Lesson 5 of 7 · 3 min read
AI Security Posture Management and AI Asset Inventory
In this lesson
TL;DR: AI security posture management (AI-SPM or AISPM) inventories AI systems and their security relationships. Use it to locate exposed models, sensitive data paths and excessive tool authority; evaluate model behavior and runtime enforcement separately.
Before you read
Pick an answer before you read further. The lesson below explains it, and guessing first, right or wrong, helps the explanation stay with you.
1A posture tool finds every model endpoint. Does that establish that agents cannot disclose private documents?
Inventory the system around the model
An AI asset can be a hosted endpoint, model artifact, agent, tool service, retrieval index or third-party integration. The security inventory should connect it to an owner, deployment, data sources, identities and reachable actions. A list of model names does not explain who can access customer records or publish generated output.
Discovery can use cloud APIs, repository evidence, network observations and application registration. Each method has blind spots. An unmanaged service account may call an external provider without creating a cloud model resource. A repository may contain unused integration code. Keep observed use, declared intent and inferred relationships separate.
Turn relationships into review questions
For a support agent, identify the user authority at retrieval, the service's own permissions and the tools it can invoke. Check whether sensitive data can enter a destination outside the approved boundary. A broad cloud role creates an entitlement risk; a public tool endpoint creates exposure; missing model-artifact provenance creates a supply-chain risk. These are actionable findings because they name a resource and a control.
Posture does not establish how frequently a model follows hostile instructions. A behavioral evaluation needs a scoped test set, observed outcomes and useful-work checks. Runtime filtering is another distinct mechanism, with false positives and false negatives. Do not report a posture pass as proof of prompt-injection immunity.
AI service
Owner and deployment
Data sources
Sensitivity and grants
Tools
Allowed operations
Assurance
Controls and evaluation
Boundary checks
Shadow usage
- Mark inferred or unobserved integrations.
Authority boundary
- Enforce outside the model.
AI service
Owner and deployment
A fictional inventory review
A company registers its production assistant but misses a staging agent used by support engineers. The staging agent shares a production retrieval identity and can send summaries externally. The first repair is to separate data and authority, restrict the recipient path and assign an owner. Changing the model or adding another inventory label leaves the disclosure path intact.
Create a relationship record with evidence time and confidence. If a connector loses access, the service does not disappear from the risk register. Mark its posture unknown until collection is restored or the owner provides verified retirement evidence.
Product terminology, checked November 2026
Google Security Command Center's AI protection documentation describes security capabilities for AI workloads and associated posture. Product packaging and supported assets change, so verify the current tier, resource scope and evidence sources for an evaluation. AI-SPM is not a universally fixed feature checklist.
Apiiro's application posture material also addresses agentic development context. That concerns how software is developed and secured; it should not be assumed to cover every deployed AI system's runtime data flow. Compare the actual assets and boundaries each integration observes.
The output that helps a reviewer
Produce a graph of AI services, data, tools and principals; a list of unknown relationships; and prioritized repairs with owners. Add control tests for retrieval, tool authorization and external effects. Record the evaluation conditions separately from the configuration evidence.
Use AI risk assessment for governance scope and evaluating an AI security platform for the practical product review.
Check yourself
Say or write your answer first, then reveal. Explaining it from memory, in your own words, is the skill an interviewer is checking.
1What makes an AI inventory useful for security?
2Why is a posture score insufficient to evaluate prompt injection?