test findings back into posture rules. This loop makes each tool more useful.
- Build the inventory. Use an AI-SPM tool if you have one, or a spreadsheet if you do not. Include owner, data, tools and users for each AI feature.
- Rank by exposure. Put systems that read untrusted content or take actions at the top. NIST AI 100-2 section 3.5 notes that agents can be vulnerable to direct and indirect prompt injection, and attacks can hijack them to execute arbitrary code or exfiltrate data.
- Test the top systems. Agree scope and authorization in writing before any test, and use test accounts.
- Turn findings into rules. If a test shows an agent holds a token with broad scope, add a posture rule that flags such tokens in other agents.
- Retest after fixes and after changes to models, prompts, tools or permissions.
See AI security best practices for the controls that sit between the two.
What questions should you ask an AI-SPM vendor?#
Ask questions that separate what the product observes from what it tests. Write the answers down, because marketing pages and product behavior often differ.
- Which AI services, clouds, SaaS tools and agent frameworks does it discover today? Which are in preview?
- Does it read configuration only, or does it send test inputs to your application? If it sends inputs, what attack categories and how many attempts?
- What does the AI BOM contain, and can you export it?
- How does it find shadow AI that no one registered?
- What does the license include, and which features need extra licenses?
- What evidence does it give for a finding, and can an engineer reproduce it?
- Can it prove that a fix worked, or does it only stop reporting the issue?
- Which data does the tool itself read from your environment, and where does it store it?
Questions
What is the difference between AI-SPM and CSPM?
CSPM checks cloud configuration against rules, such as public storage or missing encryption. AI-SPM applies the same approach to AI assets: model endpoints, AI services, pipelines, datasets and agents. Some vendors sell AI-SPM as part of a CSPM plan. Microsoft documents it this way in Defender for Cloud.
Does AI-SPM find prompt injection?
Posture tools can flag conditions that raise the impact of prompt injection, such as an internet-exposed endpoint or an over-privileged identity. They do not send attack prompts to your app in the way a red team does. Ask each vendor whether it tests runtime behavior, and what it reports.
Do we need AI-SPM if we do AI red teaming?
They answer different questions. Posture tools tell you what AI assets exist and how they are configured, which you need to scope a test. A red team tells you what an attacker can do with the assets. A small team with one AI feature may start with a test and a hand-built inventory.
What is an AI bill of materials?
An AI BOM lists the components of an AI application: models, datasets, libraries, services and the data they connect to. Microsoft documents discovery of a generative AI BOM from code to cloud. Format and depth vary by tool, so ask what the output contains and whether you can export it.
Should we buy AI-SPM before testing?
There is no required order. Buy posture tooling if you cannot list your AI assets today, or if teams deploy AI services faster than security reviews them. Test any AI feature that reads untrusted content or takes actions, whatever the tooling state.
Sources
- Microsoft Learn: Overview of AI security posture management (Microsoft Defender for Cloud), last updated 2026-06-17 (checked 9 November 2026)
- OWASP GenAI-LLM-Top10 2026 README (checked 9 November 2026)
- NIST AI 600-1: Generative AI Profile (definition of AI red-teaming) (checked 9 November 2026)
- NIST AI 100-2 E2025: Adversarial Machine Learning taxonomy, section 3.5 Security of Agents (checked 9 November 2026)
- UK NCSC: Prompt injection is not SQL injection (8 December 2025) (checked 9 November 2026)
- Microsoft AI Red Team: Lessons From Red Teaming 100 Generative AI Products (arXiv:2501.07238) (checked 9 November 2026)