AISPM Lab: AI Security Posture Management Practice

AISPM applies the idea of cloud posture management to AI systems: continuously discover AI assets (models, endpoints, vector stores, agents, tool connections, keys and the data behind them), find exposure and excess permission, and prioritise fixes. Microsoft describes the discovery of an AI bill of materials, attack path analysis and highlighting externally reachable AI endpoints as parts of its AI security posture capability.

Eleven decisions: build an inventory from the environment, handle shadow AI, close an open inference endpoint, cut an agent's permissions, vet an MCP server, rotate a leaked model key safely, protect training data, make a vector store respect permissions, layer guardrails, fold AI findings into the main posture queue and answer an auditor honestly.

CSPM looks at cloud configuration. AISPM adds the AI-specific assets and risks: models and prompts, retrieval indexes, agent identities and tool connections, and training data. In practice they share a graph, because an AI endpoint is also a cloud resource with a network path, an identity and data behind it.

It touches several of its risks, including sensitive information disclosure, excessive agency and vector and embedding weaknesses, and cites OWASP pages where it does. For the full list, see our OWASP LLM Top 10 explainer.

Product behaviour is cited from Microsoft Defender for Cloud documentation because it is public. The principles apply to other tools. The lab connects to nothing and uses fictional systems.

NIST describes its AI Risk Management Framework as voluntary guidance, so use it as a structure, not a certification. OWASP's LLM Top 10 is a useful risk checklist. The lab's last step practises saying exactly that to an auditor.

The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.

Start from where agents leave traces: identity provider and OAuth consent logs, API gateway and egress logs, MCP server and tool-connection inventories, code repositories and developer workstations, and expense or procurement records. Then give every discovered agent an owner and a decision (approve, bring under control, or retire). The Cloud Security Alliance reported in April 2026 that 54% of organisations in its study reported between 1 and 100 unsanctioned AI agents. That is a self-reported figure from a study Zenity financed and co-developed the questionnaire for, so read it as an indication of how common the problem is among respondents, not as a rate for all organisations.