Education Lab · Security track

AI Security Posture Management

Cloud had its CSPM moment when the hardware left the building. AI is having the same moment now — models, pipelines, and training data scattered across vendors, teams moving fast, and security trying to see the whole board. This track is the full playbook: the threat landscape, the components that manage it, and how to run it in a real organization.

9 sectionsGlossary includedInterview-ready checklistPractitioner level

Study companion based on AI Security Posture Management for Dummies, Wiz Special Edition (Wiley, © 2025). Every explanation here is written fresh for the Lab — a companion to the book's structure, not a republication of its text.

01 · What AI-SPM actually is

Posture, plainly

Security posture is the security status of your enterprise — networks, information, systems — given the people, hardware, software, and policies defending it and how fast they can react when things change. It covers both the defense-in-depth strategy and the individual tools carrying it out.

The pattern repeats

On-prem, you could look at status lights. Cloud took the hardware away, so posture management had to be rebuilt in software — that was CSPM. AI is the next iteration of the same problem: the pipeline now spans data intake, training, and deployment across providers you don't control, and visibility is once again the whole game.

What the tooling does

An AI-SPM continuously assesses AI pipelines — training and production alike — for risk, then correlates what it finds into attack paths: the actual routes an attacker could walk from a misconfiguration to your model or your data. Visibility first, prioritization second, remediation third.

02 · The threat landscape — CIA through an AI lens

Confidentiality: the overshare problem

Models can be talked into revealing what they shouldn't — their own instructions, or sensitive data baked into training. A customer-service model that answers a cleverly framed question with another customer's details is a confidentiality failure no firewall would catch.

Integrity: the pipeline is the surface

Data intake, prep, training, deployment — an attacker can stand at any of these points. Tampered inputs, poisoned training data, and confident hallucinations all corrupt the output the business is deciding on. With AI, the blast radius of an integrity failure is whatever downstream decision trusted the model.

Availability: talked into uselessness

Models that feed their own output back as input can be pushed into recursive loops — a denial-of-service with an AI flavor. Or they can be prompted into hallucinating so aggressively that the output is worthless to everyone using it. Same vertex of the triangle, new mechanics.

03 · Shadow AI

The maturity arc

Organizations adopt AI the way they adopted cloud: quiet experimentation, then visible development work, then production workloads — each stage with a different risk profile. The danger zone is the first stage, where usage is real but invisible to the security team.

Why bans backfire

Heavy-handed, top-down prohibition doesn't stop AI usage — it just moves it off the books and slows the organization down. People will use the tools from their phones if they have to. The winning move is embracing AI with guardrails, not pretending it isn't there.

Where it hurts

Three exposure classes follow shadow AI around: data protection (internal data fed into models as training or prompts, extractable later through inference), integrity (AI-generated code carrying bad practices or copyrighted material into your codebase), and compliance (a growing regulatory web — the EU AI Act foremost — that doesn't care your usage was unofficial).

04 · The OWASP AI risks

OWASP's Top 10 for LLM applications maps the vulnerabilities that keep showing up in real deployments. The headline entries, in working terms:

Prompt injection — direct and indirect

Direct: crafted input that bends the model into behavior it wasn't meant for — reaching areas and data outside its intended scope. Indirect: the model is steered into reading untrusted content (a web page, a document) as part of its context, and the poison rides in with it.

Output injection

When model output feeds another process, unfiltered output becomes a fresh vulnerability. Input injection gets the attacker into the AI; output injection lets the AI create the next vulnerability downstream.

Data poisoning & model theft

Corrupted training data steers results — sometimes subtly, sometimes at a competitor's direction. Closely related: published models carrying hidden bias or backdoors. And the model itself is an asset worth stealing — weights plus training signal, extractable through persistent, clever prompting.

Excessive agency

Models granted more permission, functionality, and autonomy than the task requires — acting without direct oversight on things with downstream consequences. Pair it with overreliance (trusting the output because it sounds right) and you get AI-written code shipping vulnerabilities straight through testing into production.

Plus the classics, AI-flavored

Denial of service via recursive self-feeding loops. Supply-chain risk through tainted third-party components, plugins, and the Python packages that model pipelines lean on. Familiar categories — new mechanics.

05 · Core components

AI bill of materials (AI-BOM)

The SBOM idea applied to AI: every model, dataset version, library, SDK, and source pinned down and traceable. It kills guesswork about how a deployment was built, speeds vulnerability response, shines light on shadow AI, and makes the pipeline repeatable — and a repeatable pipeline is a securable one.

DSPM for AI data

Data security posture management extended into the AI pipeline: scanning training data for sensitive content, catching exposed buckets, flagging open write access on data stores the model drinks from. Training data is where the crown jewels now live.

Attack-path analysis

Individual findings are noise; chained findings are a story. Attack-path analysis links misconfigurations, exposed secrets, excessive permissions, and lateral-movement options into the route an attacker would actually take — so you cut the path, not just the symptoms. This is where cloud context earns its keep.

Malicious model detection

Open model hubs run on inherited trust — "everyone uses it, so it's fine." AI-SPM scans for models that execute unexpected commands, reach outbound, or hide backdoors that trigger only on the attacker's cue. The classic vector is deserialization formats like pickle, which can run code on load and break out of the container. Verify, then trust.

Config checks & cross-platform detection

AI services assessed for misconfiguration the way CSPM assesses cloud — extended into the pipeline. And it has to work everywhere the models live (OpenAI, Bedrock, Azure AI, Vertex), ideally agentless and near real time, because the threat landscape doesn't wait for an install window.

06 · Making it real — governance that works

Governance, not prohibition

Start with policy, but keep it agile and cross-functional. The goal is safe adoption at speed — a living policy that evolves as fast as the field does, not a gate that teaches everyone to route around security.

The three moves

1. Total visibility into AI usage across the org. 2. Continuous risk assessment on the AI pipelines, not point-in-time audits. 3. Proactive risk removal using cloud context to shrink the attack surface before it's tested. Visibility, assessment, removal — in that order, on repeat.

Shift left, for real

Security requirements belong in the AI lifecycle as first-class members, the way DevSecOps put them in the SDLC. The force multiplier: let AI engineers see, prioritize, and fix issues inside their own pipelines. Diffused expertise beats a bottlenecked security team every time.

07 · Why it pays off

Simplification over sprawl

One graph-based view of posture beats a dozen dashboards with a dozen design languages. Context — seeing how findings connect — is what makes prioritization fast and obvious, for security engineers and AI engineers alike.

Visibility that compounds

A single tool watching cloud and AI posture together, with the AI-BOM continuously discovering new services, SDKs, and models. Automated visibility is the difference between securing AI and hoping about it.

Innovation with the brake off

The end state isn't "AI, but slower." It's a posture specific to AI — risks named, paths cut, guardrails live — so the organization can adopt fast without adopting blind. Security that enables the work instead of gating it.

08 · Interview-ready checklist

Ten questions that separate a real AI security posture from a slide deck. If you can answer all ten with specifics, you're ahead of most rooms you'll walk into.

01How much of our AI usage can we actually see — sanctioned and shadow?
02Can we assess our existing security posture specifically for AI workloads?
03Which AI-specific risks have we evaluated against our actual environment?
04How do we govern AI use — and does the policy match what's really happening?
05Do we understand how cloud deployment context changes our AI risk?
06How do we prevent data leakage through AI interactions?
07Do our existing security tools genuinely integrate with our AI stack?
08Is security centralized, or can teams own it inside their own pipelines?
09How would we detect misuse or lateral movement inside an AI pipeline?
10Does our AI security posture accelerate innovation — or slow it down?

09 · Key terms

AI-SPM: AI security posture management — continuous assessment of AI pipelines to surface risks and attack paths, the AI-era successor to CSPM.
AI-BOM: AI bill of materials — a pinned, traceable inventory of everything that built an AI deployment: models, dataset versions, libraries, SDKs, sources.
SBOM: Software bill of materials — the same ingredients-label idea for conventional software; the concept the AI-BOM extends.
DSPM: Data security posture management — monitoring data stores for sensitive content, exposure, and misconfiguration; vital for AI training data.
Shadow AI: AI tools and services in use without the security team's visibility — the sequel to shadow IT, with AI-specific exposures attached.
Prompt injection: Manipulating a model via crafted input (direct) or via untrusted content the model reads as context (indirect).
Output injection: Unfiltered model output becoming another system's input — the AI creating a new vulnerability downstream.
Data poisoning: Corrupting training data so the model produces wrong, incomplete, or biased results — sometimes planted by competitors.
Excessive agency: A model holding more permissions, functionality, or autonomy than its task needs — able to act without oversight on consequential things.
Attack path: The chained route — misconfig to exposed secret to excessive permission to lateral movement — an attacker could actually walk.
Backdoor model: A model that behaves normally until a hidden trigger activates the attacker's capability; hard to spot without scanning.
CVE: Common Vulnerabilities and Exposures — public disclosures of security flaws, hardware or software, that posture tooling tracks.
Shift left: Moving security requirements earlier into the lifecycle — here, into AI development — instead of bolting them on at the end.

← Back to the Lab · The full curriculum lands with membership.