What we still need to verify : 3 points in this profile are not yet confirmed against vendor documentation.
- Cloud and MLOps connector list, confirm with vendor
- Runtime protection architecture and whether it is inline or observational, confirm
- Depth of agent and Model Context Protocol coverage, confirm
Treat these points as unconfirmed. They are open items in the catalog's verification queue, and this note stays until each is checked against the vendor's documentation.
What it does
Noma starts from discovery, on the reasonable premise that most organizations cannot list their AI assets. It connects to cloud accounts, data platforms, notebook environments, model registries and MLOps tooling and builds an inventory of what exists: training pipelines, datasets, models, endpoints, and the applications and agents calling them. Each asset picks up context about the data it touches and the access it holds, which is what turns an inventory into a risk picture rather than a list.
On top of that inventory it evaluates posture. Misconfigured notebook environments, model artifacts pulled from public sources without review, pipelines with excessive permissions, endpoints exposed more broadly than intended. Model files are checked for the serialization and embedded code risks that make an untrusted checkpoint dangerous to load. The runtime side extends to deployed applications and agents, watching for prompt injection, data leaving through a response, and agent actions that fall outside what the agent was supposed to do, which is the hardest of these problems because an agent's legitimate action range is wide.
Where it fits
This is a posture and governance layer operated by security, spanning discovery through runtime rather than living at one point in a pipeline. It assumes an ML estate substantial enough to have gone unmapped, and it assumes you can grant read access across cloud and data platforms. Findings land with data science and platform teams, so the usual posture management prerequisite applies: someone must own remediation or the inventory becomes a report nobody acts on.
Strengths
- Automated discovery across cloud and MLOps tooling answers the question most programs stall on, which is what AI is actually running here.
- Connects model supply chain risk to the pipeline that pulled the artifact, so a finding has an owner.
- Spans posture and runtime in one product, avoiding the seam between a scanner and a separate guardrail.
- Agent-focused coverage addresses a surface that model-centric tools miss.
Limitations
- Posture management produces volume. Without prioritization tuned to your environment, the initial finding count will exceed what anyone can work through.
- Broad read access across cloud and data platforms is a significant grant that needs its own review.
- Coverage depends on connectors. Anything running outside the supported platforms stays invisible, which is exactly where unsanctioned work happens.
Who it suits
Fits enterprises with a real ML and AI footprint spread across teams and clouds, where the pressing problem is not knowing what exists. Wrong for a small team with three services calling one hosted API, where the inventory fits in a document and the money is better spent on guardrails and testing.
Used Noma Security? Recommend it under your own name and title.
Recommend this tool