AID-M-001: AI Asset Inventory & Mapping
Maintain an authoritative, versioned map of the AI estate: owned models, datasets, infrastructure, dependencies, agent skills, externally consumed AI services, and public or private AI endpoints. Reconcile declared inventory with independently observed deployment, network, identity, registry, and control-plane evidence so unknown, orphaned, stale, or unexpectedly exposed assets remain visible.
Scope boundary
Owns authoritative discovery, inventory, dependency mapping, ownership, and declared-versus-observed reconciliation for the AI estate. It produces stable asset facts and drift findings but does not authorize, block, remediate, contain, or evict an asset.
Sub-techniques
- AID-M-001.001: AI Component & Infrastructure Inventory
- AID-M-001.002: AI System Dependency Mapping
- AID-M-001.003: Agentic Skill & Instruction Asset Inventory
- AID-M-001.004: AI Service & Embedded SaaS AI Discovery
- AID-M-001.005: Public AI Endpoint & Agent-Service Exposure Discovery
- AID-M-001.006: Internal AI Endpoint & Agent-Service Discovery
Threat mappings
MITRE ATLAS
- AML.T0000 Search Open Technical Databases
- AML.T0000.003 Search Open Technical Databases: Scan Databases
- AML.T0006 Active Scanning
- AML.T0006.000 Active Scanning: Enumerate Hosted AI Resources
- AML.T0006.002 Active Scanning: Scan for Exposed AI Infrastructure
- AML.T0007 Discover AI Artifacts
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.001 AI Supply Chain Compromise: AI Software
- AML.T0010.004 AI Supply Chain Compromise: Container Registry
- AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
- AML.T0011 User Execution
- AML.T0011.001 User Execution: Malicious Package
- AML.T0040 AI Model Inference API Access
- AML.T0049 Exploit Public-Facing Application
- AML.T0116 Autonomous Reconnaissance
- AML.T0132 Misconfigured or Publicly Exposed AI Services
MAESTRO
- Compromised Framework Components (L3)
- Orchestration Attacks (L4)
- Integration Risks (L7)
- Compromised Agent Registry (L7)
- Supply Chain Attacks (Cross-Layer)
OWASP LLM Top 10 2026
- LLM04:2026 Supply Chain
OWASP ML Top 10 2023
- ML05:2023 Model Theft
- ML06:2023 AI Supply Chain Attacks
OWASP Top 10 for Agentic Applications 2026
- ASI04:2026 Agentic Supply Chain Vulnerabilities
NIST Adversarial Machine Learning 2025
- NISTAML.031 Model Extraction
- NISTAML.051 Model Poisoning (Supply Chain)
Cisco Integrated AI Security and Safety Framework
- AITech-5.2 Configuration Persistence
- AITech-6.1 Training Data Poisoning
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-9.3 Dependency / Plugin Compromise
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-9.3.1 Malicious Package / Tool Injection
- AISubtech-9.3.3 Dependency Replacement / Rug Pull
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- MST: Model Source Tampering
- MXF: Model Exfiltration
- MDT: Model Deployment Tampering
- MRE: Model Reverse Engineering
- IIC: Insecure Integrated Component
Databricks AI Security Framework 3.0
- Governance 4.1: Lack of traceability and transparency of model assets
- Governance 4.2: Lack of end-to-end ML lifecycle
- Algorithms 5.4: Malicious libraries
- Model 7.3: ML Supply chain vulnerabilities
- Model 7.4: Source code control attack
- Model Management 8.1: Model attribution
- Model Serving - Inference requests 9.11: Model Inference API Access
- Operations 11.1: Lack of MLOps - repeatable enforced standards
- Platform 12.1: Lack of vulnerability management
- Platform 12.5: Poor security in the software development lifecycle
- Platform 12.7: Initial Access
- Agents - Tools MCP Server 13.18: Tool Poisoning
- Agents - Tools MCP Server 13.20: Insecure Server Configuration
- Agents - Tools MCP Server 13.21: Supply Chain Attacks