Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: AI observability is the practice of tracking LLM performance, cost, behaviour, prompts, responses, and tool calls in production, and Lasso Security’s article argues that continuous monitoring is now necessary to catch hallucinations, prompt injection, shadow AI, and agentic misuse across growing enterprise deployments. The governance gap is no longer theoretical: visibility, logging, and runtime enforcement have become baseline requirements for AI risk management.
NHIMG editorial — based on content published by Lasso Security: AI Observability: How It Works, Key Challenges & Best Practices
By the numbers:
- Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
- The EU AI Act sets maximum fines of €35 million or 7% of global turnover for failures in high-risk AI governance, according to the article.
Questions worth separating out
Q: What breaks when AI observability relies only on pre-aggregated metrics?
A: When observability relies only on pre-aggregated metrics, teams often lose the evidence needed for fast root cause analysis.
Q: Why do AI agents create more identity risk than traditional LLM applications?
A: AI agents create more identity risk because they can persist state, choose tools, and carry out actions over time.
Q: How do teams know if AI observability is actually working?
A: It is working when teams can show which change caused a quality shift, which dataset surfaced the issue, and whether the regression was contained before users were affected.
Practitioner guidance
- Define AI monitoring objectives before production rollout Set thresholds for latency, drift, unsafe output, and policy violations before the model or agent goes live, so the first production week is not your first security test.
- Log full prompt, response, and tool-call context Capture the complete exchange, including retrieved context, model version, initiating user or service account, and each downstream tool invocation, so investigations can reconstruct what the system actually saw and did.
- Tie observability alerts to runtime policy enforcement Configure blocking, redaction, scope restriction, and rate limiting so a detected violation can be stopped before the next tool call or output is completed.
What's in the full article
Lasso Security's full blog post covers the operational detail this post intentionally leaves for the source:
- Full monitoring architecture for logging prompts, responses, model versions, and tool calls across LLM deployments
- Runtime enforcement examples for blocking, redacting, and scoping AI actions before they complete
- Operational guidance for discovering shadow AI across browsers, SaaS embeds, and unmanaged accounts
- Practical breakdown of AI agent tracing across multi-step workflows and delegated tool usage
👉 Read Lasso Security's analysis of AI observability, agent tracing, and runtime enforcement →
AI observability and agent monitoring: are your controls keeping up?
Explore further
14/09/2026 10:10 am
AI observability is becoming the control plane for production AI governance. Once models and agents are in use across business functions, raw uptime metrics are insufficient. Organisations need traceability across prompts, responses, tools, and identities so they can prove what happened and why. The governance challenge is not simply detection, but reconstructability. Practitioners should treat observability as evidence generation for AI risk management, not a dashboard exercise.
A question worth separating out:
Q: What is the difference between AI observability and AI governance?
A: AI observability tells you what the system did. AI governance decides whether it should have been allowed to do it, who approved it, and what happens when it crosses a policy boundary. Observability is a data problem. Governance is an operating model that combines policy, ownership, evidence, and enforcement.
👉 Read our full editorial: AI observability is exposing the limits of model oversight
