Data and AI Lifecycle

Expanded Definition

The Data and AI Lifecycle covers the full chain of activities that turns raw data into a trained, deployed, and continuously updated AI service. It includes data ingestion, labeling, model training, evaluation, release, monitoring, retraining, and retirement, plus the identity and secrets layers that support each stage.

For NHI security, the important distinction is that this lifecycle is not just “software development with a model added.” It introduces separate tooling, machine-to-machine trust, and runtime permissions that often outlive the code path that created them. Definitions vary across vendors on whether the lifecycle includes governance, MLOps, and prompt operations, but no single standard governs this yet. The practical boundary is wherever data pipelines, model artifacts, and autonomous execution begin to carry privileged access.

That is why the NIST NIST AI 600-1 Generative AI Profile is useful even when an organisation is not formally “doing AI security”: it frames governance, mapping, measurement, and monitoring as lifecycle duties rather than one-time controls. The most common misapplication is treating model deployment as the end of the work, which occurs when teams secure the application but leave training data, service tokens, and retraining pipelines unmanaged.

Examples and Use Cases

Implementing the Data and AI Lifecycle rigorously often introduces process friction, requiring organisations to weigh faster experimentation against tighter control over data, secrets, and release authority.

• A team uses a data lake to retrain a recommendation model every night, but the retraining job has broad write access to production storage. The lifecycle issue is not the model itself, but the NHI privileges attached to the pipeline.
• An agentic workflow pulls documents, generates outputs, and posts actions into SaaS tools. If the service token is static, the lifecycle creates a standing credential path that must be governed like NHI Lifecycle Management Guide material, not like ordinary app configuration.
• A platform team rotates training secrets only after a breach report, then discovers duplicate API keys across notebooks, tickets, and code commits. That pattern matches the Guide to the Secret Sprawl Challenge and shows why lifecycle controls must span data, model, and runtime layers.
• A security review maps model access, data access, and orchestration access against OWASP Non-Human Identity Top 10 guidance to identify where non-human credentials are created, reused, or overexposed.
• An incident response team traces why an AI assistant made an unauthorised API call and finds the issue started in a stale deployment secret, not in the model prompt. The workflow belongs to the AI lifecycle, but the failure is an identity lifecycle failure.

For deeper operational context, the NHIMG 2025 State of NHIs and Secrets in Cybersecurity research is especially relevant because lifecycle weaknesses often show up as secret exposure and overused identities.

Why It Matters in NHI Security

Data and AI Lifecycle governance matters because every phase can create or extend non-human access. If data pipelines, model trainers, eval harnesses, and agent runtimes are provisioned independently, each can accumulate secrets, tokens, and permissions that outlast the purpose they were meant to serve. That is how lifecycle sprawl becomes an identity problem.

NHIMG research shows that 44% of NHI tokens are exposed in the wild, often in collaboration tools, tickets, and code commits, which is exactly the kind of leakage lifecycle discipline is supposed to prevent. The same research also shows 60% of NHIs are overused, meaning one compromised credential can affect multiple applications or training workflows. In practice, this makes lifecycle review as important as model accuracy review.

The security implications also connect to external guidance from the OWASP Non-Human Identity Top 10 and the NIST AI 600-1 Generative AI Profile, both of which reinforce that AI systems require ongoing control over access, monitoring, and change management. Organisations typically encounter the lifecycle problem only after a model incident, a leaked token, or an unexpected autonomous action, at which point the Data and AI Lifecycle becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between SDLC security and Data and AI lifecycle security?
• Lifecycle Governance
• Non-Human Identity Lifecycle Management
• Secrets Lifecycle