Mend.io Launches AI Security Governance Framework to Combat Shadow AI Risks

AI Security Governance: A Practical Framework for Security and Development Teams

Mend.io has released a comprehensive AI Security Governance Framework to bridge the gap between rapid AI adoption and security oversight. The framework introduces a scoring system that categorizes AI assets into three distinct risk tiers based on five specific technical dimensions.

Why This Matters

Technical reality often involves developers deploying tools like GitHub Copilot or third-party APIs long before security teams establish oversight, creating significant ‘Shadow AI’ risks. This framework moves beyond ideal models by providing a practical maturity scale—from Emerging to Leading—that aligns with the EU AI Act and NIST AI RMF to ensure security doesn’t bottleneck development velocity. By implementing automated guardrails, organizations can manage the transition from reactive security to proactive, adaptive AI governance.

Key Insights

• Risk Tiering System: Assets are scored 5–15 based on Data Sensitivity and System Access, with Tier 3 (12-15) requiring full security assessments and incident response playbooks.
• The AI Bill of Materials (AI-BOM): Mend.io extends the SBOM concept to include model artifacts, training datasets, and inference infrastructure as required by the EU AI Act.
• Principle of Least Privilege for APIs: API keys must be narrowly scoped to specific resources, avoiding shared credentials between human users and autonomous agents.
• Three-Layer Monitoring: Security teams must monitor the model layer for prompt injection, the application layer for sensitive sinks like database writes, and the infrastructure layer for unauthorized egress.
• AI Maturity Model: Organizations progress through four stages—Emerging, Developing, Controlling, and Leading—to automate guardrails like system prompt hardening and CI/CD AI checks.

Practical Applications

• Automated Code Review: Integrating SAST and SCA to scan AI-generated code as untrusted input; pitfall: treating AI code as trusted by default leading to unvetted vulnerabilities.
• Inventory Management: Non-punitive cataloging of tools like Notion AI and internal LLMs to prevent Shadow AI; pitfall: restrictive policies that drive AI usage underground.
• Network Egress Control: Implementing controls to block unapproved AI endpoints; pitfall: high-volume API calls deviating from baselines without runtime monitoring.

References:

• https://www.marktechpost.com/2026/04/23/mend-releases-ai-security-governance-framework/