Asset Management for an Estate That Includes AI

All courses / AI Red Team / Module 3 / Chapter 9

Learning objectives

After the lesson the participant can:

• List the seven asset classes of an estate with AI and the fields every AI asset record holds.
• Classify reconciliation differences as match, drift, orphan or unknown and assign each an owner and deadline.
• Rate the criticality of an AI asset using reach, identity, exposure, data and dependency.
• Draft an asset record for an agent, including identity, connectors, untrusted inputs and stop-path holders.

Key concepts

Seven asset classes

AI systems, models, agents, prompts and skills, connectors and tools, data, and security AI, each with its own owner and record. Security AI reads attacker-controlled content by design and often holds privileged access, so it is recorded with the same rigour as the systems it protects.

Last verification

The date and source of the record's last verification. The chapter calls it the field that matters most in practice, because it tells the SOC and the auditor whether the record describes the estate or a memory of it.

Four reconciliation outcomes

A match confirms the record; a drift is an asset in both lists that differs; an orphan is declared but no longer found; an unknown is discovered with no record. An unknown that acts or reads confidential data is escalated to the SOC as a potential security event.

The record as a control

At Hansa Mutual the gateway generates each agent's tool allow-list from its asset record, so a call to any unrecorded connector is refused and logged. The control followed a finding in which a vendor update had added a URL-reputation connector unnoticed.

Criticality by what the asset can do

Five factors decide the tier and the highest sets it: reach, identity, exposure to content an attacker can shape, data, and dependency. A move to Level 3 Bounded, a new write connector or a new source of untrusted input triggers reassessment.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Why must the AI register required for governance and the asset inventory required for security be the same list, or two lists reconciled automatically?
2. The discovery AI itself reads content others control. What design choices keep a crafted resource description from hiding an unregistered agent?
3. How would you explain to employee representatives the difference between finding assets and judging individuals in shadow AI discovery?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. In reconciliation, what is a drift?

   1. A declared asset that discovery no longer finds anywhere in the estate
   2. An asset that exists in both the declared and the discovered inventory but differs
   3. A discovered asset for which the inventory holds no record at all
   4. A record whose last verification date has passed the limit that applies to its criticality tier
   Show the answer

   B. An asset that exists in both the declared and the discovered inventory but differs
   The chapter defines drift as an asset in both inventories that differs, such as an agent with an unlisted connector or a newer model version than the one approved. An orphan is no longer found; an unknown has no record.

2. At which autonomy level does the chapter recommend the discovery classifier works by default?

   1. Level 3 Bounded, tagging and merging records within a playbook
   2. Level 2 Supervised, applying each classification after approval
   3. Level 0 Advisory, reporting only counts of likely unknowns
   4. Level 1 Assisted, drafting proposals with evidence for the owner to confirm
   Show the answer

   D. Level 1 Assisted, drafting proposals with evidence for the owner to confirm
   The discovery AI proposes and a person decides: it has read-only access to the evidence store, no write access to the inventory of record, and Level 1 Assisted is the recommended default.

3. Why is security AI often tier-0 under the chapter's criticality factors?

   1. It reads attacker-controlled content by design, sees telemetry estate-wide and may propose containment
   2. It is always classified as a high-risk AI system under the AI Act
   3. It is the most expensive class of asset to buy and to host
   4. It is the only asset class whose models and features suppliers can change without giving the organisation notice
   Show the answer

   A. It reads attacker-controlled content by design, sees telemetry estate-wide and may propose containment
   The factors of exposure, data, reach and dependency all apply: if manipulated, a SOC investigation agent can hide an intrusion or disrupt the business.