Graph-based security posture management of artificial intelligence assets

A system for analyzing, representing, and managing security and compliance posture of artificial intelligence (AI) assets within an enterprise computing environment, comprising:

• one or more processors configured to:
• ingest, by a data processing engine via read-only platform integrations and telemetry interfaces configuration data, runtime data, and connectivity data associated with a plurality of discovered AI assets across one or more enterprise platforms;
• generate, using a trained graph-based model, a multi-dimensional graph data structure that models the discovered AI assets, access channels, and relationships among the discovered AI assets, wherein the multi-dimensional graph data structure comprises encoded security and compliance posture attributes for the discovered AI assets;
• convert, using a trained large language model (LLM), data and relationships represented within the multi-dimensional graph data structure into natural language text;
• validate, by executing a deterministic rules engine, deterministic rule-set policies of enterprise governance policies using data represented in the natural language text;
• generate, by a context prompt generator that queries one or more context resources, a contextually relevant prompt corresponding to validating LLM-based policies of the enterprise governance policies;
• validate, by executing a trained reasoning model, the LLM-based policies using the contextually relevant prompt, the natural language text, and results of validating the deterministic rule-set policies;
• compute, based on the validations, a security risk score and a compliance risk score for each of the discovered AI assets;
• assign a critical security risk designation to a discovered AI asset when the security risk score satisfies a criticality criterion and a critical compliance risk designation to the discovered AI asset when the compliance risk score satisfies a criticality criterion;
• and
• responsive to a detected change in the multi-dimensional graph data structure, the detected change being based on the ingested data and corresponding to at least one of runtime behavior, configuration state, and connectivity of at least one of the discovered AI assets, retriggering at least the generating, converting, validating, computing, and assigning steps to update the security risk score and the compliance risk score and corresponding criticality designations for the at least one discovered AI asset.

A non-transitory computer-readable medium storing a set of instructions for analyzing, representing, and managing security and compliance posture of artificial intelligence (AI) assets within an enterprise computing environment, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• ingest, by a data processing engine via read-only platform integrations and telemetry interfaces configuration data, runtime data, and connectivity data associated with a plurality of discovered AI assets across one or more enterprise platforms;
• generate, using a trained graph-based model, a multi-dimensional graph data structure that models the discovered AI assets and relationships among the discovered AI assets, wherein the multi-dimensional graph data structure comprises encoded security and compliance posture attributes for the discovered AI assets;
• convert, using a trained large language model (LLM), data and relationships represented within the multi-dimensional graph data structure into natural language text;
• validate, by executing a deterministic rules engine, deterministic rule-set policies of enterprise governance policies using data represented in the natural language text;
• generate, by a context prompt generator that queries one or more context resources, a contextually relevant prompt corresponding to validating LLM-based policies of the enterprise governance policies;
• validate, by executing a trained reasoning model, the LLM-based policies using the contextually relevant prompt, the natural language text, and results of validating the deterministic rule-set policies;
• compute, based on the validations, a security risk score and a compliance risk score for each of the discovered AI assets;
• assign a critical security risk designation to a discovered AI asset when the security risk score satisfies a criticality criterion and a critical compliance risk designation to the discovered AI asset when the compliance risk score satisfies a criticality criterion;
• and
• responsive to a detected change in the multi-dimensional graph data structure, the detected change being based on the ingested data and corresponding to at least one of runtime behavior, configuration state, and connectivity of at least one of the discovered AI assets, retriggering at least the generating, converting, validating, computing, and assigning steps to update the security risk score and the compliance risk score and corresponding criticality designations for the at least one discovered AI asset.