Unifying AI and Data Posture Management

AI adoption has risen rapidly, with 1.3 million, or around 50%, of Australian businesses now regularly using the technology. However, while generative AI tools such as ChatGPT, Gemini and Copilot once felt like the answer to every organisation’s problems, that was just the tip of the iceberg. The next step, agentic AI, or AI agents, don’t just think, they can perceive, reason and act on their own.

For Australian businesses, AI agents are already reshaping how work gets done: orchestrating data, automating workflows and executing tasks. It sounds almost too good to be true – and our adversaries are clearly thinking the same. This is where risk comes into play, and why AI and data security posture management have never been more important.

‍

‍

The Risks of AI Adoption

AI agents work incredibly quickly and often have broad default permissions. That ability to access what they need, when they need it, at speed, is also a significant danger. They don’t follow the same safeguards as human users and are routinely over-permissioned, inheriting the excessive privileges already present in many SaaS systems. For attackers, it’s too good an opportunity to miss.

SaaS was already a significant attack vector for cybercriminals because it breaks traditional security boundaries; it’s accessible from everywhere, full of integrations, easy for lateral movement, and many organisations are still slow to secure it. AI agents have led to the emergence of new attack types, including model poisoning, data manipulation, and inference attacks, which specifically target AI systems.

One example of the risk was demonstrated by the 2023 Microsoft AI model exposure incident. Researchers discovered that an overly permissive SAS token had accidentally exposed 38TB of private AI training data on GitHub. While it wasn’t an attack, it showed just how quickly AI systems can become vulnerable when permissions aren’t tightly controlled. And because Azure and Microsoft 365 are so widely used in Australia, the exposure raised real concerns about how easily sensitive data could leak into AI workflows without proper oversight. Ultimately, attackers only need one weak point to cause widespread damage.

‍

Understanding AI Security Posture Management (AI-SPM) and Data Security Posture Management (DPSM)

As AI adoption accelerates and data becomes increasingly decentralised, organisations need a structured way to keep control of both, without slowing innovation. This is where AI-SPM and DSPM come into play, each offering a slightly different approach to identifying, monitoring and reducing risk:

• ‍AI Security Posture Management (AI-SPM) is an approach that helps organisations secure the AI systems and data they rely on. It’s a dedicated framework that continuously monitors, manages and improves the security of AI models, data pipelines and deployment environments. In short, AI-SPM provides organisations with a comprehensive view of their AI security posture, highlighting emerging risks so they can take action before issues escalate into incidents.‍
• Data Security Posture Management (DSPM) focuses on the data itself, where sensitive information lives, who can access it and whether the right controls are in place. It gives organisations visibility across SaaS, cloud and hybrid environments and ensures sensitive data is discovered, classified, protected and only accessible to the right people.

AI-SPM and DSPM together give organisations a way to see exactly where data lives, how AI systems are behaving, which permissions don’t look right and where the biggest risks sit. With this visibility, organisations can move quickly without losing control.

‍

Building a Unified Approach

Once you understand the scale of the risks, the next step is turning posture management into something practical. This means going beyond simple compliance checklists and moving towards a more proactive, unified approach across protecting your data.

This is where Infotrust can help organisations implement a comprehensive enterprise Data Program program which defines and implements the technology and processes necessary to reduce the risk of data exposure and leakage through AI and other risky destinations. Infotrust provides subject matter expertise through a range of specialised services:

• ‍Data Security Services: Helping organisations discover where sensitive data lives, classify it appropriately, and apply the right controls across SaaS, cloud and hybrid environments.‍
• Data Loss Prevention (DLP): Implementing intelligent, policy-driven controls that prevent accidental or malicious data leaks — especially important as AI tools increase the speed and volume of data movement.‍
• Insider Threat Management (ITM) or Insider Risk Management (IRM): A structured approach that organisations implement to detect, prevent, and respond to risks posed by individuals within the organisation who may misuse their access to harm the enterprise.‍
• Consulting and Advisory: Working with organisations to strengthen governance frameworks, uplift internal capabilities and ensure AI, SaaS and data security strategies are aligned with compliance needs and best practice.

By combining governance, visibility and control, organisations can build an AI and data posture that actually supports growth rather than slowing it down.

‍

Creating a More Resilient Security Posture for Your Business

AI adoption will continue to rise, and with AI agents now operating across core business systems, the stakes have never been higher. Without the right posture management in place, the risks can quickly outweigh the benefits.

AI-SPM and DSPM give organisations the clarity and structure they need to manage these risks, providing visibility into how AI systems behave, where sensitive data lives and which access points pose the greatest threat. Ultimately, by bringing these approaches together, you can create a stronger, more resilient security posture for your organisation that supports innovation rather than holding it back.

If you’d like to explore how AI and Data Security Posture Management can strengthen governance, visibility and trust across your digital ecosystem, get in touch with the team at Infotrust.