# SPM-007: Provide visibility for unmanaged endpoints


- Area: AI Security Posture Management

- Verification: Walkthrough + Documentation
- OWASP adoption tier: AT1, AT2
- Formerly: DIS-012
- URL: /r/SPM-007

**Acceptance criteria:** Use approved SaaS/API methods where no endpoint agent can be installed.

**Why it matters:** Contractors and personal devices still reach corporate AI tenants, and some will never run an agent.

**How to verify:** The vendor shows and documents the coverage method for an unmanaged device in your environment.

**OWASP adoption context:** Shadow, vendor-embedded and platform-integrated use may occur without a managed endpoint; network or service-side visibility depends on the available architecture.

**Mappings:**
- NIST CSF 2.0: DE.CM-01, DE.CM-06 — Approved network, remote-MCP and SaaS/API observations provide network or service-monitoring inputs where an endpoint agent cannot run. They do not establish equivalent visibility into all device activity.
- ISO 42001: A.6.2.6 — Alternative collection methods contribute to the AI operation-monitoring arrangement for unmanaged endpoints. Its scope, gaps and operating process still need to be defined.
- SOC 2: CC7.2; ISO 27001: A.8.16 — Off-endpoint telemetry supplies otherwise missing evidence for security monitoring within the buyer’s boundary. Validate coverage gaps, analysis and review rather than assuming equivalent visibility. These methods do not harden the endpoint.