Security guide

What Is AISPM? AI Security Posture Management Explained

AI security posture management (AISPM) is the practice of continuously discovering your AI assets and fixing the exposure around them. Think models, inference endpoints, vector stores, agents and their identities, tool servers, keys and the data behind them. The goal is the same as cloud posture management, applied to a new class of assets: know what exists, find what is exposed or over-privileged, and fix the riskiest first.

The term has no formal standard, so this guide sticks to what public documentation says: Microsoft's AI security posture capability, OWASP's LLM risk pages, the Model Context Protocol security guidance and NIST's AI Risk Management Framework, all read on 4 November 2026.

Updated 4 November 2026 (last reviewed)

TL;DR

The short version

6 points

AISPM = continuous discovery of AI assets plus exposure, identity and data checks, ranked by risk.
Build the inventory from the environment (an AI bill of materials), with surveys only to fill gaps and name owners.
Close externally reachable AI endpoints with strong authentication and least-privilege identities.
Limit agents by functionality, permission and autonomy; a prompt instruction is not an access control.
Vet MCP servers, keep secrets out of notebooks, sanitise training data and make retrieval respect permissions.
Rank AI findings in the same attack-path view as cloud findings, and treat NIST AI RMF as voluntary guidance.

What AISPM looks at

Microsoft says Defender for Cloud discovers deployed generative AI workloads continuously and identifies the AI bill of materials: application components, data and AI artifacts from code to cloud. It also scans for vulnerabilities in generative AI libraries, and highlights externally reachable AI endpoints so teams can enforce strong authentication and least-privilege identities. Recommendations cover identity, data security and internet exposure, and attack path analysis is applied to AI workloads. Check licensing: Microsoft notes that agent-level capabilities moved to a separate licence from 1 July 2026.

Record what you find in an AI System Inventory and an AIBOM; AISPM keeps them honest.

Sources (accessed 4 November 2026): AI security posture (Defender for Cloud).

The risks that show up in posture reviews

Excessive agency. OWASP traces it to too much functionality, too many permissions or too much autonomy, and recommends limiting each and requiring human approval for high-impact actions.
Sensitive information. OWASP names PII, financial details, health records, confidential business data and security credentials as information an LLM application can expose, and recommends sanitising data so user data does not enter training.
Tool servers. The MCP security guidance covers sandboxing local servers with minimal privileges, per-client consent for proxy servers and a ban on passing through tokens not issued for the server.
Vectors and embeddings. OWASP lists them as a risk category for retrieval systems. Permission-aware retrieval is our recommended design response.

The OWASP LLM Top 10 explainer walks through the full list; the MCP Server Security Checklist covers tool servers.

Sources (accessed 4 November 2026): OWASP LLM06 Excessive Agency; OWASP LLM02 Sensitive Information Disclosure; MCP security best practices; OWASP Top 10 for LLM Applications.

Shadow AI is shadow IT with higher stakes

Staff using public chatbots or personal model accounts is a discovery problem first: traffic-based discovery can show which services are used and by whom, and the CASB pattern of sanction, unsanction and offer an alternative applies (our application of that pattern to AI is PlayCISO practice). See What is a CASB? and the CASB Lab.

Sources (accessed 4 November 2026): Cloud discovery overview; Govern discovered apps.

AISPM versus CSPM

	CSPM	AISPM
Assets	Cloud resources and identities	Models, endpoints, vector stores, agents, tool servers, keys, training data
Typical finding	Public bucket, open port	Unauthenticated inference endpoint, agent with admin scope, PII in a training set
Prioritisation	Attack paths to valuable assets	The same, with AI assets in the graph

This table is our summary for orientation. Read What is CSPM? for the foundation and the CSPM Triage Lab to practise ranking.

Governance without overclaiming

NIST describes its AI Risk Management Framework as intended for voluntary use, and notes that the 1.0 version is being revised. Use it, and the OWASP list, as structures for your programme. Do not say you are compliant with or certified against them. Lead audits with the discovered inventory, the owners and the open items.

Sources (accessed 4 November 2026): NIST AI RMF; OWASP Top 10 for LLM Applications.

Practise it

The AISPM Lab puts eleven of these decisions in front of you on a fictional company, including the exposed endpoint, the over-permissioned agent and the leaked key. For agent controls specifically, try the Agent Tool Scope Lab and AI Agent Guardrail Planner.

Frequently asked questions

What does AISPM stand for?

AI security posture management. There is no single standard definition; the term is used by vendors for continuously discovering AI assets and assessing their exposure, identity and data risk. Microsoft documents AI security posture as part of Defender for Cloud.

What assets does AISPM cover?

Models and the services that host them, inference endpoints, vector stores, agents and their identities, tool connections such as MCP servers, API keys, and the training and retrieval data behind them. Microsoft describes discovering an AI bill of materials: application components, data and AI artifacts from code to cloud.

How is AISPM different from CSPM?

CSPM checks cloud configuration. AISPM adds AI-specific assets and risks and, in practice, shares the same graph, because an AI endpoint is also a cloud resource with a network path, an identity and data behind it. Microsoft delivers its AI posture capability within the Defender CSPM plan.

What are the biggest AI posture risks?

Externally reachable endpoints without strong authentication, agents with more functionality, permission or autonomy than they need, exposed credentials, sensitive data in training or retrieval sets, and unvetted tool servers. OWASP and the MCP specification document several of these.

Do I need AISPM if I already have an AIBOM?

An AIBOM records what an AI system is made of. AISPM is the continuous part: discovering what exists, comparing it with what is recorded, and ranking exposure. They work together.

Is the NIST AI RMF a certification?

No. NIST describes the AI Risk Management Framework as intended for voluntary use. Use it as a structure for your programme and be careful not to claim compliance with it.

How can I practise?

Try the free AISPM Lab: eleven scored decisions on a fictional company with shadow AI, an open endpoint, an over-permissioned agent and exposed training data.