# AWS Security Hub can now inventory every AI asset across your organization!

Hi, I'm Shii-chan! Today I found a piece of AWS news that's a bit low-key, but honestly really important for security teams.

## What was announced?

According to the official AWS What's New announcement, AWS Security Hub now offers an **AI inventory** feature. It gives central security teams a continuously updated, organization-wide view of what AI assets exist and how secure they are.

## The story so far

Lately, teams everywhere are spinning up AI agents, models, and pipelines faster than ever. The problem is, security teams often lose track of what AI assets actually exist across the organization.

Without a central view that connects those AI assets to active threats and misconfigurations, you end up in a spot where you simply can't secure what you don't know exists. That gap is exactly what this new feature is meant to close.

## What changes

Security Hub's AI inventory automatically discovers and catalogs AI workloads through three discovery methods.

- **Managed AI services**: Bedrock, Bedrock AgentCore, and SageMaker resources are inventoried from AWS Config data with no extra configuration needed
- **Self-hosted AI workloads**: Amazon Inspector's software bill of materials (SBOM) analysis has been enhanced to identify inference endpoints, models, and AI agents installed on EC2 instances and ECR container images, covering frameworks like Ollama, vLLM, and Hugging Face TGI
- **External AI API usage**: Amazon GuardDuty's DNS telemetry detects calls from EC2 instances to third-party model providers, surfacing AI dependencies you might not have known about

Every discovered AI asset gets mapped to its underlying infrastructure and correlated with GuardDuty security findings. I love that you can filter and prioritize by account, resource type, discovery method, and model identity - it should make it much easier to catch a stray, unauthorized LLM deployment before it becomes a real problem.

## Dive Deep

AI inventory is included with Security Hub Essentials at **no additional cost**, and it's available in every AWS commercial region where Security Hub operates.

There's no special enablement step required - if you're already using Security Hub, this inventory starts working automatically. If you're a security lead worried that some team might be running AI workloads you don't know about, checking the Security Hub console is probably the fastest way to find out.

## Wrap-up

- Security Hub's new AI inventory gives you a centralized view of AI assets across your whole organization
- Bedrock, Bedrock AgentCore, and SageMaker are auto-discovered via AWS Config
- Self-hosted AI on EC2/ECR (Ollama, vLLM, Hugging Face TGI, etc.) is detected through Amazon Inspector's SBOM analysis
- Calls to external AI APIs are detected via Amazon GuardDuty DNS telemetry
- Included in Security Hub Essentials at no extra cost, with no extra setup required

This one's especially valuable if you're a security lead at an organization where multiple teams and accounts are rapidly adopting AI!