# Control 1.24: Defender AI Security Posture Management (AI-SPM)

**Control ID:** 1.24<br>
**Pillar:** Security<br>
**Regulatory Reference:** OCC Bulletin 2026-13 (formerly OCC 2011-12) (model risk monitoring), Fed SR 26-2 (formerly SR 11-7) (effective challenge), FINRA RN 24-09 + Rule 3110, GLBA 501(b) Safeguards Rule, NYDFS 23 NYCRR Part 500, NIST AI RMF 1.0 (MAP/MEASURE/MANAGE/GOVERN)<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

!!! note "Agent 365 Architecture Update"
    Agent 365 security posture dashboard integrates with Microsoft Defender, providing centralized visibility into agent security risks across platforms. See [Unified Agent Governance](../../framework/agent-identity-architecture.md) for security posture management architecture.

## Objective

Implement Microsoft Defender for Cloud AI Security Posture Management (AI-SPM) to gain comprehensive visibility into multi-cloud AI security posture, identify attack paths targeting AI workloads, and maintain an AI Bill of Materials (AI BOM) for agent discovery and risk assessment across Azure, AWS, and GCP environments.

---

## Why This Matters for FSI

- **OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) (Model Risk Management):** Ongoing model monitoring expectations include identifying changes in the AI system's attack surface, third-party model dependencies, and configuration drift. AI-SPM's continuous discovery and AI Bill of Materials (AI BOM) help meet the bulletin's expectation that firms maintain awareness of model components and risks throughout the model lifecycle.
- **Federal Reserve SR 26-2 (formerly SR 11-7) (Guidance on Model Risk Management):** Effective challenge of AI models depends on independent visibility into model infrastructure, data flows, and security posture. AI-SPM attack path analysis supports independent risk review by surfacing exploitable paths the model owner may not self-report.
- **FINRA RN 24-09 / Rule 3110 (AI Supervisory Controls):** Calls for risk-based supervision of AI systems, comprehensive AI inventories, and third-party AI vendor oversight. AI-SPM agent discovery and AI BOM directly support the inventory requirement; attack path analysis aids supervisory reviewers in identifying risks introduced by configuration changes or new integrations.
- **GLBA 501(b) Safeguards Rule:** Requires identification of foreseeable internal and external risks to customer information. AI-SPM helps identify AI-specific risks (prompt injection chains, data exfiltration paths) that may not be visible to traditional CSPM tooling.
- **NYDFS 23 NYCRR Part 500:** Risk assessments must consider AI-enabled threats and the firm's own AI-enabled systems. AI-SPM provides the technical evidence to support these assessments.
- **NIST AI RMF 1.0:** Maps to all four functions — **MAP** (agent discovery and AI BOM inventory), **MEASURE** (attack path analysis and risk factor scoring), **MANAGE** (prioritized security recommendations and remediation tracking), **GOVERN** (posture dashboards and trend reporting for governance committees).
- **SEC Reg S-P (amended 2024):** Incident response programs must address AI-related risks to customer records; AI-SPM alerts feed incident detection workflows.

---

!!! info "No companion solution by design"
    Not all controls have a companion solution in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions); solution mapping is selective by design. This control is operated via native Microsoft admin surfaces and verified by the framework's assessment-engine collectors. See the [Solutions Index](../../reference/solutions-index.md#coverage-scope) for the catalog and coverage scope.


## Control Description

Defender AI-SPM provides multi-cloud AI security posture management capabilities that complement Microsoft Purview DSPM for AI. While DSPM for AI (Control 1.6) focuses on data security and compliance within Microsoft 365, AI-SPM addresses the broader attack surface and vulnerability management for AI workloads across cloud platforms.

> **Relationship to DSPM for AI:** AI-SPM and DSPM for AI serve complementary purposes. DSPM for AI monitors how AI applications interact with organizational data (data-centric). AI-SPM identifies vulnerabilities, attack paths, and security misconfigurations in AI infrastructure (security-centric). Organizations using both M365 Copilot/Microsoft Copilot Studio and Azure AI services should implement both controls.

| Capability | Description |
|------------|-------------|
| Agent discovery | Automatically discovers AI agents across Microsoft Foundry, Copilot Studio, and multi-cloud environments |
| AI Bill of Materials (AI BOM) | Inventories AI components, models, SDKs, and dependencies |
| Attack path analysis | Identifies exploitable paths to AI workloads and sensitive data |
| Risk factors | Assesses indirect prompt injection, data exfiltration, and other AI-specific risks |
| Security recommendations | Provides prioritized remediation guidance for AI security gaps |
| Multi-cloud support | Extends visibility to AWS Bedrock, GCP Vertex AI, and other cloud AI services |

### Recent Enhancements (2025-2026)

| Enhancement | Release | Description |
|-------------|---------|-------------|
| **GCP Vertex AI Support** | Public Preview (April 2025) | Defender for Cloud AI-SPM coverage for Google Cloud Vertex AI workloads. Released as Public Preview on April 29, 2025 and remains in Public Preview as of May 2026 (no Microsoft Learn or Defender for Cloud release-notes entry has announced GA since). Verify against the [Defender for Cloud AI-SPM overview](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-security-posture) and the [Defender for Cloud release notes archive](https://learn.microsoft.com/en-us/azure/defender-for-cloud/release-notes-archive) before relying on this as a sole Zone 3 control. |
| **Agent-Specific Recommendations** | January 2026 | Targeted security recommendations for Copilot Studio and Agent 365 SDK agents |
| **Attack Path Expansion** | January 2026 | New AI-specific attack path scenarios including indirect prompt injection chains |
| **Agent 365 SDK Discovery** | Preview | Blueprint-registered agent inventory and risk assessment |

### AI-SPM vs. DSPM for AI Comparison

| Feature | Defender AI-SPM | Purview DSPM for AI |
|---------|-----------------|---------------------|
| **Primary Focus** | Attack surface & vulnerabilities | Data security & compliance |
| **Scope** | Multi-cloud (Azure, AWS, GCP) | Microsoft 365 AI applications |
| **Key Capabilities** | Attack path analysis, AI BOM | Oversharing assessment, activity monitoring |
| **Discovery** | Agent inventory & infrastructure | AI interaction monitoring |
| **Risk Assessment** | Security misconfigurations | Sensitive data exposure |
| **FSI Control** | Control 1.24 | Control 1.6 |

#### AI Threat Protection Alerts (GA)

Microsoft Defender now generates specific threat alerts for AI workloads:

| Alert Type | Description |
|------------|-------------|
| **Jailbreak attempt** | Detects prompt injection attempts to bypass agent guardrails |
| **Prompt leak** | Detects attempts to extract system prompts or instructions |
| **Phishing via AI** | Detects agents being used to generate phishing content |
| **ASCII smuggling** | Detects unicode/ASCII encoding attacks in agent interactions |
| **Reconnaissance** | Detects systematic probing of agent capabilities and data access |

These alerts integrate with Microsoft Sentinel and the Defender XDR incident queue for unified security operations.

- **Copilot Studio and Foundry agent alerts (Preview):** Defender can now generate threat alerts specific to Copilot Studio and Microsoft Foundry agents, including alerts for agents discovered in the tenant that haven't been registered in the governance framework
- **Operational Shadow AI Detection (Beyond Discovery Inventory):** AI-SPM agent inventory captures *registered* agents (Copilot Studio, Foundry) inside the tenant; it does not by itself catch *operational* shadow AI such as employees using personal-account ChatGPT / Claude / Gemini from a corporate device, or third-party SaaS embedding non-tenant LLMs. For Zone 3 operational shadow-AI surface, layer:
    - **Microsoft Defender for Cloud Apps** — the **AI applications** catalog now includes risk-scored profiles for 1,000+ generative-AI SaaS endpoints; combine with the App Discovery dashboard (logs ingested from Defender for Endpoint or proxy/firewall) to see which non-sanctioned AI services users are actually reaching.
    - **Microsoft Defender for Endpoint network connection telemetry** — surfaces direct connections to common LLM API endpoints (OpenAI, Anthropic, Google AI Studio) from managed devices even when the SaaS app itself is unknown to MDCA.
    - **Microsoft Entra Tenant Restrictions v2 (TRv2)** — at the network egress layer, blocks employees from signing in to AI services with non-corporate Microsoft / Google identities; complements MDCA's *visibility* with *prevention* for the personal-tenant exfiltration vector.
    - **Microsoft Purview Insider Risk Management — "Risky AI usage" policy template** — correlates DSPM-for-AI signals with HR / data-classification context to flag users whose AI usage pattern materially deviates from peers.
  Treat AI-SPM agent inventory as the *registered* surface and the four signals above as the *operational* surface; both feed the same Sentinel / DSPM-for-AI pane for unified review.

---

## Key Configuration Points

- **Licensing prerequisite:** Defender for Cloud **Defender CSPM** plan must be enabled (Standard tier) on each Azure subscription that hosts AI workloads — AI-SPM is a Defender CSPM extension and is not available on the Foundational CSPM (free) tier
- **AI workload prerequisite:** At least one supported AI resource (Azure OpenAI, Microsoft Foundry (formerly Azure AI Foundry), Azure AI Services / Cognitive Services, Azure Machine Learning) must exist in the subscription for discovery findings to populate
- Enable the **AI security posture management** extension under Defender CSPM settings on each in-scope Azure subscription
- Configure multi-cloud connectors for AWS Bedrock and GCP Vertex AI where applicable (GCP Vertex AI support is **Public Preview** as of April 29, 2025 and remains in Public Preview as of May 2026 — see [Defender for Cloud AI-SPM overview](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-security-posture) and the [Defender for Cloud release notes archive](https://learn.microsoft.com/en-us/azure/defender-for-cloud/release-notes-archive); validate behavior in a non-production environment before relying on it as a sole control)
- Enable **Microsoft Threat Intelligence** extension on Defender CSPM (required for AI-specific attack path scenarios)
- Enable **Defender for AI Services** plan for runtime threat protection complementary to AI-SPM posture findings
- Configure **agent-specific recommendations** filter for Copilot Studio and Microsoft Foundry agents (released January 2026)
- Integrate findings with Microsoft Sentinel via the Defender for Cloud data connector for FSI SIEM correlation
- Document risk factor thresholds (critical / high / medium) and remediation SLAs aligned to zone requirements in the firm's Written Supervisory Procedures (WSPs)
- Establish a quarterly review cadence for the **AI Bill of Materials (AI BOM)** as part of model inventory attestation

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Defender CSPM + AI-SPM extension enabled where Azure AI workloads exist; monthly AI-SPM dashboard review by AI Governance Lead; agent discovery enabled; critical-severity attack paths remediated within 30 days | Baseline visibility supports OCC Bulletin 2026-13 (formerly OCC 2011-12) model inventory expectations even for personal-productivity agents |
| **Zone 2** (Team) | Zone 1 plus Defender for AI Services runtime plan enabled; weekly posture review documented in supervisory log; high-severity attack paths remediated within 14 days; critical within 7 days; multi-cloud connectors configured if any non-Azure AI workloads exist | Shared agents touch broader data; FINRA RN 24-09 / Rule 3110 expects evidence of risk-based supervisory cadence |
| **Zone 3** (Enterprise) | Zone 2 plus Sentinel integration for AI alerts (required); daily posture review by SOC; critical attack paths remediated within 72 hours; documented exception process tied to OCC Bulletin 2026-13 (formerly OCC 2011-12) model risk register; AI BOM reviewed quarterly by Model Risk Committee | Customer-facing and revenue-impacting agents require continuous monitoring and Model Risk Committee oversight |

> **Licensing note:** Defender CSPM is a paid Defender for Cloud plan billed per-resource. AI-SPM extension is included with Defender CSPM at no additional cost as of April 2026. Defender for AI Services (runtime) is a separately metered plan. Confirm pricing in Azure Portal prior to enabling at scale.

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Entra Security Admin | Enable Defender CSPM and AI-SPM extension; configure multi-cloud connectors; manage AI-related security recommendations and Defender XDR alert routing |
| Cloud Security Architect | Review attack paths, validate AI BOM accuracy against architecture-of-record, prioritize remediation, document compensating controls |
| AI Governance Lead | Align AI-SPM findings with governance framework; chair AI BOM quarterly review; maintain mapping between AI-SPM findings and the firm's model risk register |
| SOC Analyst | Triage Defender XDR alerts for AI workloads (jailbreak, prompt leak, ASCII smuggling, reconnaissance); investigate per Sentinel runbook; escalate per incident response plan |
| Model Risk Manager | Review AI-SPM findings as input to OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7) model risk assessments; track remediation evidence for regulatory examinations |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.6 - DSPM for AI](1.6-microsoft-purview-dspm-for-ai.md) | Complementary data-centric AI monitoring |
| [1.8 - Runtime Protection](1.8-runtime-protection-and-external-threat-detection.md) | Runtime threat detection for agents |
| [3.7 - PPAC Security Posture](../pillar-3-reporting/3.7-ppac-security-posture-assessment.md) | Power Platform security posture assessment |
| [3.1 - Agent Inventory](../pillar-3-reporting/3.1-agent-inventory-and-metadata-management.md) | Agent inventory management |
| [3.9 - Sentinel Integration](../pillar-3-reporting/3.9-microsoft-sentinel-integration.md) | SIEM integration for AI security events |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/1.24/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/1.24/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/1.24/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/1.24/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Defender CSPM (Standard tier) is enabled on every Azure subscription that hosts AI workloads (Azure OpenAI, AI Foundry, AI Services, Azure ML)
2. The **AI security posture management** extension is toggled on under Defender CSPM settings for each in-scope subscription
3. **AI workload discovery** is active and the AI Bill of Materials (AI BOM) lists all known AI resources; reconcile against architecture-of-record quarterly
4. **Attack path analysis** surfaces at least one expected AI-specific scenario (e.g., publicly exposed AI endpoint with sensitive data store) in test conditions, confirming the analyzer is producing AI-aware results
5. AI-specific **risk factors** (indirect prompt injection susceptibility, sensitive-data exposure) are scored on inventoried agents
6. Security recommendations for AI workloads are reviewed and remediation tracked per zone SLA (monthly Z1 / weekly Z2 / daily Z3)
7. Multi-cloud connectors (AWS, GCP) are configured and reporting where non-Azure AI workloads exist
8. Defender XDR / Sentinel receive AI-specific alert types (jailbreak attempt, prompt leak, ASCII smuggling, reconnaissance) and the SOC has a documented runbook for each
9. AI BOM and remediation evidence are exported quarterly and retained per the firm's record-retention schedule (typically 6 years for FINRA, 7 years for SOX)

---

## Additional Resources

- [Microsoft Learn: AI security posture management overview](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-security-posture)
- [Microsoft Learn: Enable AI security posture management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-onboarding)
- [Microsoft Learn: AI threat protection (Defender for AI Services)](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-threat-protection)
- [Microsoft Learn: Defender for Cloud overview](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction)
- [Microsoft Learn: Attack path analysis](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path)
- [Microsoft Learn: Defender CSPM plan options](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management)
- [Microsoft Learn: Multi-cloud security (AWS/GCP)](https://learn.microsoft.com/en-us/azure/defender-for-cloud/multicloud)
- [Microsoft Learn: Real-time agent protection during runtime (Defender for Cloud Apps)](https://learn.microsoft.com/en-us/defender-cloud-apps/real-time-agent-protection-during-runtime)
- [NIST AI Risk Management Framework 1.0](https://www.nist.gov/itl/ai-risk-management-framework)
- [OCC Bulletin 2026-13: Sound Practices for Model Risk Management (formerly OCC Bulletin 2011-12)](https://www.occ.gov/news-issuances/bulletins/2011/bulletin-2011-12.html)
- [FINRA Regulatory Notice 24-09 — Generative AI guidance (June 2024)](https://www.finra.org/rules-guidance/notices/24-09)

### FSI Scope Note

> **Power Platform Focus:** While AI-SPM provides valuable multi-cloud visibility, this framework primarily targets Power Platform and Microsoft 365 AI governance. Organizations should implement AI-SPM when:
>
> - AI agents call Azure AI services (Azure OpenAI, Cognitive Services)
> - Custom agents are built with Microsoft Foundry
> - Multi-cloud AI workloads exist alongside Copilot Studio agents
>
> For organizations exclusively using Copilot Studio without Azure AI integration, Control 1.6 (DSPM for AI) and Control 3.7 (PPAC Security Posture) may provide sufficient coverage.

!!! tip "Complement with Defender for AI Services (GA)"
    **Defender for AI Services** provides **runtime threat protection** as a complement to AI-SPM's posture management. While AI-SPM identifies misconfigurations and attack paths (proactive), Defender for AI Services detects and blocks threats during agent execution (reactive). Organizations should implement both for defense-in-depth coverage. See [Microsoft Learn: Defender for AI Services](https://learn.microsoft.com/en-us/azure/defender-for-cloud/ai-threat-protection) for details.

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
