Microsoft Defender for Cloud AI security posture management: multicloud AI posture feature in Defender CSPM
Defender AI-SPM is a multicloud AI posture feature in Defender CSPM from Microsoft. It is a commercial product offered as: Cloud-native. Pricing model: included with platform.
Teams already using Defender for Cloud that want AI workloads in Azure, AWS and Google Cloud added to their posture view
Microsoft-centric security teams that want AI exposure to appear in the attack paths and recommendations they already triage
Consider instead if
You want shadow AI discovery and runtime prompt injection signals in the same posture product rather than in separate Microsoft plans.
See Wiz AI-SPM or Orca AI-SPM.
Your main AI risk sits in code that has not shipped yet, and you want an AI-BOM built from source repositories with a CI gate.
See Evo AI-SPM.
What Defender AI-SPM does
Defender AI-SPM is not a product you buy on its own: it is part of the Defender Cloud Security Posture Management (CSPM) plan, so its value depends on whether you already run Defender for Cloud. It finds AI workloads on Azure, AWS and Google Cloud and puts them into the same recommendations and attack paths as the rest of the estate. Microsoft has split the AI story across licenses. Agent-level discovery moved to Microsoft Agent 365 on July 1, 2026, and scanning of model files sits in the separate Defender for AI Services plan, in preview and limited to Azure Machine Learning. The four named infrastructure as code checks are all Azure AI Service settings. Wiz and Orca put shadow AI and runtime signals in one posture product; here you assemble them from several Microsoft plans.
This summary is our own wording of the sourced facts on this page.
Key facts
Each value links to the page that states it, with the date we checked it.
Where Defender AI-SPM fits in our AI security layers
Our analysis
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document.
How the model works.
AI security layers that Defender AI-SPM covers, with the role, how each applies and what it rests on
Lists AI components in an AI-BOM, scans AI library dependencies, and (in a separate preview plan) scans model files for malware.
Discovers generative AI workloads and their AI bill of materials, including application components, data and AI artifacts; Finds vulnerabilities in generative AI library dependencies such as TensorFlow, PyTorch and LangChain in source code and container images; Separate preview add-on scans Azure Machine Learning model files for malware, unsafe operators and exposed secrets once a week
Not mapped in our analysis: LLM06, LLM08.
These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.
Finds agents, MCP servers, skills and models across endpoint, SaaS and cloud and flags their risks.
Best for: Security teams that need to find and govern agents, MCP servers and models spread across endpoints, SaaS and cloud
53Coverage Score 53 out of 100
LLM02 Sensitive Information Disclosure
LLM03 Supply Chain
LLM06 Excessive Agency
Reviewed
Defender AI-SPM FAQ
Which Defender plan includes AI security posture management?
The Defender Cloud Security Posture Management (CSPM) plan in Microsoft Defender for Cloud.
Does it cover AI agents?
Effective July 1, 2026, the docs say AI agent discovery and posture for Microsoft Foundry agents and third-party cloud agents require a Microsoft Agent 365 license.
Does it scan model files for malware?
Only through a separate add-on. Microsoft's AI model security feature is in preview, included with the Defender for AI Services plan rather than Defender CSPM, and scans models in Azure Machine Learning workspaces and registries once a week, up to 10 GB per file. The docs name only Azure Machine Learning as a scan target, so models hosted on Bedrock or Vertex AI fall outside it.
Does it find sensitive data exposure?
Yes, as a secondary capability. The docs say it issues recommendations on identity, data security and internet exposure, and that attack path analysis covers data that might be exposed during grounding or fine-tuning. That is posture detection, so we list it under discovery and posture, not under the data protection layer, which covers tools that redact, tokenize or block data.
We have no commercial relationship with Microsoft.
Sources & last reviewed
Last reviewed . We compile from the vendors' own public
pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.
We may use analytics and, later, show ads. They stay off until you choose, wherever you are. Declining
never limits what you can read. See our privacy policy and
cookie policy.
Privacy settings
Choose what you allow. Your choice is stored on this device for 13 months. You can change it later from the
"Privacy choices" link in the footer.