Layer 2 of 8, Know what you run
Discovery and posture: find the AI in use and check how it is exposed
This layer finds the AI models, services, agents, MCP servers and AI apps in use, including ones missing from any hand-made register, and checks how each is configured and exposed.
Executive summary
- What it is
- This layer finds the AI models, services, agents, MCP servers and AI apps in use, including ones missing from any hand-made register, and checks how each is configured and exposed.
- The risk
- Shadow AI and forgotten AI services: endpoints with weak authentication, agents and identities with more access than they need, unvetted models, and sensitive data that AI systems can reach without anyone deciding they should.
- What to buy or do
- Ask your cloud or data security platform vendor about an AI posture add-on first, then cover workforce shadow AI with browser or DLP products. Send every finding to an owner in the layer 1 register.
Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.
The question this layer answers
What AI is running in our clouds, SaaS apps and endpoints, and which of it is exposed or misconfigured?
Budget line
AI security posture management, usually an add-on to a cloud security (CNAPP or CSPM) or data security (DSPM) platform; workforce shadow AI discovery often comes with browser or DLP products.
What it protects against
Our analysis
- Shadow AI and unknown AI assets
- AI services with exposed endpoints, weak authentication or risky settings
- Agents and identities with more access than they need
- Sensitive data AI systems can reach
- Unvetted models and components in use
Typical controls
Our analysis
- Automated AI asset inventory and AI bill of materials from connected accounts
- Shadow AI discovery across cloud, SaaS, endpoint and browser
- Misconfiguration checks, including infrastructure as code
- Attack path analysis to AI assets
- Data exposure checks for AI
- Agent and MCP server discovery
How it maps to standards
Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.
| Framework | Entry | Basis | Where the source says it | How it applies |
|---|---|---|---|---|
| OWASP LLM Top 10 (2025) | LLM10 Unbounded Consumption | Source states | Prevention list | Keep a central model inventory and control access to model repositories. |
| OWASP LLM Top 10 (2025) | LLM06 Excessive Agency | Our analysis | Not named by the source | Posture checks can flag agents that hold more access than they need. |
| OWASP LLM Top 10 (2025) | LLM02 Sensitive Information Disclosure | Our analysis | Related: prevention list | Data exposure checks show which sensitive data AI can reach. OWASP names least privilege, not posture scanning. |
| OWASP LLM Top 10 (2025) | LLM03 Supply Chain | Our analysis | Not named by the source | An inventory of models and AI components is the input to supply chain checks. |
| OWASP LLM Top 10 (2025) | LLM08 Vector and Embedding Weaknesses | Our analysis | Related: prevention list | OWASP names permission-aware vector stores. Posture checks of vector store access would fit this layer. |
| OWASP Agentic Top 10 (2026) | ASI04 Agentic Supply Chain Vulnerabilities (opens in a new tab) OWASP relates it to LLM03. | Source states | Mitigation 1 | Maintain an inventory of AI components, use curated registries and block untrusted sources. |
| OWASP Agentic Top 10 (2026) | ASI03 Identity and Privilege Abuse (opens in a new tab) OWASP relates it to LLM01, LLM06, LLM02. | Our analysis | Related: mitigation 8 | Posture checks of agent permissions and identities relate to detecting delegated and transitive permissions. |
| MITRE ATLAS | AML.M0016 Vulnerability Scanning | Our analysis | Not named by the source | Posture scans of AI workloads and models. |
| MITRE ATLAS | AML.M0019 Control Access to AI Models and Data in Production | Our analysis | Not named by the source | Checks of access settings on AI services and data. |
| MITRE ATLAS | AML.T0010 AI Supply Chain Compromise | Our analysis | Not named by the source | Finding unvetted models and AI services in use. |
| NIST AI RMF | GOVERN Govern (opens in a new tab) | Source states | GOVERN 1.6 | Mechanisms are in place to inventory AI systems. |
| NIST AI RMF | MAP Map (opens in a new tab) | Our analysis | Related: MAP 4.2 | Internal risk controls for AI system components, including third-party AI technologies, are identified and documented. |
| NIST AI RMF | MEASURE Measure (opens in a new tab) | Our analysis | Related: MEASURE 2.7 | Security and resilience are evaluated and documented, which configuration checks feed. |
Tools in this layer (8)
Tools whose category is AI security posture management & discovery, listed by name. Compare them with Coverage Scores on the AI-SPM hub.
Microsoft Defender for Cloud AI security posture management
Microsoft · multicloud AI posture feature in Defender CSPM
CommercialNoma Security · agent and AI security platform with AI-SPM
CommercialOrca Security · agentless AI posture management capability
CommercialPalo Alto Networks Prisma AIRS
Palo Alto Networks · commercial AI security platform
CommercialSandboxAQ · AI security posture management product
CommercialSnyk · AI security posture management module
CommercialWiz AI Security Posture Management (AI-SPM)
Google (Wiz) · agentless posture management tool for cloud AI
CommercialZscaler · AI security posture management product
Commercial
Also cover this layer (20)
Our analysis Tools from other categories that document a capability in this layer. Each row names the layer the tool belongs to first and the documented capability our placement rests on.
| Tool | Its primary layer | How it applies | Based on |
|---|---|---|---|
| Akto1,532 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026 | L7 Agent access | Documents discovery of MCP servers, AI agents, tools and resources across infrastructure, cloud and employee laptops. | Agentic AI Discovery catalogs MCP servers, AI agents, tools and resources across infrastructure, cloud and employee laptops |
| Astrix AI Agent Security | L7 Agent access | Documents a real-time inventory of AI agents, MCP servers and non-human identities, including shadow agents. | Keeps a real-time inventory of AI agents, MCP servers and non-human identities, including shadow and unregistered agents |
| Cisco DefenseClaw888 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026 | L7 Agent access | Inventories agents, MCP servers, skills, AI packages and local models on a machine. | AI discovery inventories agents, MCP servers, skills, AI SDK dependencies, local models and IDE extensions on a machine |
| Credo AI | L1 Governance | Keeps a registry of AI systems that includes shadow AI detection. | Registry that catalogs AI systems, agents, vendors and models, with shadow AI detection |
| CrowdStrike Falcon Guardian | L8 Monitoring | Documents discovery of known and shadow AI agents on Windows and macOS endpoints. | Falcon sensor discovers known and shadow AI agents on Windows and macOS endpoints |
| Harmonic Security | L5 Data | Documents a map of the AI tools that staff use, through shadow AI discovery. | Maps the AI tools a workforce actually uses, including AI features embedded in SaaS tools |
| Holistic AI | L1 Governance | Documents shadow AI discovery and an inventory of AI systems. | Shadow AI discovery and a centralized AI inventory with classification and mapping |
| IBM watsonx.governance | L1 Governance | Documents shadow AI detection and an inventory of AI systems. | Governance graph of AI systems, risks, controls and policies, plus shadow AI detection |
| MCP-Scan (Snyk Agent Scan)3,161 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026 | L7 Agent access | Documents automatic discovery of agent configurations. | Auto-discovers agent configurations for Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf and Gemini CLI |
| Microsoft Agent Governance Toolkit6,454 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026 | L7 Agent access | Documents Shadow AI Discovery, which finds unregistered agents across processes, configs and repos. | Shadow AI Discovery finds unregistered agents across processes, configs and repos |
| Microsoft Purview Data Security Posture Management (DSPM) for AI | L5 Data | Documents a list of the AI apps and agents in use across the organization. | Detects visits to third-party generative AI sites from browser activity and lists the AI apps and agents in use |
| ModelOp Center | L1 Governance | Documents discovery of AI tools and models that nobody registered. | Searchable registry of ML, GenAI, agent, vendor and SaaS-embedded AI, with discovery of unregistered tools |
| Oasis Security | L7 Agent access | Documents a real-time inventory of non-human identities that maps each agent, identity and permission. | Keeps a real-time inventory of non-human identities and maps each agent, identity and permission |
| OneTrust AI Governance | L1 Governance | Documents discovery of AI systems and their addition to the inventory. | Discovers and inventories AI systems, models, agents, datasets, vendors and use cases, with owners and dependencies |
| Pillar Security | L7 Agent access | Documents a catalog of agents, including shadow AI. | Catalogs agents, models, tools, MCP servers and skills, including shadow AI |
| Straiker | L7 Agent access | Documents discovery of AI agents and monitoring of their tools and MCP connections. | Discovers AI agents and monitors their tools and MCP connections |
| Uber ADR2,072 GitHub stars as of Oct 21, 2026; last push Oct 19, 2026 | L8 Monitoring | Documents discovery of AI apps, agents and MCP servers on endpoints, flagging unknown surfaces for review. | Discovery inventories AI apps, CLI agents, IDE extensions, local model runtimes and MCP servers on endpoints and flags unknown surfaces for review |
| Veza AI Agent Security | L7 Agent access | Documents unified discovery of AI agents and MCP servers across major AI platforms. | Discovers AI agents across major AI platforms and connections to public MCP servers in one inventory; Shows access paths from agents and their models to tools, data and systems, and sizes each agent's blast radius; Discovers Copilot Studio agents and third-party agents registered with Microsoft Entra Agent ID |
| WitnessAI | L5 Data | Documents a catalog of the AI apps and MCP servers in use. | Discovers AI use across employees and agents and catalogs AI applications and MCP servers; Sees AI activity across the network without browser extensions or endpoint clients |
| Zenity | L7 Agent access | Documents a live inventory of agents. | Builds a live inventory of agents across SaaS, custom and endpoint deployments |
Gaps we can see
- Only 3 tools (Protecto, Pangea AI Guard, Lakera Red) are mapped to OWASP LLM08 Vector and Embedding Weaknesses. No listed tool documents posture checks of vector store access.
What this layer will not do
Discovery shows what exists and how it is set up; it does not stop an attack in progress or inspect prompts. Coverage ends where the connectors end: an agentless cloud scan does not see staff using AI from personal accounts or unmanaged devices, and a browser extension does not see cloud workloads. A finding changes nothing until someone owns and fixes it, which is why results belong in the layer 1 register. Posture checks also report settings, not behavior, so a correctly configured agent can still be misused at runtime.
Related guides
Discovery and posture FAQ
How is AI security posture management different from CSPM and DSPM?
Our analysis: CSPM checks the configuration of cloud resources, DSPM finds and classifies sensitive data, and AI security posture management applies both ideas to AI assets: models, endpoints, agents, AI bills of materials and the data they can reach. AI-SPM products are often sold as an add-on to a cloud or data security platform, which is where many teams look first.
Does discovery find the AI apps employees use?
Only if the product watches where employees work. Cloud posture tools find AI services in connected cloud accounts. Workforce shadow AI, such as staff using public chat apps, is found by browser, endpoint or network products, several of which sit in the data protection layer and also cover this one. Each tool page says what its sources say it discovers.
Which standards ask for an AI inventory?
Source states: NIST AI RMF GOVERN 1.6 says mechanisms are in place to inventory AI systems, the OWASP LLM10 page lists a centralized ML model inventory among its prevention steps, and the OWASP Agentic Top 10 asks for an inventory of AI components under ASI04. This layer automates that inventory; layer 1 adds owners and approvals to it.
Framework sources & last reviewed
OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)
- genai.owasp.org/llm-top-10 checked
OWASP LLM01:2025 Prompt Injection (1 sources)
OWASP LLM02:2025 Sensitive Information Disclosure (1 sources)
OWASP LLM03:2025 Supply Chain (1 sources)
OWASP LLM04:2025 Data and Model Poisoning (1 sources)
OWASP LLM06:2025 Excessive Agency (1 sources)
OWASP LLM07:2025 System Prompt Leakage (1 sources)
OWASP LLM08:2025 Vector and Embedding Weaknesses (1 sources)
OWASP LLM10:2025 Unbounded Consumption (1 sources)
OWASP Top 10 for Agentic Applications for 2026 (resource page) (1 sources)
OWASP Top 10 for Agentic Applications 2026 (PDF, December 2025) (1 sources)
- genai.owasp.org/download/52117 checked
MITRE ATLAS (ids and names from the published ATLAS data file, version 2026.09) (1 sources)
- atlas.mitre.org checked