# AWS Security Hub Adds an AI Inventory for Organization-Wide Visibility

**AWS Security Hub now automatically discovers, catalogs, and correlates AI workloads across an AWS environment using three separate discovery methods.**

Security teams often cannot see every AI system running inside their own organization. As teams stand up AI agents, models, and pipelines faster than security can track them, that blind spot becomes a real risk: an organization cannot secure an AI asset it does not know exists. AWS says its new AI inventory in Security Hub is meant to close that gap by giving central security teams a continuously updated, organization-wide view of AI assets and their security posture.

## What's new
The core change is that Security Hub now inventories AI assets automatically, without teams needing to register or tag anything themselves. Every asset it finds gets tied back to the infrastructure it runs on, and cross-referenced against security findings pulled from across the wider AWS security stack, GuardDuty threat findings included. Linking "here is an AI asset" to "here is what's wrong with it" is what turns a simple list into something a security team can act on.

## Three ways Security Hub finds AI assets
AWS describes three discovery methods behind the new inventory. For managed AI services, Security Hub pulls in AWS Config resources from Amazon Bedrock, Bedrock AgentCore, and Amazon SageMaker, with no additional configuration needed. For self-hosted AI workloads, it draws on software bill of materials analysis from Amazon Inspector, which AWS says has been enhanced to spot inference endpoints, models, and AI agents running on Amazon EC2 instances and inside Amazon ECR container images, including open frameworks like Ollama, vLLM, and Hugging Face TGI. Third, Security Hub uses Amazon GuardDuty DNS telemetry to catch outbound calls to external AI API endpoints, including calls to third-party model providers, so teams can see AI dependencies they might otherwise miss.

## Connecting inventory to security findings
Once assets are discovered, teams can filter, group, and query the inventory by account, resource type, discovery method, and specific model identity. AWS positions this as a way to prioritize remediation: instead of treating every AI workload the same, security teams can focus first on the ones that are actively under threat or that carry the highest organizational risk.

## Availability and cost
AI inventory ships as part of Security Hub Essentials at no additional cost, and AWS says it requires no new enablement step. It is available in all AWS commercial Regions where Security Hub is offered.

## Key facts
- AI inventory is built into AWS Security Hub and combines three discovery methods: AWS Config data, Amazon Inspector SBOM analysis, and Amazon GuardDuty DNS telemetry.
- Managed-service discovery covers Amazon Bedrock, Bedrock AgentCore, and Amazon SageMaker with no additional configuration.
- Self-hosted discovery identifies inference endpoints, models, and AI agents on Amazon EC2 instances and Amazon ECR images, including frameworks such as Ollama, vLLM, and Hugging Face TGI.
- GuardDuty DNS telemetry surfaces external AI API endpoints, including calls to third-party model providers.
- AI inventory is included with Security Hub Essentials at no additional cost and needs no new enablement.

## Check your understanding
What are the three discovery methods AWS Security Hub uses to build its AI inventory?
How does Amazon GuardDuty DNS telemetry help Security Hub find AI-related risk?

## Sources
- [AWS Security Hub now provides AI inventory](https://aws.amazon.com/about-aws/whats-new/2026/07/aws-security-hub-ai/)

---

- Category: implement (tooling)
- Affects: —
- Published: 2026-07-14T00:00:00.000Z
- Original: https://aws.amazon.com/about-aws/whats-new/2026/07/aws-security-hub-ai/
- Generated by tinker news