What Is AI TRiSM?

AI TRiSM is a unified framework for operationalizing enterprise AI governance requirements. In October 2022, Gartner named AI TRiSM a top strategic technology trend for 2023 in its Top Technology Trends research. The framework supports the trustworthiness, explainability, data privacy, and active security of AI models.

Because static policies can’t keep up with AI, AI TRiSM adds continuous monitoring, validation, and runtime enforcement. Static policies are written rules, such as a document that lists approved AI tools or restricted data types. They capture intent at a single point in time, and AI changes faster than documents do. New tools appear weekly. Models drift over time. Employees paste data into prompts that no one has reviewed.

Runtime enforcement applies the rules while AI is in use. It inspects each prompt and response in motion, then blocks, redacts, or flags when content breaks policy. Continuous monitoring and validation add ongoing checks that models behave as intended.

Gartner describes AI TRiSM as providing “the technical foundation and controls to operationalize modern AI governance.” Organizations use the framework to manage AI risk throughout a model’s life cycle, from training and fine-tuning through daily operation.

What Are the Pillars of the Gartner AI TRiSM Framework?

Gartner’s AI TRiSM framework is built on four pillars: explainability and model monitoring, ModelOps, AI application security, and data privacy. Practitioners often add regulatory compliance as a fifth pillar. Each pillar answers a different question about how an AI system is understood, run, defended, supplied with data, and held accountable.

Explainability and Model Monitoring

Explainability makes it possible to understand what an AI model did and why. Users, auditors, and regulators should be able to review an AI output and challenge it when it looks wrong.

That ability is critical in high-stakes industries, such as finance and healthcare. For example, a bank has to justify a denied loan, and a hospital should be able to show why a model flagged a scan. A decision that nobody can trace is a decision that nobody can correct.

Model Operations (ModelOps)

ModelOps governs how each model is deployed, monitored, updated, and eventually retired. A central registry keeps version history, training data sources, and ownership in one place.

Drift detection watches for the moment when real-world data no longer resembles training data, since accuracy usually declines at that point. When a model reaches the end of its useful life, a documented retirement decision and an archived final version keep the record complete.

AI Application Security

AI introduces attack surfaces that traditional application security was never built to cover. Attackers can use prompt injection to slip hidden instructions into prompts, poison training data, extract private information from a model, or steal the model itself.

Adversarial inputs can also push a model toward harmful behavior. Protection has to reach the model, the application wrapper around it, and the pipelines that feed it. Inline inspection of prompts and responses puts those protections to work while AI is in use.

Data Privacy

Sensitive corporate intellectual property (IP) and personally identifiable information can escape through a single prompt. They can also end up in a training pool, where removal is difficult. Three techniques lower that risk at the source:

• Data minimization: Collect and keep only the data that a model needs for its purpose. Information that never enters the pipeline cannot leak from it.
• Anonymization: Remove or alter identifiers, such as names and account numbers, so that records no longer point to a specific person.
• Differential privacy: Add carefully measured statistical noise to data or model outputs. Patterns stay useful, but it becomes very difficult to infer whether a single individual’s record was included.

Data classification across training sets, inputs, and outputs makes downstream controls more accurate. Inline data loss prevention (DLP) can then stop sensitive content before it leaves the organization.

Regulatory Compliance

Regulatory compliance ensures that AI systems meet the requirements of laws such as GDPR and HIPAA, along with a growing body of AI-specific regulation. Compliance depends on enforced policy, clear documentation, and evidence that auditors can verify.

Ungoverned AI creates risk at the moment of use, and that is where the controls above apply. Two categories stand out: data exposure through unsanctioned tools and manipulation of the models themselves.

Shadow AI and Prompt Leakage: The Risks of Ungoverned AI Tools

Shadow AI is any AI tool that an employee uses without security review. It can be a standalone tool, such as unauthorized use of Claude, or a feature embedded in an approved tool, such as an AI-enhanced browser extension. These ungoverned models pose three main forms of risk, including:

• Data leakage: Employees often paste sensitive information like proprietary source code, contract details, or customer data into public prompts.
• Prompt injection: Attackers hide malicious instructions in content that an AI model can read, then steer its behavior.
• Hallucinations: Models are nondeterministic, so that the same question can return different and sometimes false answers.

Traditional firewalls cannot identify this activity. Generative AI prompts travel inside encrypted HTTPS sessions. A virtual firewall that checks ports, IP addresses, and domains sees an allowed connection to an AI site. It cannot read the prompt inside, so sensitive data can leave unnoticed.

Closing that blind spot requires inline inspection of encrypted traffic.

Adversarial Attacks and Unreliable Outputs

Models also face adversarial attacks, both within the conversation and against the model itself. In a prompt injection attack, malicious instructions hide in content that an AI model can read, and they steer its behavior. Poisoned training data and extraction attempts target the model itself. Zscaler red team testing found critical flaws in 100% of enterprise AI systems analyzed, and most systems could be compromised in 16 minutes.

Reliability is a second concern. Models are nondeterministic, so the same question can return different answers. Models can also produce false answers with confidence, known as hallucinations. Runtime inspection checks prompts and responses against policy, and ongoing monitoring tracks output quality over time. Together, they help flag manipulation and unreliable answers before they affect business decisions.

Traditional AI governance sets the rules, roles, and accountability for AI use through committees, written policies, and periodic reviews. AI TRiSM adds the technical controls that enforce those rules. It monitors AI activity as it happens and blocks violations in real time, rather than relying on people and models to follow policy on their own.

Policies alone, without an enforcement arm, can’t prevent prompts from submitting private customer data to a public-facing AI model.

Regulatory compliance shapes what responsible AI looks like and holds organizations accountable. AI TRiSM is the technical foundation that demonstrates how organizations should meet those expectations in their daily operation.

• EU AI Act: The European Union’s law requires high-risk AI providers to run a risk management system across the life cycle, govern data, and maintain automatic logs. AI TRiSM supports this initiative through runtime inspection, which records prompt and output activity as audit evidence.
• NIST AI Risk Management Framework (RMF): The voluntary US framework organizes AI risk work into four functions named govern, map, measure, and manage. AI TRiSM puts the measure and manage functions into practice with continuous monitoring and automated responses. NIST’s Generative AI Profile provides additional guidance on the risks unique to generative AI, such as sensitive data exposure.
• ISO/IEC 42001: This international standard defines requirements for an AI management system. These include AI policy, risk management, data governance, and performance monitoring. The inline controls of AI TRiSM generate measurable records of enforcement, providing evidence behind the monitoring and evaluation clauses.

Each framework asks for documented, repeatable control over AI use. Policy documents satisfy only part of that request, whereas inline enforcement and logging produce the proof.

Implementing AI TRiSM begins with clear rules for how employees use generative AI. It then extends to the AI features that already sit inside approved applications. At each step, a written policy becomes a control that works while AI is in use.

Step 1. Establish GenAI Acceptable Use Policies

An acceptable use policy defines which GenAI tools are approved, including which specific data types are allowed in prompts and who owns each decision. When establishing policies, security teams should combine a short, plain-language document with an approved-tool register and technical enforcement. This policy becomes the standard that every later control enforces.

Step 2. Audit Existing AI Usage Against an Ideal Enforcement Baseline

With the policy in place, the next move is to measure real behavior against it. An AI usage audit compares actual AI use with the approved-tool register and shows which controls are missing.

The baseline converts rules into controls in sequence:

1. Inventory existing AI use, since most organizations discover shadow AI at this step.
2. Replace free consumer tiers with enterprise accounts.
3. Block unapproved AI tools with web gateway rules.
4. Flag sensitive data headed to AI domains with AI-aware data loss prevention (DLP).
5. Log approved tool usage for audit.

A security-reviewed allow list works better than a blanket block, because employees keep a sanctioned path to AI.

Step 3. Establish Embedded AI Governance

Policies and audits cover tools that employees choose. The final step covers embedded AI, meaning AI features built into tools the organization has already approved.

Approval of a SaaS application does not approve every AI feature added later. AI copilots and assistants are now embedded inside collaboration, CRM, and coding tools, often without central review.

Guardrails should apply across public GenAI, copilots, SaaS AI features, and agents. Governance begins with an inventory of AI-enabled features and connectors. That inventory cannot be a one-time exercise, as the quote makes clear. Security teams should look for vendors that offer the following capabilities:

• Continuous discovery: automated detection of embedded AI features and connectors as vendors add them, in place of annual audits and clickwrap agreements.
• Visibility into orchestration: insight into how copilots, agents, and APIs exchange data with each other and with approved apps, so opaque interactions become visible.
• Independent runtime enforcement: inline inspection of prompts and responses that works regardless of vendor assurances, with the ability to block, redact, or coach.
• Permission and data awareness: sensitivity labels, DLP, and connector limits that flag oversharing before an assistant surfaces sensitive content.
• Audit-ready logging: records of AI interactions that show regulators what happened and which policy applied.

For example, a leading Microsoft Copilot risk is oversharing across SharePoint, OneDrive, and Teams. Sensitivity labels, DLP, and limits on connectors and agents reduce that exposure. Inline inspection of prompts and responses adds enforcement where native settings stop. Together, these capabilities give security teams greater control over embedded AI, so they don’t have to rely on vendor assurances alone.

AI TRiSM, AI-SPM, and DSPM share some overlap, but each covers a different scope in the realm of AI security. AI TRiSM sets the governance direction, while AI-SPM and DSPM assess posture. Neither AI-SPM nor DSPM inspect live prompts, which is why runtime enforcement is needed to enforce complete AI security.

• AI TRiSM: Gartner’s framework controls aspects of governance, ethics, explainability, and security across an enterprise’s entire AI environment. It determines what an organization should govern, and it covers key functions like runtime inspection and enforcement.
• AI-SPM: AI security posture management continuously inventories and evaluates AI assets, such as models, datasets, prompts, and agents. It pinpoints misconfigurations and vulnerabilities before attackers do. Under the TRiSM umbrella, it provides the asset inventory and configuration checks that governance and runtime controls depend on.
• DSPM: data security posture management discovers, classifies, and protects sensitive data across cloud and hybrid environments. It shows where regulated data lives and who can reach it.

AI-SPM and DSPM are posture-based disciplines that scan assets at rest and report risk. They can also reveal an exposed model or an overshared dataset. But an agent that accesses the wrong database needs inline inspection capabilities backed by AI TRiSM to stop it.

Gartner’s Market Guide for AI TRiSM lays out four layers of technical capabilities that enforce AI governance policies. Each layer is specifically designed to protect a unique aspect of the AI life cycle, and each maps to a distinct category of technology.

• AI governance: A central registry catalogs all models, agents, and AI applications, along with their associated risk assessments and policy compliance status. This provides security teams with a single view of what all exists in an organization’s AI environment. Technology category: AI governance platforms and model registries.
• AI runtime inspection and enforcement: Live traffic between users, applications, and models passes through inspection. Prompts and responses are appropriately filtered, and any violations are blocked as they occur. Technology category: AI runtime security, including guardrails, AI gateways, and secure web gateways with AI inspection.
• Information governance: Access controls, classification, and inline DLP decide which data a model can reach. Unapproved or sensitive content stays out of prompts and training sets. Technology category: data security tools such as DLP, data classification, DSPM, and access management.
• Infrastructure and tech stack: The underlying environment that hosts AI workloads requires its own set of protections. Network controls and endpoint sandboxing bring zero trust principles to connected systems. Technology category: network, endpoint, and cloud security.

Which AI TRiSM Layer to Prioritize First

Governance takes inventory of what exists, while runtime inspection acts on it. Organizations whose employees already use GenAI daily often deploy runtime inspection first, since it protects the data inside prompts.

AI TRiSM delivers its value when controls run during live AI use, not only during development. In practice, that means monitoring model decisions, inspecting prompts, and blocking attacks in real time, as part of a broader AI security strategy. The following four industry examples show how that works.

Finance

A lender relies on an AI credit model to help guide approvals. Continuous monitoring tests each decision for bias against protected groups and flags behavioral drift before applicants feel the effect. Documented results give compliance teams evidence of fair lending under consumer protection rules.

Healthcare

A clinician pastes patient notes into an AI assistant to draft a summary. Inline inspection detects protected health information (PHI) in the prompt and redacts or blocks it before it leaves the network. Zscaler DLP guidance notes that employees often copy healthcare records into public AI tools, and prompt scanning checks for sensitive patterns before submission. Care teams keep the productivity benefit while the organization supports its HIPAA obligations.

SaaS and Technology

A software company builds an AI assistant into its product and gives engineers internal language models. Enterprise AI activity is rising quickly, and the ThreatLabz 2026 AI Security Report measured an 83% year-over-year surge in AI transactions. Each new interaction gives attackers another chance to attempt prompt injections or a data extraction attempt. Runtime inspection can detect and block both before they reach the model.

Retail

AI use is growing fast in this sector. ThreatLabz measured a 193% year-over-year increase in retail and wholesale AI transactions, reaching 49 billion in 2025. A retailer running customer chatbots and pricing models uses prompt inspection to keep payment and loyalty data out of public AI tools. The same controls can block prompt injection attempts aimed at its chatbot.

Effective AI TRiSM watches more than the model itself. Monitoring covers the data going in, the decisions coming out, and the activity around them. These are the components that matter most:

Policy alone cannot stop a prompt that is already in motion. Practical AI TRiSM starts with seeing every AI interaction, then adding controls that take action at the moment of use.

Step 1: Discover and Catalog Shadow AI

Shadow AI is any AI tool in use without security review. The risk extends to AI features that arrive inside approved tools such as CRM platforms and team software, where a new assistant can switch on after a routine update.

Discovery engines inspect outbound traffic, DNS queries, and URLs to spot AI destinations, then categorize each one, including apps embedded within popular SaaS platforms. Zscaler strategic guidance sorts every app as sanctioned, unsanctioned, or unreviewed. The result is a living catalog with a clear policy decision for each tool.

Step 2: Enforce Inline DLP and Real-Time User Coaching

Prompts travel over encrypted HTTPS. Inline SSL decryption lets DLP read them in transit, so uploads of source code, PII, or financial data can be blocked before they cross the network boundary.

Some behavior is risky but fixable. For those cases, a coaching trigger appears just before submission, explains why the content is sensitive, and points to an approved alternative. Employees learn the rule at the moment it matters.

Step 3: Sandbox Interactions with Secure Browser Isolation

Some AI platforms are unvetted but still in demand. Secure browser isolation renders them in a secure cloud container. Employees can still type prompts, while copy and paste, uploads, and downloads are disabled. Sensitive content stays inside, and generated content cannot be saved to a local device.

Zscaler and Portal26 pair network-level enforcement with deep AI analytics in one integrated approach to AI TRiSM. Portal26, featured in Gartner’s 2023 Market Guide for AI TRiSM, adds advanced analytics, prompt monitoring, and strategy tools on top of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA).

The zero-deployment design builds on Zscaler modules that organizations already run. According to Portal26, teams can activate Portal26 AI TRiSM capability in under an hour with no new footprint.

Key capabilities include the following:

• Prompt discovery forensic vault: A vault protected by FIPS 140-validated encryption keeps prompts encrypted and ready for audits, investigations, and legal discovery.
• GenAI Strategy Module: It reveals how and why employees use GenAI, which guides investment and policy decisions.
• Real-time DLP analytics: A second layer of analysis measures how well DLP policies perform on AI prompts.
• Departmental reporting: Usage reports by team support targeted coaching and faster risk decisions.

Together, these capabilities give security teams a full picture of AI use and the controls to act on it. Organizations gain proof for auditors, insight for leaders, and protection at the moment a prompt is submitted.

To learn more about Zscaler AI Security, schedule a meeting.