About this book:

*Cloud-Native AI Security* provides a comprehensive framework for protecting machine learning models and data across Kubernetes, serverless, and managed services. The book shifts the security paradigm from traditional network perimeters to a "Zero Trust" model centered on identity and automation. It explores the unique attack surface of AI, including data poisoning, model theft, and prompt injection, while emphasizing the Shared Responsibility Model between cloud providers and customers. By establishing "Architectural Trust," the text provides reference designs for segregating training and inference environments to limit blast radius and ensure operational integrity.

The technical core of the book details essential hardening strategies for cloud-native infrastructure. Key chapters cover scoped Identity and Access Management (IAM) through workload identity federation, which eliminates the need for static credentials, and the use of microsegmentation via Kubernetes network policies and service meshes. The authors provide practical guidance on secrets management, container security (including SBOMs and SLSA provenance), and the use of admission controllers to enforce security as code. Specific attention is given to managed platforms like AWS SageMaker, Google Vertex AI, and Azure ML, detailing how to configure private connectivity and encryption to protect sensitive intellectual property.

A significant portion of the text is dedicated to the unique risks associated with Large Language Models (LLMs) and Generative AI. It addresses sophisticated threats such as prompt injection and RAG (Retrieval-Augmented Generation) poisoning, offering defense-in-depth strategies like input/output filtering and AI-native firewalls. To maintain visibility without compromising privacy or budget, the book introduces "cost-aware" observability and runtime threat detection powered by eBPF. These tools allow security teams to monitor for behavioral drift and anomalous system calls at the kernel level, providing real-time defense against evolving adversarial tactics.

Finally, the book bridges the gap between technical execution and organizational governance. It maps cloud-native security controls to the NIST AI Risk Management Framework (RMF) and emerging global regulations like the EU AI Act. Operational resilience is addressed through tailored incident response playbooks and the implementation of "kill switches" for autonomous agents. By integrating FinOps principles to right-size security investments and adopting "Policy as Code" across multi-cloud and hybrid environments, the book empowers practitioners to build secure, compliant, and resilient AI systems that can scale without sacrificing trust.

What You'll Find Inside:

• Reference designs for securing AI training and inference across Kubernetes, serverless, and managed services, with network segmentation, least-privilege IAM, and data protection.
• Identity and access management practices including scoped IAM, workload identity federation, and short-lived credentials to limit blast radius.
• Data protection techniques: encryption at rest and in transit, tokenization, data minimization, and supply chain security for code, data, and models.
• Runtime threat detection and observability: eBPF-based monitoring, policy-driven controls, drift detection, and cost-aware logging/telesmetry.
• Incident response, governance, and FinOps for AI: playbooks, kill switches, mapping to NIST AI RMF, and right-sizing security controls.

Who's It For:

This book is written for DevOps engineers, platform teams, cloud security engineers, and MLOps practitioners who need actionable, step‑by‑step guidance to secure AI workloads in cloud‑native environments. Readers will find practical checklists, diagrams, and examples for Kubernetes, serverless functions, and managed AI platforms such as SageMaker, Vertex AI, and Azure ML, enabling them to implement security controls quickly and align them with risk, compliance, and cost objectives.