TL;DR: AI Security Posture Management is positioned as a continuous control layer for AI systems because traditional CSPM and DSPM do not cover prompt injection, shadow AI, runtime misuse, or model-specific governance gaps, according to Akto. The practical takeaway is that AI security now depends on discovering AI assets, constraining tool access, and monitoring behaviour as a governance problem, not just a deployment problem.
At a glance
What this is: Akto argues that AI-SPM is moving from a niche idea to a baseline control because conventional cloud and data posture tools do not cover the runtime and governance risks of agentic AI.
Why it matters: IAM, PAM, and security teams need AI-specific discovery, policy enforcement, and runtime monitoring because agentic systems use identities, tools, and data in ways static controls do not govern well.
Context
AI security posture management sits at the point where model risk, access control, and operational governance meet. Traditional cloud and data posture tools are built for relatively static systems, but agentic AI changes actions, tool use, and data exposure at runtime. That makes discovery, authorisation, and behaviour monitoring part of the same control problem, not separate workstreams.
The identity angle is direct. Agentic systems act through tools, APIs, and delegated privileges, which means over-privileged access, shadow AI, and uncontrolled MCP-style integrations become governance failures as much as technical ones. For IAM and PAM teams, the question is no longer whether AI has access, but how that access is issued, constrained, observed, and revoked.
Key questions
Q: How should security teams handle prompt injection in AI systems?
A: Treat prompt injection as an authorisation problem, not only a content problem. Validate user input, monitor for override patterns, and block any prompt that tries to change model policy, exfiltrate data, or trigger sensitive actions. The safest design is one where untrusted prompts cannot directly reach code execution, production data, or privileged tools without policy checks.
Q: Why do agentic AI systems complicate existing IAM and PAM controls?
A: They complicate them because IAM and PAM were built around stable identities, human-paced approvals, and entitlements that are reviewed after use. Agentic systems compress decision-making into runtime, which means access can be consumed, combined, and discarded before a review cycle ever sees it. That makes static privilege models incomplete for autonomous execution.
Q: What are the signs that shadow AI is becoming a governance problem rather than a productivity aid?
A: The clearest signs are widespread use outside IT visibility, repeated sharing of corporate data with GenAI tools, and no consistent approval path for new applications. If employees are using AI because no sanctioned option exists, or if security teams cannot see which tools are active, the issue has moved from isolated behaviour to unmanaged risk.
Q: Should organisations use AI-SPM instead of CSPM and DSPM for AI security?
A: No. CSPM and DSPM still matter, but they do not cover AI behaviour, delegated tool use, or prompt-driven abuse. Organisations should use AI-SPM alongside them so infrastructure, data, and runtime AI controls are governed together rather than in separate silos.
Technical breakdown
Why CSPM and DSPM miss agentic AI risk
Cloud Security Posture Management focuses on infrastructure configuration, while Data Security Posture Management focuses on where sensitive data lives and how it is classified. Neither model was built to understand an AI system that changes behaviour based on prompts, context, memory, and external tools. Agentic AI can appear compliant at deployment time and still become unsafe at runtime when it receives manipulated instructions or uses legitimate access in unexpected ways. That creates a governance gap between static posture checks and dynamic execution risk.
Practical implication: Treat AI posture as a runtime control problem, not just a deployment review.
How AI-SPM maps AI assets and delegated access
AI-SPM starts with inventory. That means identifying models, agents, MCP servers, SaaS AI tools, training data, and the privileges those components inherit. In practice, discovery is the control that makes governance possible: if an organisation cannot see shadow AI, untracked agents, or third-party model dependencies, it cannot set policy or measure exposure. The authorisation issue matters here because many AI failures are not about model quality alone, but about excessive access to email, databases, code, or business systems.
Practical implication: Build an authoritative AI inventory that links each agent or model to its tools, data, and owners.
Why runtime guardrails are the real security boundary
Pre-deployment testing cannot absorb the full risk of agentic behaviour because the agent can still be manipulated after release. Runtime guardrails are the enforcement layer that limits unsafe topics, blocks sensitive actions, filters malicious prompts, and can deny access when anomalous behaviour appears. This is where AI-SPM begins to overlap with identity governance: the system must decide not only who or what may connect, but what actions remain permitted once the session starts. Behavioural logging and SIEM integration then turn those decisions into evidence for investigation.
Practical implication: Move from test-only assurance to live policy enforcement at the point of action.
Threat narrative
Attacker objective: The objective is to turn a trusted AI workflow into an unwitting execution path for data exposure, policy evasion, or unauthorised action.
- Entry occurs when a prompt injection, shadow AI deployment, or unvetted integration reaches the agent through an email, document, webpage, or API-connected workflow.
- Credential and tool abuse follow when the agent uses legitimate privileges to send email, query databases, execute code, or move data in ways the operator did not intend.
- Impact lands as data leakage, policy bypass, model manipulation, or unsafe autonomous actions that persist across later workflows.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI-SPM is becoming a governance layer, not a point product category. The article is right to treat AI security posture as continuous rather than episodic, because agentic systems change behaviour after deployment. That makes discovery, policy, and monitoring part of one operating model. For security leaders, the practical conclusion is that AI governance cannot stop at approval workflows or cloud posture reviews.
The named concept here is the AI runtime trust gap. Static controls assume the risky decision happened before release, but agentic systems can make high-impact decisions during execution, after the review window has closed. That gap is especially visible where tools, memory, and delegated access intersect. The practitioner takeaway is to enforce controls at the moment of action, not only at onboarding.
Identity governance now has to include non-human decision makers. When an AI agent can call APIs, query systems, and act on behalf of users, privilege becomes behavioural, not just role-based. That means IAM and PAM teams must account for tool scope, session scope, and the conditions under which access is valid. The conclusion is that agent identity must be governed as a live security object, not a static account.
Shadow AI is an inventory problem before it becomes an incident problem. If an organisation cannot identify unsanctioned models, plugins, or connected workflows, it cannot apply consistent policy or establish accountability. The article's strongest signal is that AI security failures increasingly begin outside formal procurement and then enter the estate through business use. The practitioner conclusion is to make discovery the first control, not an afterthought.
Agentic AI security will converge with access governance and data governance. The more AI systems touch sensitive data and external tools, the more control boundaries collapse into one another. That means AI-SPM should be evaluated alongside IAM, DLP, and security telemetry, not as a separate AI-only effort. The practitioner implication is to design one control plane for identity, data, and runtime enforcement.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
- Read next: Agentic AI Identity Maturity Model
What this signals
Agentic AI security is now an access-governance issue, not only a model-risk issue. Once an agent can query systems, send messages, or trigger workflows, the control question shifts to who or what is authorised to do which action under which conditions. That is why teams should align AI security controls with identity lifecycle, privilege scope, and telemetry rather than isolate them inside an AI-only workstream.
The AI runtime trust gap will widen faster than legacy controls can absorb. Pre-deployment reviews were designed for deterministic software, but agentic systems keep changing through prompts, memory, and external tools. Security leaders should expect more incidents where the model is approved, yet the runtime path is not, which means policy enforcement has to move closer to execution.
AI-SPM adoption will force organisations to inventory shadow AI and third-party integrations more aggressively. The operational lesson is simple: what cannot be discovered cannot be governed. For practitioners, that means extending discovery, owner assignment, and access constraints into every AI-connected workflow before the next approval cycle closes.
For practitioners
- Inventory all AI assets and delegated connections Build and maintain an AI-BOM that covers models, agents, MCP servers, plugins, SaaS tools, datasets, and the business owners responsible for each one.
- Constrain tool access to task-scoped permissions Limit each agent to the smallest set of APIs, databases, and actions needed for its use case, and revoke access when the task or session ends.
- Deploy runtime guardrails for prompts and outputs Filter malicious input, block unsafe outputs, and deny high-risk actions when the agent's behaviour diverges from approved policy.
- Monitor agent behaviour as security telemetry Send prompts, tool calls, and anomalous actions into SIEM workflows so security teams can investigate misuse, not just misconfiguration.
- Review third-party AI integrations before production use Treat external model providers, APIs, and workflow plugins as supply chain dependencies that require security review, data handling checks, and owner assignment.
Key takeaways
- AI-SPM is emerging because traditional cloud and data posture controls do not address the live behaviour of agentic systems, including prompt manipulation, tool misuse, and shadow deployments.
- The core governance failure is visibility plus enforcement, since organisations cannot manage AI access they have not inventoried and cannot stop actions they do not control at runtime.
- For security teams, the practical shift is to govern AI assets, delegated privileges, and runtime behaviour as one control surface rather than separate programmes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agent misuse of legitimate privileges and tool access. |
| ASI02 — Tool Misuse | Tool abuse is one of the article's core runtime risks for agentic systems. | |
| ASI10 — Rogue Agents | Shadow AI and unapproved agents are a recurring theme in the article. | |
| Recommendation — Constrain agent identity and privilege scope so runtime actions remain task-bound and auditable. Restrict and monitor tool invocation so agents cannot execute unauthorised actions through approved connectors. Inventory and govern unapproved agents before they can operate outside security review. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article frames AI-SPM as a governance layer for accountability and policy control. |
| MANAGE — AI Risk Management | The article focuses on continuous identification and mitigation of AI risk. | |
| Recommendation — Define ownership, policy, and oversight for AI systems before they reach production. Manage AI risk continuously across discovery, monitoring, and response workflows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent privilege, tool scope, and delegated access are central to the article. |
| Recommendation — Review AI entitlements and authorisations so agent access stays least-privilege and task-scoped. | ||
| MITRE ATLAS | TA0006; TA0004 — Credential Access; Privilege Escalation | Prompt injection and tool abuse map to adversarial access and escalation behaviours. |
| Recommendation — Map AI abuse patterns to credential access and privilege escalation tactics for detection coverage. | ||
| CSA MAESTRO | Agentic AI Threat Modeling | The article discusses runtime threats, guardrails, and AI supply chain risk. |
| Recommendation — Apply agentic AI threat modelling to identify where prompts, tools, and memory can be abused. | ||
Key terms
- AI Security Posture Management: A governance approach for discovering and tracking AI assets such as models, agents, datasets, vector stores, and related infrastructure. It becomes useful only when inventory is connected to runtime exposure and the identity that can actually reach the data.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
- AI bill of materials: An inventory of the components used by an AI development environment, including models, plugins, hooks, skills, and agent integrations. It gives security teams visibility into what is operating in the stack so they can assess trust, dependency risk, and governance coverage.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It is designed for practitioners who need to connect access control, lifecycle management, and governance across modern identity programmes.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org