Runtime.
Rate limiting, monitoring, isolation, incident response, audit logging.
- Questions
- 2 in the adaptive tree
- Frameworks
- LLM10, NIST AI RMF
- Moves
- The Controls axis of the Posture Quadrant
Why runtime matters
Runtime is operational AI security. Rate limiting, monitoring, isolation, incident response, and audit logging. The Posture Check measures these five controls because they collectively determine whether your AI deployments can be operated safely at production scale, observed when things go wrong, and recovered from incidents. This dimension maps to OWASP LLM06 (Excessive Agency), LLM10 (Unbounded Consumption), and the Manage function of NIST AI RMF. Runtime is the dimension where SOC and SecOps teams have the most direct contribution: AI-specific detection content, AI-aware IR playbooks, and AI usage telemetry feeding the SIEM. Low runtime weight often sits beside full governance weight: the policy is right but the operational reality has not caught up.
What the check asks about runtime
The check asks up to five questions in total, chosen by your earlier answers, so a path may meet one of these or none. Each carries a weight from 0 to 3 and cites its source.
| Question | Citation | Answers |
|---|---|---|
| Are prompts and outputs logged, and is anyone alerted on unusual use?Logs are how you show the policy is being followed. | OWASP LLM10, NIST AI RMF MANAGE-2.2 |
|
| Has an AI-specific incident response plan been exercised in a tabletop?A plan nobody has run is only a document. | NIST AI RMF MANAGE-2.2 |
|
Frameworks cited on this dimension
Every question above cites its source. These are the frameworks behind runtime.
Unbounded Consumption (LLM10)
An LLM service is consumed in ways that drive cost, latency, or availability problems. Includes denial-of-wallet attacks, resource exhaustio.
Read the guideNIST AI RMF in Operation
The NIST AI Risk Management Framework (AI RMF 1.0, published January 2023) defines four core functions for AI risk: Govern, Map, Measure, Ma.
Read the guideSee where runtime lands on your chart.
Five questions, about three minutes, and your dot lands on the Posture Quadrant. Your stage and the move that takes you forward arrive by email or in a live conversation with a CWS engineer.