Topic starter
05/07/2026 6:53 pm
TL;DR: As enterprises treat AI models as first-class software artifacts, TrojAI and JFrog describe a workflow for scanning models, automating red teaming, and attaching compliance evidence before deployment, according to TROJ.AI. The real shift is governance: model risk now belongs in the same lifecycle controls as binaries, packages, and containers.
Editorial analysis by NHI Mgmt Group, based on content published by TROJ.AI: “Where DevSecOps Meets AI Security: TrojAI + JFrog Integration”.
Key questions
Q: How should teams govern AI-generated tests in DevOps pipelines?
A: Teams should treat AI-generated tests as controlled drafts, not ready-made assets.
Q: How should security teams combine model scanning and AI red teaming in an AI security programme?
A: Security teams should use model scanning to check model files before they enter the environment, then use AI red teaming to test how the model behaves under realistic prompts and adversarial pressure.
Q: What breaks when AI model evidence is not tied to a specific version?
A: Auditability breaks first, then accountability.
Practitioner guidance
- Treat models as governed release artifacts Place AI models under the same intake, versioning, and approval workflow used for other production artifacts so provenance and release state are explicit.
- Add pre-deployment model scanning Scan model files for structural risks, packaging anomalies, and serialization or deserialization issues before they are promoted into shared repositories or deployment paths.
- Run automated red teaming at ingestion Test models with single-turn and multi-turn adversarial prompts before deployment so behavioural weaknesses are detected while the artifact is still controllable.
Bottom line: AI model governance is shifting into the DevSecOps control plane, where release discipline matters as much as model selection.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:14 pm
AI model governance is now a supply chain problem, not just a model risk problem. Once models are versioned, stored, and distributed like software artifacts, the control question shifts from isolated evaluation to lifecycle governance. That means security, compliance, and platform teams have to treat model provenance, testing, and release approval as a single operating model. The practitioner conclusion is that model governance belongs in the same control plane as binaries and packages, not in a separate AI side process.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI governance and AI security as the same thing?
A: No. Governance answers who approved the system, what data it may use, and which policy applies. Security answers whether an attacker can misuse the system, steal data, or abuse credentials. The two functions need different owners, different evidence, and different response workflows.
👉 Read our full editorial: AI model supply chain governance now extends into DevSecOps