What is AI-SPM? AI security posture management explained

What posture management covers

Posture management assesses a system continuously against a desired secure state and tells you what to fix. For AI, the questions are concrete: which models, AI services, agents and data sources do we run, which are reachable from the internet, which identities can use them, what sensitive data can they touch, and which findings come first.

Posture tools work from the configuration and metadata of the accounts and code you connect, which is our reading of the vendor documents cited below. They do not sit in the request path, so screening prompts and answers stays with guardrails (see our guide to the best LLM guardrails). In our AI Security Layers model, AI-SPM is the discovery and posture layer for AI assets, and the in-line screening is the runtime guardrails layer.

AI-SPM vs CSPM vs DSPM

The three terms overlap, and vendors package them differently. The table is our analysis, with the right-hand column taken from Microsoft’s Defender for Cloud documentation, which describes all three.

Term	What it watches	Question it answers	How Microsoft describes it
CSPM (cloud security posture management)	Configuration of cloud accounts, workloads and services	Is our cloud set up securely?	Continuous visibility into the security state of cloud assets and workloads, with guidance to improve it.
DSPM (data security posture management)	Data stores and the sensitive data in them	Where is our sensitive data, and who can reach it?	Discovering sensitive data resources across clouds and evaluating their sensitivity, exposure and data flows.
AI-SPM (AI security posture management)	AI workloads: models, AI services, agents, libraries and the data they use	What AI do we run, and is it exposed or over-privileged?	Discovering the generative AI bill of materials, issuing recommendations, running attack path analysis and highlighting externally reachable AI endpoints.

Packaging is part of the answer. In Microsoft’s documentation, AI security posture management, attack path analysis and data security posture management are features of the paid Defender CSPM plan, and the foundational CSPM plan is free. Ask each vendor whether you are buying a standalone tool or a tier of a larger platform.

What gets inventoried and checked

Two cloud providers publish documentation that shows the shape of the category. Neither is a recommendation; both are useful for building your own checklist.

Microsoft Defender for Cloud. The Defender CSPM plan discovers deployed AI workloads across Azure OpenAI Service, Azure AI Foundry, Azure Machine Learning, Amazon Bedrock and Google Vertex AI. It finds vulnerabilities in generative AI library dependencies such as TensorFlow, PyTorch and Langchain by scanning source code for infrastructure-as-code misconfigurations and container images for vulnerabilities. It issues recommendations on identity, data security and internet exposure; its infrastructure-as-code checks include private endpoints, restricted endpoints, and managed or identity-based authentication for Azure AI service accounts. Attack path analysis covers externally reachable AI endpoints and data exposed while grounding or fine-tuning a model. See Microsoft’s page on AI security posture management.

The same page records a licensing change: effective July 1, 2026, AI agent discovery and security posture for Microsoft Foundry agents and third-party cloud agents require a Microsoft Agent 365 license, where the Defender CSPM plan used to include them. Ask which features sit behind which plan.

Google Cloud AI Protection. In Security Command Center, AI Protection provides AI asset inventory and discovery of agents, MCP servers, data sources and models on all service tiers. Higher tiers add vulnerability identification for agentic workloads, risk assessment with attack path simulation, threat detection and sensitive data discovery with Sensitive Data Protection. Model Armor findings appear in Security Command Center once you enable and connect it. Google’s AI Protection overview has the current tier details.

From these two sources and our reading of the category, expect a posture product to inventory and check the following. The list is our analysis.

1. An inventory of AI assets. Models, AI services, agents, MCP servers, data sources and their library dependencies, often called an AI bill of materials.
2. Exposure. Public endpoints, weak or missing authentication and missing network restrictions.
3. Identity and permissions. Over-broad roles, unmanaged credentials and agents with more access than they need.
4. Data. Which sensitive data stores AI workloads can reach, and how data flows into grounding and fine-tuning.
5. Code and dependencies. Infrastructure-as-code misconfigurations, vulnerable AI libraries and secrets in code.
6. Attack paths. How a weakness in one place chains to a sensitive asset in another, so you fix the paths that lead somewhere first.
7. Reporting. Findings you can assign, track and report on, with any framework mapping stated as the vendor’s own claim.

AI-SPM tools in this directory

These are the products in our AI-SPM category whose own pages present AI posture management as a headline capability. We compile them from vendor documentation and product pages and do not run them. The Coverage Score, explained in our methodology, measures how much a vendor documents publicly, not how well a product detects anything.

All are commercial, and the pricing column shows what each vendor publishes. Several, including Wiz, Orca, Noma, Prisma AIRS and AQtive Guard, also document runtime features next to posture. Runtime protection is a separate layer, so judge the posture features on their own.

Microsoft Defender for Cloud AI-SPM

Defender AI-SPM discovers generative AI workloads and their AI bill of materials, including application components, data and AI artifacts Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . It covers Azure OpenAI Service, Azure AI Foundry, Azure Machine Learning, Amazon Bedrock and Google Vertex AI Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) , and it uses attack path analysis to find and prioritize risks to AI workloads across Azure, AWS and Google Cloud Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . Pricing: included with platform Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . Best for teams already on Defender for Cloud that want AI workloads in Azure, AWS and Google Cloud added to their posture view.

Wiz AI-SPM

Wiz AI-SPM discovers AI services, technologies and SDKs and builds an AI bill of materials Source, checked October 21, 2026: wiz.io · 2026-10-21 (opens in a new tab) . It surfaces shadow AI in cloud environments Source, checked October 21, 2026: wiz.io · 2026-10-21 (opens in a new tab) , and it works with managed AI services such as Amazon SageMaker and OpenAI without agents Source, checked October 21, 2026: wiz.io · 2026-10-21 (opens in a new tab) . On ownership, Google announced on March 11, 2026 that it completed its acquisition of Wiz, which joins Google Cloud and keeps its brand. Source, checked October 21, 2026: googlecloudpresscorner.com · 2026-10-21 (opens in a new tab) Pricing: not published in the sources we checked Source, checked October 21, 2026: wiz.io · 2026-10-21 (opens in a new tab) . Best for cloud security teams that want agentless discovery of AI services and their risks inside a cloud security platform.

Orca AI-SPM

Orca AI-SPM discovers AI models, datasets, training pipelines and inference endpoints and produces an AI bill of materials Source, checked October 21, 2026: orca.security · 2026-10-21 (opens in a new tab) . It scans workloads across AWS, Azure and GCP without agents using SideScanning Source, checked October 21, 2026: orca.security · 2026-10-21 (opens in a new tab) , and it shows which sensitive datasets AI systems can access by combining data security posture management with AI discovery Source, checked October 21, 2026: orca.security · 2026-10-21 (opens in a new tab) . Pricing: not published in the sources we checked Source, checked October 21, 2026: orca.security · 2026-10-21 (opens in a new tab) . Best for cloud security teams already on Orca that want AI assets, their configuration and data exposure in the same inventory.

Noma Security

Noma Security discovers agents, MCP servers, toolsets, skills and models across endpoint, SaaS and cloud and keeps a registry of allowed AI components Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) . It finds shadow AI by connecting to cloud and SaaS platforms, code repositories and endpoints through an existing EDR or MDM Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) . It is also listed in our agent security category. Pricing: not published in the sources we checked Source, checked October 21, 2026: noma.security · 2026-10-21 (opens in a new tab) . Best for security teams that need to find and govern agents, MCP servers and models spread across endpoints, SaaS and cloud.

Palo Alto Networks Prisma AIRS

Prisma AIRS maps AI workloads, resources and traffic to find blind spots across the enterprise Source, checked October 21, 2026: docs.paloaltonetworks.com · 2026-10-21 (opens in a new tab) . It scans GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors, malicious code and deserialization flaws Source, checked October 21, 2026: docs.paloaltonetworks.com · 2026-10-21 (opens in a new tab) , and it is also listed in our model supply chain category. Pricing: not published in the sources we checked Source, checked October 21, 2026: docs.paloaltonetworks.com · 2026-10-21 (opens in a new tab) . Best for organizations that already run Palo Alto Networks security products and want AI inventory, model scanning and runtime controls from one vendor.

Snyk Evo AI-SPM

Snyk Evo AI-SPM continuously maps AI models, agents, frameworks, datasets, MCP servers and Skills across code and running applications Source, checked October 21, 2026: snyk.io · 2026-10-21 (opens in a new tab) . It also turns plain-English intent into enforceable policies, raises issues on violations and lets teams pre-approve models, agents and tools Source, checked October 21, 2026: snyk.io · 2026-10-21 (opens in a new tab) . Pricing: usage-based: enterprise rate card: evo ai-spm at 0.66 credits per active contributor per day, with 1 credit = $1. evo capabilities are not available on the free or team plan; enterprise pricing is by contact sales. (as listed on october 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: snyk.io · 2026-10-21 (opens in a new tab) . Best for application security teams that want an inventory of the AI models and components in their code projects.

SandboxAQ AQtive Guard AI-SPM

AQtive Guard AI-SPM automatically identifies AI assets across the organization, including models, agents and MCP servers Source, checked October 21, 2026: sandboxaq.com · 2026-10-21 (opens in a new tab) . It scans AWS environments and integrates with GitHub and GitLab for static analysis and CI/CD checks Source, checked October 21, 2026: aqtiveguard.com · 2026-10-21 (opens in a new tab) . Pricing: not published in the sources we checked Source, checked October 21, 2026: aqtiveguard.com · 2026-10-21 (opens in a new tab) . Best for teams on AWS that want AI asset discovery tied to code and pipeline checks.

Zscaler AI Asset Management

Zscaler AI Asset Management discovers, classifies and inventories AI services, with lineage context such as publisher, country of origin and licensing terms Source, checked October 21, 2026: zscaler.com · 2026-10-21 (opens in a new tab) . It covers Amazon Bedrock, Microsoft Azure Foundry AI and Google Vertex AI, plus unmanaged services such as Hugging Face and Ollama Source, checked October 21, 2026: zscaler.com · 2026-10-21 (opens in a new tab) , and it identifies misconfigurations, access risk and vulnerabilities in AI agents Source, checked October 21, 2026: zscaler.com · 2026-10-21 (opens in a new tab) . Pricing: not published in the sources we checked Source, checked October 21, 2026: zscaler.com · 2026-10-21 (opens in a new tab) . Best for organizations already on Zscaler that want managed and unmanaged AI services in one inventory.

Data protection tools that also find AI use

Two products in our GenAI data protection category are also listed under AI-SPM, because they document discovery of the AI tools people use. Microsoft Purview DSPM for AI detects visits to third-party generative AI sites from browser activity and lists the AI apps and agents in use Source, checked October 21, 2026: learn.microsoft.com · 2026-10-21 (opens in a new tab) . Harmonic Security maps the AI tools a workforce actually uses, including AI features embedded in SaaS tools Source, checked October 21, 2026: harmonic.security · 2026-10-21 (opens in a new tab) . Both work from browser or workforce activity, so in our analysis they complement cloud-account scanning and do not replace it.

Adjacent tools that document AI asset discovery

Five products in our agent security and guardrails categories also document discovery of AI assets, agents or shadow AI, next to runtime controls. Compare them with AI-SPM tools on the discovery feature only. We do not run these products.

Pillar Security

Pillar Security catalogs agents, models, tools, MCP servers and skills, including shadow AI Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) . Best for security teams that want agent discovery, adversarial testing and runtime guardrails, with the option to keep data in their own VPC.

Operant AI

Operant AI discovers shadow AI and coding agents Source, checked October 21, 2026: operant.ai · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: operant.ai · 2026-10-21 (opens in a new tab) . Best for platform teams running agents and MCP servers on Kubernetes that want runtime controls and an MCP gateway.

Zenity

Zenity builds a live inventory of agents across SaaS, custom and endpoint deployments Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: zenity.io · 2026-10-21 (opens in a new tab) . Best for security teams that need to govern agents built inside SaaS copilot platforms such as Copilot Studio and Agentforce.

Straiker

Straiker discovers AI agents and monitors their tools and MCP connections Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . It is closed source Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . Best for teams running custom or MCP-connected agents that want discovery, adversarial testing and runtime blocking from one vendor.

Cisco AI Defense

Cisco AI Defense is a commercial suite for discovering AI assets, validating models and enforcing runtime guardrails; its tool page lists the cloud services it covers for asset discovery. It is closed source Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for organizations that already use Cisco security products and want AI discovery, validation and runtime enforcement from one vendor.

Which OWASP risks this category helps with

Posture tools are not the main defense against prompt-level attacks. In our scoring, the AI-SPM category is weighed on four OWASP LLM risks: sensitive information disclosure, supply chain, excessive agency and vector and embedding weaknesses. That choice is our analysis and matches what posture tools can see: data exposure, dependencies, permissions and the stores behind retrieval. None of the AI-SPM products above carries an LLM08 mapping in our data, because we map a risk only to a capability the vendor’s own pages document, and none of those pages describes controls for vector stores or embeddings. Put the retrieval layer to each vendor as an open question.

How to evaluate an AI-SPM tool

“Supports AWS” is not an answer. Microsoft’s discovery list names services from three clouds, Google’s AI Protection describes assets in Google Cloud, and both tie some features to a plan, tier or license. A tool can see one cloud’s AI services well and another’s barely. Work through these questions with each vendor; the list is our analysis.

1. Which AI services, agent platforms and libraries are discovered, per cloud? Get the list in writing, with any that need an extra license.
2. How does it connect, and with which permissions? Prefer least-privilege access, and check what the connection can read.
3. Does it find shadow AI? Ask whether it sees unapproved services in connected accounts only, or usage elsewhere too.
4. What checks and recommendations are documented? Identity, data, exposure and configuration should all appear.
5. Does attack path analysis include data stores and identities? Paths that ignore data miss the asset an attacker wants.
6. Does it cover code? Infrastructure-as-code, containers and AI libraries are where many findings start.
7. How are findings handled? Look for ticketing and workflow integrations, and a way to mark accepted risks.
8. How is it packaged and priced? Separate product or tier, any extra license for agents, and the pricing model the vendor publishes.

Filters on the tools page narrow the AI-SPM list by deployment and license.

Related controls

Posture management finds and ranks weaknesses. Other controls handle what it does not:

• Guardrails screen prompts and responses at runtime. See the best LLM guardrails.
• Model scanning checks model files before you load them. See how to scan ML models for malware.
• Red teaming probes your applications the way an attacker would. See open-source AI red teaming tools.