AI Security Posture Management (AI-SPM)

Get full visibility into deployed AI models and protect against data tampering and leakage.

AI Deployments Rapidly Introduce Cloud Security Risks

AI presents a myriad of business benefits. Yet without the right AI security in place, organizations face new cloud risks, some familiar, and some unique to AI models. Siloed AI-SPM products only multiply the existing challenges facing security teams—alert fatigue, blind spots, and inability to see the bigger picture—while leaving organizations exposed to critical risks.

1. Security teams don’t know which AI models are in use and aren’t able to discover shadow AI.
2. Misconfigured public access settings, exposed keys, and unencrypted data can cause model theft.
3. If sensitive data is (accidentally) included in training data, this can cause AI models to expose sensitive data and PII.

Complete End-to-End AI-SPM with 100% Visibility

Orca’s AI-SPM leverages our patented, agentless SideScanning™ technology to provide the same visibility, risk insight, and deep data for AI models that it does for other cloud resources, while also addressing unique AI use cases. Orca’s AISPM solution covers 50+ AI models and software packages, allowing you to confidently adopt AI tools while maintaining visibility and security for your entire tech stack—no point solutions needed.

Complete AI and ML inventory and bill of materials (BOM)

Orca gives you a complete view of all AI models that are deployed in your environment—both managed and unmanaged, including any shadow AI.

Address AI misconfigurations

Orca ensures that AI models are configured securely, covering network security, data protection, access controls, and IAM.

Detect sensitive data

Orca alerts if any AI models or training data contain sensitive information so you can take appropriate action to prevent unintended exposure.

Discover exposed access keys

Orca detects when keys and tokens to AI services and software packages are unsafely exposed in code repositories.

Get full visibility into your deployed AI projects

Much like other resources in the cloud, shadow AI and LLMs are a major security concern. Orca continuously scans your entire cloud environment and detects all deployed AI models, keeping security teams in the know about every AI project, whether it contains sensitive data, and whether it’s secure.

• Get a complete AI inventory and BOM for every AI model deployed in your cloud, giving you visibility into any shadow AI.
• Orca covers the major cloud provider AI services, such as Azure OpenAI, Amazon Bedrock & Sagemaker, and Google Vertex AI.
• Orca also inventories the 50+ most commonly used AI software packages, including Pytorch, TensorFlow, OpenAI, Hugging Face, scikit-learn, and many more.

Leverage AI Posture Management (AI-SPM)

Orca’s AISPM alerts when AI models are at risk from misconfigurations, overprivileged permissions, Internet exposure, and more, and provides automated and guided remediation to quickly fix any issues.

• Orca’s compliance framework for AI best practices includes dozens of rules for proper upkeep of AI models, network security, data protection, access controls, IAM, and more.
• Protect against data leakage and data poisoning risk from AI models and training data.

Detect sensitive data in AI models and training data

Orca uses Data Security Posture Management (DSPM) capabilities to scan and classify the data stored in AI projects, and alerts if any sensitive data is found. By informing security teams where sensitive data is located, they can make sure that it is removed since AI models can be manipulated into “pouring” their training data.

• Orca scans and classifies all the data stored in AI projects, as well as data used to train or fine-tune AI models.
• Receive an alert when sensitive data is found, such as telephone numbers, email addresses, social security numbers, or personal health information. 
• Ensure that your AI models are fully compliant with regulatory frameworks and CIS benchmarks.

Detect exposed AI access keys to prevent tampering

Orca detects when AI keys and tokens are left in code repositories, and sends out alerts so security teams can swiftly remove the keys and limit any damage.

• Orca scans your code repositories (such as GitHub and GitLab), finding any leakage of AI access keys – such as tokens to OpenAI, Hugging Face.
• Leaked access keys could grant bad actors access to AI models and their training data, allowing them to make API requests, tamper with the AI model, and exfiltrate data.