AI security needs inventory and runtime protection

AWS is making AI security more visible: on July 14, the company announced AI Inventory in AWS Security Hub and GuardDuty AI Protection. Both address a gap that is emerging in many organizations: AI assets are being deployed faster than security teams can discover and monitor them.

What is changing

Security Hub is intended to provide an organization-wide inventory of AI assets. According to AWS, managed services such as Amazon Bedrock, Bedrock AgentCore and Amazon SageMaker are discovered through AWS Config. For self-hosted workloads, Security Hub uses SBOM analysis from Amazon Inspector, among other signals, to identify inference endpoints, models and agents on EC2 instances or in ECR images. GuardDuty DNS telemetry can also make calls to external AI APIs visible.

GuardDuty AI Protection adds runtime signals to that view. AWS mentions anomalous model invocations, cost-harvesting attacks and prompt injection attempts, including through integration with Amazon Bedrock Guardrails. Findings flow into Security Hub, so inventory, threats and misconfigurations do not have to be assessed separately.

Why this matters

The announcement fits a broader security pattern. OWASP lists prompt injection as a core LLM risk. A recent arXiv paper on “Stealthy Memory Injection” shows how untrusted content can be written into persistent agent memory and later act as apparently trusted state. Research findings do not automatically describe every production environment, but the direction is clear: agents need more than better prompts. They need inventory, telemetry and response processes.

DACH perspective

For organizations in German-speaking markets, AI security is becoming operational. The key question is not only whether a model runs in an approved region. It is which models, agents, endpoints and external APIs are actually used, which data they touch and which findings are prioritized.

A pragmatic starting point is an AI asset register with owner, data class, operating location, cost center, permitted tools and incident path. Security teams should then check whether existing SIEM, CSPM and IAM processes already cover AI workloads — or whether production agents still run outside the control layers the organization relies on for the rest of its cloud estate.