A data scientist spins up a SageMaker endpoint to test a model.
It's public by default, the notebook has a full-admin execution role attached, and training data is being pulled from a bucket the security team has never seen. Multiply that by every experimental model in your organisation. Traditional CSPM doesn't have a rule for it — AI security is the shadow IT nobody is watching.
The risk of not knowing
If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.
The mechanism, not the marketing
- 1
Onam enumerates AI-specific resources — SageMaker endpoints, notebooks, training jobs, Bedrock invocations, model artifacts — via read-only APIs.
- 2
Each resource is evaluated against AI-native rules that cover network isolation, IAM scope on execution roles, encryption of artifacts, and logging of inference and training events.
- 3
On AWS, AI services that show up in your cloud audit logs but are missing from the inventory are flagged as shadow AI.
- 4
Findings integrate with the identity, network, and data engines, so an over-permissive endpoint reachable from the internet ranks alongside the equivalent web-app risk.
- 5
Each finding is tagged with MITRE ATLAS, the public catalogue of known attacks on AI systems. Onam checks configuration — it does not read prompts or attack-test models.
Specific outputs, measurable outcomes
AI Security in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
Ready to see AI Security in your cloud?
Connect a read-only role in three minutes. Your first findings surface in under five.