AI security posture management, or AI-SPM, is the ongoing practice of discovering the AI models, agents, pipelines and data your organization uses, checking how they are configured and what they can access, and fixing risky settings. The term is a market label rather than a standard, so define what you need it to cover.
Where does the term come from?
It borrows from cloud security posture management: inventory, assess, prioritize, fix, repeat. There is no single standards body definition of AI-SPM. The substance comes from existing frameworks. NIST's AI Risk Management Framework is a voluntary framework to incorporate trustworthiness into the design, development, use and evaluation of AI systems, and its generative AI profile (NIST AI 600-1) identifies risks unique to generative AI. NIST AI 100-2 provides a taxonomy and terminology for attacks on AI systems. OWASP's list of risks for LLM applications gives a practical catalog.
What does it cover?
Inventory. Which models, hosted or self-run, do you use? Which applications call them? Which agents and tools exist, and which teams run unapproved ones? You cannot assess what you cannot see.
Data. What data feeds training, fine tuning, retrieval and prompts? Does it include personal or confidential material? Who can read the vector store?
Access and identity. What credentials do models, agents and pipelines hold? What tools can an agent call, and as whom? OWASP's prompt injection guidance recommends least privilege, giving the application its own tokens and handling functions in code, and human approval for high risk actions. These are posture settings you can check.
Configuration. Are logging, filtering and output validation turned on? Are public endpoints exposed? Are model files loaded from safe formats, given the risks of pickle based files?
Supply chain. Which model files, datasets, packages and plugins come from outside, and are they verified?
Runtime behavior. Are tool calls logged and are anomalies reviewed? Observability closes the gap between a configuration that looks right and behavior that is.
What does it not cover?
Posture management finds and fixes settings. It does not make a model immune to prompt injection. The UK NCSC argues that current models do not enforce a boundary between instructions and data, so some risk remains by design and has to be handled by limiting impact. It also does not replace governance: deciding which uses are allowed, who approves new ones and how you respond to incidents.
A constructed example
A company's security team surveys AI use and finds nine internal applications that call hosted models. Three use a shared API key stored in a wiki. Two retrieve documents from a drive that includes HR files because an index was built from a broad folder. One agent can send email and read the file share under a single service account, with no approval step. The team rotates and splits the keys, narrows the index, and moves the email action behind human approval. It then writes a short intake rule: any new AI use is registered with an owner, data sources and tool permissions before it launches.
If your agents use MCP, policy checks on tool calls are one concrete control. Safeguard's MCP Guardrail checks tool calls against policy, and its MCP server and agent identity features help manage what agents may do. Safeguard does not replace governance or model-level testing.
How to check or apply this
- Create an inventory of models, AI applications, agents, tools, datasets and vector stores, each with an owner.
- Classify the data each one touches.
- Review every credential and permission held by AI components, and cut them to the minimum.
- Require human approval for irreversible or sensitive actions.
- Turn on logging for prompts, retrieval, tool calls and blocked outputs, with sensible redaction.
- Verify the origin of external models and files, and avoid pickle based formats for untrusted sources.
- Repeat monthly, and register new AI use through a simple intake step.
Quick check
Is AI-SPM a certification or standard?
No. It is a product category and a practice. Use NIST's AI RMF and OWASP's guidance as the underlying references.
What is the first step?
An inventory of where AI is used, by whom and with what data and permissions.
Sources
- NIST AI Risk Management Framework
- NIST AI 100-2 E2025, Adversarial Machine Learning taxonomy
- OWASP, LLM01:2025 Prompt Injection
- UK NCSC, Prompt injection is not SQL injection (it may be worse)
Last reviewed: 18 October 2026.
