This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Post Deployment

Continuously monitoring deployed AI applications, managing vulnerabilities, auditing autonomous agents, and supporting secure AI-assisted remediation.

Continuous AI Security Monitoring and Controlled Remediation

Security does not stop when an AI-enabled application reaches production. New vulnerabilities are discovered, AI models and dependencies change, autonomous agents interact with external systems, and emerging threats can affect applications long after their initial deployment.

Phase 3: Post Deploy focuses on maintaining continuous security visibility into deployed AI applications, models, agents, and their supporting software components.

This phase extends traditional vulnerability management and runtime security practices to address AI-specific threats, including prompt injection, unauthorized agent activity, sensitive information disclosure, model compromise, and unsafe automated actions.

It also explores how artificial intelligence can support vulnerability analysis and remediation while maintaining independent validation, human oversight, and auditable security controls.

The objective is to ensure that deployed AI-enabled software remains secure throughout its operational lifecycle.

Why AI Security Must Continue After Deployment

Traditional post-deployment security activities focus on monitoring applications, identifying vulnerabilities, detecting suspicious behavior, and applying security updates.

AI-enabled applications introduce additional challenges:

  • Changing AI Threats: Newly discovered attack techniques can affect deployed AI applications without requiring changes to their underlying source code.
  • Autonomous Agent Activity: AI agents may execute commands, access APIs, modify resources, or interact with external systems during production operations.
  • Model and Dependency Vulnerabilities: Deployed AI services depend on models, frameworks, libraries, containers, and supporting infrastructure that may develop new security exposures.
  • Prompt Injection and Data Exposure: Malicious inputs and untrusted external content can manipulate model behavior or expose sensitive information.
  • Limited Deployment Visibility: Organizations may lack an accurate inventory of which AI models, prompts, dependencies, and configurations are running in production.
  • AI-Assisted Remediation Risks: AI-generated security fixes may introduce compatibility issues, unintended changes, or new vulnerabilities if applied without validation.

Addressing these challenges requires continuous security monitoring, accurate deployed asset inventories, and controlled remediation workflows.

Phase 3: Post Deployment Outcomes

By implementing these practices, DevOps and security teams establish continuous security oversight for deployed AI-enabled software.

Expected outcomes include:

  • Deployed AI applications are monitored for suspicious behavior, unauthorized access, and emerging threats.
  • AI agents operate with observable and auditable execution histories.
  • Newly disclosed software vulnerabilities are correlated with affected production applications and dependencies.
  • AI-specific behavioral risks are assessed alongside traditional software vulnerabilities.
  • AI-assisted remediation changes are independently tested and approved before release.
  • Compromised models, agents, and applications can be isolated, rolled back, or recovered.
  • Security evidence supports incident investigation, vulnerability management, and compliance assessments.
  • Production security findings provide feedback into earlier CI/CD security activities.

These outcomes support a continuous security model in which monitoring, vulnerability identification, remediation, and verification extend throughout the operational lifecycle.

The following frameworks provide guidance relevant to Phase 3 AI security activities.

Framework Relevant Guidance
NIST SP 800-218 – Secure Software Development Framework Vulnerability identification, remediation, root cause analysis, and improvements to secure development practices.
NIST SP 800-218A – AI SSDF Profile AI-specific secure development and vulnerability management considerations across the AI lifecycle.
NIST AI Risk Management Framework Monitoring, measurement, governance, and ongoing management of AI-related risks.
OWASP Top 10 for LLM Applications AI security risks including prompt injection, sensitive information disclosure, improper output handling, excessive agency, and model-related threats.
NIST Cybersecurity Framework 2.0 Continuous cybersecurity risk management, detection, response, and recovery activities.
NIST SP 800-61 – Incident Response Incident response planning, detection, analysis, containment, and recovery.
OpenSSF Open-source software supply chain security, vulnerability management, and secure development practices.

These frameworks provide guidance for implementing and managing AI security controls. They do not all establish mandatory regulatory compliance requirements.

Integrating AI Security into the CI/CD Pipeline

AI security controls should be incorporated into existing CI/CD automation rather than implemented as disconnected manual processes.

This section will cover a typical AI-enabled software delivery workflow to include:

1 - AI Runtime Security Monitoring

Continuously monitoring deployed AI applications for prompt injection, sensitive information exposure, suspicious model behavior, and runtime security threats.

AI Runtime Security Monitoring - Phase 3: Post Deploy

Artificial intelligence applications introduce runtime behaviors that traditional application security monitoring may not fully capture. Large language models (LLMs), retrieval-augmented generation (RAG) systems, and autonomous agents interact with users, external data sources, APIs, and supporting services in ways that can create additional security risks.

These risks include prompt injection, sensitive information disclosure, unauthorized tool execution, model manipulation, and resource abuse.

During Post Deploy, organizations should continuously monitor AI applications to identify suspicious activity, detect security policy violations, and respond to emerging threats.

This activity extends established runtime security monitoring practices to include AI-specific behavior, model interactions, and application security events.

AI Runtime Security Monitoring

Objective: Detect and investigate suspicious AI application behavior, unauthorized access, prompt injection attempts, sensitive information exposure, and runtime security policy violations.

The NIST AI Risk Management Framework emphasizes ongoing measurement, monitoring, and management of risks associated with AI systems.

The NIST Cybersecurity Framework 2.0 provides guidance for identifying, detecting, responding to, and recovering from cybersecurity threats.

The OWASP Top 10 for LLM Applications identifies AI-specific threats including prompt injection, sensitive information disclosure, excessive agency, and unbounded consumption.

For DevOps teams, runtime monitoring should combine application telemetry, infrastructure security events, AI interaction traces, and independently enforced security policies.

Monitoring should collect sufficient information to investigate suspicious behavior while protecting confidential prompts, user information, credentials, and sensitive model outputs.

AI-generated explanations of suspicious activity should not replace independently collected security evidence.

AI Security Requirements and Open-Source Tooling

Framework Reference Security Activity CI/CD Implementation Suggested Open-Source Tools
NIST AI RMF MEASURE, MANAGE AI application runtime observability Collect application traces, metrics, errors, and AI interaction telemetry to establish operational and security baselines. OpenTelemetry, Prometheus
OWASP LLM01 Prompt injection monitoring Monitor suspicious input patterns and use security evaluations to investigate potential prompt injection attempts. Promptfoo, Garak
OWASP LLM02 Sensitive information exposure detection Detect potentially exposed sensitive information in appropriately authorized and protected application telemetry. Microsoft Presidio, OpenTelemetry
OWASP LLM05, LLM06 Suspicious tool execution Detect unexpected commands, process execution, and unauthorized operations initiated by AI-enabled applications. Falco, Tetragon
OWASP LLM10 Resource abuse monitoring Monitor inference request rates, resource consumption, service latency, and abnormal usage patterns. Prometheus, Grafana
NIST CSF DE.CM Continuous infrastructure monitoring Monitor containers, Kubernetes workloads, and supporting AI application infrastructure for suspicious activity. Falco, Wazuh
NIST CSF DE.AE Security event correlation Correlate AI application events with infrastructure logs, authentication records, and security alerts. OpenSearch, Wazuh
NIST AI RMF MANAGE Runtime policy enforcement Enforce defined access, network, and execution policies independently of model-generated instructions. Open Policy Agent, Kyverno
NIST CSF DE.CM, RS.AN Security investigation and evidence Preserve security-relevant telemetry and records needed to investigate suspected AI incidents. OpenTelemetry, OpenSearch

Observability tools collect and analyze runtime information but do not automatically detect every AI-specific attack. Prompt injection testing tools primarily support security evaluations and require additional integration for continuous monitoring.

Expected Security Evidence

  • AI application runtime monitoring configurations.
  • AI service traces, metrics, and security event records.
  • Records of detected suspicious input or application behavior.
  • Unauthorized tool execution and access violation alerts.
  • Sensitive information exposure detection results.
  • Resource usage and abnormal consumption monitoring reports.
  • Infrastructure and container runtime security findings.
  • Correlated application and security event records.
  • Security incident investigation records.
  • Runtime policy enforcement and alert response evidence.

These artifacts demonstrate that deployed AI applications are subject to continuous security monitoring and that security-relevant events can be investigated.

Monitoring findings should feed into vulnerability management, incident response, and the security requirements applied during earlier CI/CD phases.

Additional Resources

2 - Continuous AI Vulnerability Management

Identifying vulnerabilities in deployed AI applications, correlating vulnerable dependencies with production environments, and managing AI-specific behavioral security risks.

Continuous AI Vulnerability Management - Phase 3: Post Deploy

AI-enabled applications depend on software frameworks, model-serving infrastructure, libraries, containers, APIs, and supporting services that may become vulnerable after deployment.

A software component that passes security testing during development may later be affected by a newly disclosed Common Vulnerabilities and Exposures (CVE) record.

Traditional pre-deployment scanning cannot detect vulnerabilities that become known after software has already been released.

AI applications also introduce behavioral security risks, including prompt injection, excessive agent permissions, sensitive information disclosure, and manipulation of model outputs. These weaknesses may not have CVE identifiers and cannot always be addressed through traditional software patching.

During Post Deploy, organizations should continuously monitor both newly disclosed software vulnerabilities and AI-specific behavioral security risks.

This activity focuses on maintaining deployed software visibility, identifying affected environments, assessing AI-specific threats, prioritizing remediation, and verifying that corrective actions reach affected production systems.

Continuous AI Vulnerability Management

Objective: Continuously identify, assess, prioritize, and remediate software vulnerabilities and AI-specific behavioral security weaknesses affecting deployed AI applications, dependencies, agents, and supporting infrastructure.

The NIST Secure Software Development Framework (SSDF) establishes practices for identifying vulnerabilities in released software, assessing their impact, and implementing appropriate responses.

The NIST AI SSDF Profile (SP 800-218A) extends secure development guidance to address AI model development and integration.

The NIST Cybersecurity Framework 2.0 provides guidance for identifying technology assets, managing vulnerabilities, assessing risks, and implementing appropriate responses.

The NIST AI Risk Management Framework provides guidance for identifying, measuring, monitoring, and managing risks associated with AI systems.

The OWASP Top 10 for LLM Applications identifies AI-specific security risks, including prompt injection, sensitive information disclosure, improper output handling, and excessive agency.

For DevOps teams, continuous AI security requires two complementary practices:

  1. Software Vulnerability Management: Identify known software vulnerabilities, correlate findings with deployed components, and verify remediation.
  2. AI Behavioral Risk Management: Identify and mitigate AI-specific weaknesses through adversarial testing, runtime monitoring, access controls, and application security improvements.

These practices should share application inventory, ownership, and deployment information while maintaining distinct methods for assessing and remediating security findings.

Software Vulnerability Management - NIST SSDF

Software vulnerability management focuses on identifying, assessing, and remediating known vulnerabilities in deployed software components, including AI frameworks, libraries, containers, model-serving infrastructure, and supporting services.

NIST SSDF practices RV.1 and RV.2 establish processes for identifying and responding to vulnerabilities in released software.

For DevOps teams, vulnerability management must extend beyond creating Software Bills of Materials (SBOMs) and scanning release artifacts.

SBOM information should be associated with application versions and deployment metadata so teams can identify which vulnerable components are actually running, where they are deployed, and who is responsible for remediation.

Continuous monitoring of vulnerability intelligence sources enables organizations to identify vulnerabilities disclosed after deployment and determine their potential impact on production applications.

Remediation should be prioritized based on severity, known exploitation, exposure, affected production systems, and operational risk.

Software Vulnerability Management Requirements and Open-Source Tooling

Framework Reference Security Activity CI/CD Implementation Suggested Open-Source Tools
NIST SSDF PS.3; NIST CSF ID.AM Deployed AI component inventory Maintain records of deployed applications, AI frameworks, model-serving components, software packages, and supporting dependencies. Syft, CycloneDX
NIST SSDF RV.1 Continuous vulnerability intelligence Monitor vulnerability databases for newly disclosed vulnerabilities affecting deployed software components. OSV, OSV-Scanner
NIST SSDF RV.1; NIST CSF ID.RA Deployed vulnerability correlation Associate vulnerability findings with SBOM components, application releases, and deployment records to identify affected environments. Ortelius, GUAC
NIST SSDF RV.1 Container and dependency vulnerability assessment Reassess container images and application dependencies against updated vulnerability intelligence. Trivy, Grype
NIST CSF ID.RA Vulnerability prioritization Prioritize vulnerabilities based on severity, known exploitation, exposure, and affected production assets. OSV, DefectDojo
NIST SSDF PS.3, RV.1 Affected application identification Trace vulnerable components to associated software artifacts, deployments, and application ownership records. Ortelius, GUAC
NIST SSDF RV.2 Remediation tracking Record vulnerability ownership, remediation decisions, affected releases, and outstanding corrective actions. DefectDojo, Gitea
NIST SSDF RV.2 Remediation verification Rescan affected software and confirm that patched components have reached the relevant deployment environments. Trivy, Ortelius

Vulnerability discovery, software supply chain correlation, and deployment inventory are complementary capabilities. An SBOM scanner identifies software components and may detect known vulnerabilities, while deployment correlation is needed to determine which applications and environments are affected.

Software Vulnerability Management - Expected Security Evidence

  • Inventory of deployed AI applications and supporting software components.
  • SBOMs associated with released application versions.
  • Deployment records identifying environments and affected assets.
  • Newly disclosed CVE detection records.
  • Correlations between vulnerable packages and deployed applications.
  • Vulnerability severity, exploitability, and exposure assessments.
  • Documented vulnerability ownership and prioritization decisions.
  • Remediation tracking records and assigned corrective actions.
  • Post-remediation vulnerability scanning results.
  • Evidence confirming deployment of corrected software versions.

These artifacts provide evidence that software vulnerability management continues after deployment and that newly disclosed vulnerabilities can be associated with affected production systems.

Vulnerability findings should initiate appropriate remediation workflows, including the AI-assisted remediation activities described in this phase.

AI Behavioral Risk Management - OWASP and NIST AI RMF

AI-enabled applications introduce behavioral security weaknesses that may not be associated with a known CVE or vulnerable software package. These weaknesses arise from how AI systems process instructions, interact with external content, access tools, and make decisions.

Examples include prompt injection, excessive agency, sensitive information disclosure, unsafe output handling, and manipulation of retrieved information.

Unlike traditional software vulnerabilities, these issues may require changes to application architecture, trust boundaries, authorization policies, model configurations, prompts, or agent permissions rather than dependency upgrades.The OWASP Top 10 for LLM Applications identifies common AI-specific security risks, while the NIST AI Risk Management Framework provides guidance for assessing, monitoring, and managing AI risks throughout the operational lifecycle.

For DevOps teams, AI behavioral risk management should be integrated into continuous security testing, runtime monitoring, application configuration management, and incident response processes. Security findings should be associated with affected AI applications, model versions, agent configurations, and deployed environments whenever possible.

AI Behavioral Risk Management Requirements and Open-Source Tooling

Framework Reference Security Activity CI/CD Implementation Suggested Open-Source Tools
OWASP LLM01; NIST AI RMF MEASURE Prompt injection risk assessment Test and monitor AI applications for malicious instructions delivered through user prompts, retrieved documents, tool outputs, or external content. Promptfoo, Garak
OWASP LLM02; NIST AI RMF MEASURE Sensitive information disclosure Evaluate whether AI application outputs or interactions expose confidential information, credentials, or protected data. Microsoft Presidio, Promptfoo
OWASP LLM05 Unsafe output handling Test whether AI-generated outputs can trigger unauthorized commands, injection attacks, or unsafe downstream operations. Semgrep, OWASP ZAP
OWASP LLM06; NIST AI RMF MANAGE Excessive agency and agent permissions Evaluate agent permissions, tool access, and autonomous actions to prevent operations beyond approved authorization boundaries. Open Policy Agent, Promptfoo
OWASP LLM08; NIST AI RMF MEASURE Retrieval and vector security Assess unauthorized retrieval, malicious document injection, and manipulation of external information used by AI applications. Promptfoo, Garak
NIST AI RMF MEASURE, MANAGE Continuous AI security evaluation Execute repeatable adversarial evaluations and reassess AI application security following changes to models, prompts, tools, or external dependencies. Inspect AI, Promptfoo
NIST AI RMF MANAGE; NIST CSF DE.CM AI runtime security monitoring Collect application telemetry, monitor abnormal agent behavior, and correlate AI security events with supporting infrastructure activity. OpenTelemetry, Falco
NIST AI RMF MANAGE AI behavioral risk tracking Record identified weaknesses, affected AI components, mitigation decisions, and unresolved security risks. DefectDojo, Gitea

OWASP identifies AI application security risk categories, while NIST AI RMF provides processes for managing AI risks. The suggested controls and tools are implementation examples rather than mandatory requirements specified by these frameworks.

AI Behavioral Risk Management - Expected Security Evidence

  • AI application threat models and behavioral risk assessments.
  • Prompt injection testing and evaluation results.
  • Sensitive information disclosure assessments.
  • Agent permission and authorization validation records.
  • Security testing results for retrieval and external tool integrations.
  • AI model and application evaluation reports.
  • Runtime monitoring and security event records.
  • Documented AI behavioral weaknesses and affected applications.
  • AI security risk ownership and prioritization decisions.
  • Mitigation plans and security configuration changes.
  • Post-mitigation security testing and validation results.
  • Records of accepted, unresolved, or escalated AI security risks.

These artifacts provide evidence that AI-specific behavioral security risks are being assessed and managed throughout the operational lifecycle. Because AI behavior may vary with model versions, prompts, retrieved content, and external integrations, security evaluations should be repeated when significant changes occur.

Coordinating Software Vulnerabilities and AI Behavioral Risks

Software vulnerability management and AI behavioral risk management should operate as complementary security processes. A deployed AI application may contain vulnerable software dependencies while also exhibiting unsafe behavior caused by excessive agent permissions, prompt injection, or insecure application design.

Both categories of findings should be linked to the affected applications and deployment environments, but their detection and remediation requirements may differ.

Security Consideration Software Vulnerability Management AI Behavioral Risk Management
Primary Guidance NIST SSDF OWASP LLM Top 10, NIST AI RMF
Security Findings CVEs, vulnerable dependencies, software weaknesses Prompt injection, excessive agency, data exposure, unsafe model interactions
Detection Methods Vulnerability intelligence, SCA, SBOM analysis, artifact scanning Adversarial testing, behavioral evaluation, runtime monitoring
Affected Assets Software packages, containers, frameworks, infrastructure Models, prompts, agents, retrieval systems, application configurations
Typical Corrective Actions Dependency upgrades, patches, configuration updates Access control changes, application fixes, prompt changes, additional security boundaries
Validation Rescanning, regression testing, deployment verification Security reevaluation, adversarial testing, policy validation
Evidence CVE records, SBOMs, patch records, deployment history Evaluation results, agent logs, policy changes, behavioral risk assessments

For DevOps and platform engineering teams, maintaining a connection between these security processes improves visibility into the complete security posture of deployed AI applications.

A common application inventory, ownership model, and deployment record can help correlate findings while preserving the distinct evaluation and remediation workflows required for each risk category.

Additional Resources

3 - AI Agent Activity Monitoring

Monitoring autonomous AI agents for unauthorized tool execution, excessive permissions, suspicious actions, and security policy violations.

AI Agent Activity Monitoring - Phase 3: Post Deploy

Autonomous AI agents introduce security risks because they can execute actions rather than simply generate responses. Production agents may interact with APIs, access databases, execute commands, modify files, invoke external tools, and communicate with other agents. These capabilities create security concerns when agents perform unauthorized actions, exceed assigned permissions, expose sensitive information, or respond to manipulated instructions.

During Post Deploy, organizations should continuously monitor AI agent activity to detect suspicious behavior, enforce authorization boundaries, and maintain auditable records of agent operations.

This activity focuses on establishing visibility into agent identities, tool calls, permissions, execution history, and security-sensitive actions.

AI Agent Activity Monitoring

Objective: Ensure autonomous AI agent activity is observable, attributable, and auditable, with controls capable of detecting unauthorized actions, excessive permissions, and security policy violations.

The NIST AI Risk Management Framework provides guidance for monitoring and managing AI-related risks throughout system operation.

The NIST Cybersecurity Framework 2.0 establishes practices for monitoring systems, detecting suspicious activity, and managing access-related security risks.

The OWASP Top 10 for LLM Applications identifies excessive agency as a security risk when AI systems have unnecessary functionality, permissions, or autonomy.

For DevOps teams, autonomous agents should be monitored similarly to other privileged automated services, with additional visibility into model-directed tool selection and execution.

Security controls should record which agent initiated an action, what resource was accessed, which tool was invoked, and whether the action was authorized.

Agent-generated explanations should not replace independent audit logs, access control records, and execution telemetry.

AI Security Requirements and Open-Source Tooling

Framework Reference Security Activity CI/CD Implementation Suggested Open-Source Tools
NIST AI RMF MEASURE, MANAGE Agent activity observability Collect traces and events associated with agent execution, model requests, and external tool interactions. OpenTelemetry, Jaeger
NIST CSF PR.AA; OWASP LLM06 Agent identity and access monitoring Monitor authentication, authorization decisions, and access to protected resources. Keycloak, Open Policy Agent
OWASP LLM06 Agent tool execution monitoring Record tool calls and identify unauthorized commands, API operations, or unexpected resource modifications. OpenTelemetry, Falco
OWASP LLM01, LLM06 Agent instruction manipulation detection Investigate suspicious agent actions associated with untrusted inputs, retrieved content, or manipulated instructions. Promptfoo, Garak
NIST CSF DE.CM Suspicious process execution detection Monitor agent workloads for unexpected process execution, privilege escalation, and system activity. Falco, Tetragon
NIST CSF PR.AA Agent authorization policy enforcement Evaluate permissions independently of AI-generated instructions and deny unauthorized operations. Open Policy Agent, Casbin
NIST CSF DE.AE Agent activity correlation Correlate agent execution records with application logs, authentication events, and infrastructure security findings. OpenSearch, Wazuh
NIST CSF RS.MI Agent containment Support suspension of compromised agent workloads and revocation of affected credentials. Kubernetes, Keycloak
NIST AI RMF MANAGE Agent activity auditing Retain records of security-sensitive actions, tool execution results, and authorization decisions for investigation. OpenTelemetry, OpenSearch

Agent observability and authorization are separate controls. Monitoring records what an agent attempted or performed, while trusted authorization systems must independently determine which actions are permitted.

Expected Security Evidence

  • Inventory of active AI agents and assigned identities.
  • Agent authentication and authorization records.
  • Agent tool invocation and execution logs.
  • Records of access to protected APIs and services.
  • Alerts identifying unauthorized or suspicious agent actions.
  • Agent permission and policy enforcement results.
  • Runtime process execution and infrastructure security events.
  • Correlated agent activity and application security records.
  • Records of suspended agents and revoked credentials.
  • Security investigation and remediation records.
  • Audit trails linking agent actions to initiating requests and execution contexts.

These artifacts demonstrate that autonomous AI agents operate under monitored and enforceable security controls.

Agent monitoring should support timely investigation of unauthorized operations while retaining sufficient evidence to establish which actions occurred and what systems were affected.

Additional Resources

4 - AI-Assisted Vulnerability Remediation

Using AI to analyze vulnerabilities, recommend dependency upgrades, generate validated remediation changes, and support secure CI/CD remediation workflows.

AI-Assisted Vulnerability Remediation - Phase 3: Post Deploy

Traditional vulnerability management tools identify vulnerable software packages and report security findings, but correcting those vulnerabilities frequently requires manual investigation, dependency analysis, code modifications, compatibility testing, and deployment coordination.

AI-assisted remediation introduces opportunities to reduce this effort by analyzing vulnerability information, identifying candidate fixes, and generating proposed software changes.

However, AI-generated remediation may introduce breaking changes, dependency conflicts, functional regressions, or new vulnerabilities.

During Post Deploy, organizations should integrate AI-assisted remediation into controlled CI/CD workflows that independently validate proposed changes before they are accepted or deployed.

This activity focuses on connecting deployed vulnerability detection with AI-assisted analysis, remediation preparation, automated validation, and authorized software delivery.

AI-Assisted Vulnerability Remediation

Objective: Accelerate vulnerability remediation through AI-assisted analysis and code generation while ensuring that proposed fixes are independently tested, reviewed, and authorized before deployment.

The NIST Secure Software Development Framework (SSDF) establishes practices for identifying and addressing vulnerabilities in released software.

The NIST AI SSDF Profile (SP 800-218A) extends secure development guidance to AI-related systems and development practices.

The NIST Cybersecurity Framework 2.0 provides guidance for managing cybersecurity risks and implementing appropriate corrective actions.

For DevOps teams, AI-assisted remediation should begin with an identified vulnerability and sufficient information about affected software components, dependency relationships, and deployment environments.

AI may analyze the vulnerability and prepare candidate updates, but independent tools and authorized reviewers should determine whether the proposed changes are acceptable.

Remediation workflows should not allow AI agents to bypass testing, change approval, or production deployment controls.

AI Security Requirements and Open-Source Tooling

Framework Reference Security Activity CI/CD Implementation Suggested Open-Source Tools
NIST SSDF RV.1 Vulnerability identification Detect newly disclosed vulnerabilities affecting application packages and deployed software components. OSV, Trivy
NIST SSDF RV.1; NIST CSF ID.RA Affected deployment identification Correlate vulnerable packages with application artifacts and deployment records to identify affected environments. Ortelius, GUAC
NIST SSDF RV.2 AI-assisted remediation analysis Provide vulnerability details and dependency information to an approved AI workflow for candidate remediation analysis. Aider, OpenHands
NIST SSDF RV.2 Dependency upgrade preparation Identify candidate patched versions and prepare dependency manifest or source code changes for review. Renovate, Aider
NIST SSDF PW.7, PW.8 Independent remediation validation Validate proposed fixes through builds, automated tests, static analysis, and dependency vulnerability scanning. Jenkins, Semgrep, Trivy
NIST SSDF RV.2 Unsafe remediation detection Block proposed changes that introduce failing tests, incompatible dependencies, or unacceptable security risks. Jenkins, Open Policy Agent
NIST SSDF RV.2 Unresolved vulnerability tracking Generate tracked issues when no compatible remediation is available or further investigation is required. Gitea, DefectDojo
NIST SSDF PO.1, PW.7 Remediation authorization Require appropriate review and approval before AI-generated remediation changes are merged or released. Gitea, Open Policy Agent
NIST SSDF RV.2 Post-deployment remediation verification Rescan affected components and verify that corrected versions are deployed to the intended environments. Trivy, Ortelius
NIST SSDF RV.3 Remediation effectiveness analysis Record root causes, validation outcomes, and lessons learned to improve future vulnerability prevention and remediation. DefectDojo, Gitea

The listed AI development tools can assist with code changes, but they do not independently provide a complete vulnerability remediation system. Organizations must integrate vulnerability intelligence, dependency analysis, testing, authorization, and deployment verification.

Controlled AI Remediation Workflow

AI-assisted remediation should distinguish three possible outcomes:

1. Safe Dependency Upgrade

A vulnerability has a known patched version that is compatible with the application.

The AI proposes an update, and independent build, security, and regression tests confirm the change satisfies release requirements.

The proposed fix is submitted for review and authorization before deployment.

2. Unsafe Dependency Upgrade

A patched version is available, but upgrading introduces breaking changes, dependency conflicts, or failed tests.

The proposed change is blocked or revised. The workflow records the failure and may generate a tracked issue for further investigation.

3. Ambiguous or Unresolved Vulnerability

A vulnerability cannot be safely corrected because the available evidence is insufficient, a compatible patch does not exist, or the remediation risk is unacceptable.

The workflow preserves the vulnerability finding, documents the available alternatives, and creates an issue for human investigation.

These outcomes ensure AI-assisted remediation produces auditable decisions rather than uncontrolled changes to production software.

Expected Security Evidence

  • Original vulnerability findings and identifiers.
  • Records identifying affected packages, applications, and deployments.
  • AI-generated vulnerability analysis and candidate remediation recommendations.
  • Proposed dependency changes and source code modifications.
  • Dependency compatibility analysis results.
  • Build, security scanning, and regression testing results.
  • Records of rejected or unsuccessful remediation attempts.
  • Pull requests containing validated remediation changes.
  • Issues documenting unresolved vulnerabilities.
  • Human review and approval records.
  • Release and deployment records for corrected software.
  • Post-deployment verification showing remediation status.
  • Records of AI recommendations and independent validation outcomes.

These artifacts provide evidence that AI-assisted vulnerability remediation follows controlled software development and deployment practices.

The objective is to reduce the time required to investigate and prepare vulnerability corrections without weakening security validation or production change authorization.

Additional Resources

5 - AI Incident Response and Recovery

Detecting, investigating, containing, and recovering from AI-related cybersecurity incidents involving models, agents, prompts, and supporting infrastructure.

AI Incident Response and Recovery - Phase 3: Post Deploy

AI-enabled applications introduce security incident scenarios that may differ from traditional application and infrastructure compromises.

Incidents can involve prompt injection, unauthorized agent execution, compromised model artifacts, manipulated retrieval content, sensitive information exposure, or abuse of external tools and services.

These incidents may affect application behavior even when the underlying software binaries remain unchanged.

During Post Deploy, organizations should extend established cybersecurity incident response procedures to include AI-specific threats, affected assets, and recovery requirements.

This activity focuses on detecting and investigating AI security incidents, containing affected systems, preserving evidence, restoring trusted configurations, and incorporating lessons learned into CI/CD security practices.

AI Incident Response and Recovery

Objective: Establish repeatable processes for detecting, investigating, containing, recovering from, and documenting AI-related security incidents while preserving reliable security evidence and preventing recurrence.

The NIST Cybersecurity Framework 2.0 establishes a lifecycle approach to cybersecurity risk management, including detection, response, and recovery.

NIST SP 800-61 Rev. 3 provides incident response recommendations aligned with the NIST Cybersecurity Framework.

The NIST AI Risk Management Framework provides guidance for measuring and managing risks associated with AI systems.

For DevOps teams, incident response should incorporate AI application telemetry, agent execution records, model and configuration inventories, deployment evidence, and software dependency information.

Security teams should be able to identify which AI components were involved, which actions occurred, which resources were affected, and whether the incident involved compromised software, manipulated model behavior, or unauthorized agent activity.

Recovery must restore both trusted software artifacts and approved AI configurations, permissions, models, and data sources.

AI Security Requirements and Open-Source Tooling

Framework Reference Security Activity CI/CD Implementation Suggested Open-Source Tools
NIST CSF DE.CM, DE.AE AI security incident detection Detect suspicious model interactions, unexpected agent execution, unauthorized access, and infrastructure security events. Falco, Wazuh
NIST CSF RS.AN AI incident investigation Correlate AI application telemetry, agent tool calls, authentication records, and infrastructure logs. OpenSearch, OpenTelemetry
NIST CSF ID.AM, RS.AN Affected AI asset identification Identify affected models, software dependencies, application releases, configurations, and deployed environments. Ortelius, GUAC
NIST CSF RS.AN Security evidence preservation Preserve relevant execution logs, security events, deployment records, and model artifact identifiers for investigation. OpenSearch, Velociraptor
NIST CSF RS.MI Agent and workload containment Isolate compromised workloads, suspend agent execution, and restrict access to affected services. Kubernetes, Cilium
NIST CSF PR.AA, RS.MI Credential and permission revocation Revoke affected identities, rotate credentials, and restrict compromised agent permissions. Keycloak, Open Policy Agent
NIST CSF RC.RP Trusted artifact recovery Restore approved application versions, container images, models, prompts, and deployment configurations. Argo CD, Flux
NIST CSF RC.RP Recovery validation Execute security and functional validation before restoring affected AI services to production. Jenkins, Promptfoo
NIST CSF RS.MA, RS.AN Incident coordination and tracking Maintain incident records, assign investigation responsibilities, and document response actions. DFIR-IRIS, Gitea
NIST CSF ID.IM Continuous security improvement Convert incident findings into development security requirements, regression tests, and updated CI/CD policies. Gitea, Open Policy Agent

The listed tools support incident detection, investigation, containment, and recovery activities. They do not replace an established incident response process or guarantee identification of every AI-specific threat.

AI Incident Response Workflow

A typical AI security incident response process should include:

1. Detection and Triage

Identify suspicious AI behavior, unauthorized agent actions, sensitive information exposure, or infrastructure security events.

Determine the potential impact and initiate the appropriate incident response procedures.

2. Investigation and Impact Assessment

Collect relevant telemetry, agent execution records, model information, configuration versions, and deployment evidence.

Identify affected applications, users, services, and supporting infrastructure.

3. Containment

Restrict compromised services, suspend affected agents, revoke credentials, and prevent additional unauthorized operations.

Containment procedures should preserve evidence where practical.

4. Remediation

Correct identified vulnerabilities, remove malicious configurations or content, replace compromised artifacts, and address unauthorized access paths.

Changes should be validated through established CI/CD workflows.

5. Recovery

Restore approved model versions, prompts, agent configurations, application artifacts, and infrastructure settings.

Verify that recovered services operate within approved security boundaries before resuming normal operations.

6. Lessons Learned

Document root causes, incident impact, remediation outcomes, and opportunities to improve security controls.

Update threat models, security tests, monitoring rules, and deployment policies to reduce the likelihood of recurrence.

Expected Security Evidence

  • AI security incident detection records and alerts.
  • Incident classification and severity assessments.
  • AI application and agent execution logs.
  • Model, prompt, and agent configuration version records.
  • Affected software component and deployment inventories.
  • Security investigation findings and incident timelines.
  • Records of contained workloads and suspended agents.
  • Credential revocation and access restriction records.
  • Remediation changes and associated validation results.
  • Recovery procedures and approved rollback records.
  • Security and functional testing results following recovery.
  • Incident closure and post-incident review reports.
  • Updated threat models, monitoring policies, and CI/CD security requirements.

These artifacts demonstrate that AI-related security incidents can be investigated and resolved through structured, repeatable processes.

Security incident findings should inform future development, testing, and deployment activities.

Additional Resources