What is Onyxia Cyber?

Onyxia is a preemptive cyber resilience platform for CISOs and security teams. It unifies telemetry from 40+ security tools, benchmarks programs against NIST CSF and MITRE ATT&CK, and helps CISOs quantify and demonstrate the business value of cybersecurity investments.

What security tools does Onyxia integrate with?

Onyxia integrates with 40+ leading security tools, including CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Tanium, Okta, Microsoft Entra ID, Cisco Duo, JumpCloud, Qualys, Tenable, Rapid7, Wiz, Orca, Microsoft Defender for Cloud, Checkmarx, Proofpoint, Mimecast, Abnormal, Cofense, Microsoft Sentinel, KnowBe4, Cloudflare, Cisco Umbrella, Checkpoint, Microsoft Intune, Jamf Pro, VMware Workspace One, Axonius, Armis, and Atlassian Jira.

Is Onyxia SOC 2 certified?

Yes. Onyxia is SOC 2 Type II certified (AICPA audited) and ISO 27001 certified.

What compliance frameworks does Onyxia support?

Onyxia aligns to the NIST Cybersecurity Framework (NIST CSF) and MITRE ATT&CK, and supports compliance demonstration across SOC 2 and ISO 27001.

AI Governance — Onyxia Cyber

What is AI Governance?

AI governance is the framework of policies, controls, and oversight mechanisms an organization uses to ensure that artificial intelligence is adopted securely, used responsibly, and held accountable to business, regulatory, and ethical standards. It defines which AI systems are permitted, what data they may touch, who is responsible for their behavior, and how their risks are measured and managed over time. Unlike a one-time policy document – which describes intent – AI governance is an operational discipline that spans inventory, risk assessment, technical controls, monitoring, and incident response.

Why AI Governance Has Become a CISO Priority

AI adoption did not wait for permission. Employees bring generative AI tools into the enterprise faster than security teams can evaluate them, and the gap between usage and oversight has become its own attack surface.

The risk is not limited to employee misuse. AI systems introduce new exposure classes of their own — prompt injection, training-data leakage, model manipulation, and third-party AI embedded in vendor products. A cybersecurity program asks how to stop these attacks. An AI governance program asks a broader question: does the organization know every place AI is running, who owns it, and whether its risk is acceptable to the business?

AI Governance vs AI Security

AI security focuses on protecting AI systems themselves — defending models, training data, and pipelines against attacks like prompt injection and data poisoning, using taxonomies such as MITRE ATLAS and the OWASP LLM Top 10. AI governance encompasses AI security and extends beyond it: it covers policy, accountability, regulatory compliance, acceptable use, vendor risk, and board oversight for every AI system the organization builds or buys.

An AI security program asks how an attacker could compromise a model. An AI governance program asks whether the organization should be running that model at all — and who answers for it when something goes wrong.

The 5 Stages of Building an AI Governance Program

A mature AI governance program develops in stages, each producing a concrete artifact:

AI Inventory and Discovery. Identify every AI system in use — sanctioned tools, embedded vendor AI, and shadow AI — because no organization can govern what it cannot see.
Policy and Acceptable Use. Establish which tools are approved, what data classes may enter prompts, and how violations are reported, turning informal norms into enforceable rules.
Risk Assessment and Classification. Evaluate each AI use case against frameworks like the NIST AI RMF and the EU AI Act's risk tiers, so oversight effort matches actual exposure.
Governance and Accountability. Assign ownership through a cross-functional AI committee with clear decision rights, escalation paths, and executive sponsorship.
Continuous Monitoring and Measurement. Track governance performance with real metrics — inventory coverage, policy violations, vendor assessments, incident response times — and report them to the board in business terms.

The Frameworks Behind AI Governance

Security leaders don't have to choose one framework — the major standards answer different questions. The NIST AI Risk Management Framework defines what risks to manage, organized around its GOVERN, MAP, MEASURE, and MANAGE functions. ISO/IEC 42001 defines how to run the program, as the first certifiable AI management system standard. The EU AI Act defines what is legally required, scaling obligations by risk tier. And MITRE ATLAS and the OWASP LLM Top 10 define how attackers operate against AI systems. A strong program maps its controls across all of them, and can prove that alignment on demand

The Challenges of AI Governance

The hardest part of AI governance is not writing policy — it is achieving visibility. AI usage is fragmented across departments, browsers, and third-party products, and much of it runs through personal accounts that never touch corporate monitoring. Security teams inherit accountability for systems they did not select and often cannot see.

The second challenge is translation. Boards and regulators now expect AI risk reported in business terms — cost avoidance, regulatory standing, risk reduction — while most security teams still measure AI in technical fragments across disconnected tools. Without a unified, measurable view, AI governance remains aspirational rather than operational.

Frequently Asked Questions About AI Governance

Who is responsible for AI governance in an organization?

Increasingly, the CISO. 96% of CISOs now report responsibility for AI governance and risk management (CISO Report 2026), typically working through a cross-functional committee that includes legal, compliance, data, and business leadership. Effective programs assign a clear owner for every AI system in the inventory.

What is shadow AI, and why does it matter for governance?

Shadow AI is the use of AI tools by employees without IT or security approval — the AI-specific form of shadow IT. It matters because ungoverned tools handle sensitive data outside monitoring and controls — IBM linked shadow AI to breaches at 20% of breached organizations, at roughly $670K in added cost per breach. An AI inventory that surfaces shadow usage is the first step of any governance program.

What frameworks support AI governance?

The NIST AI Risk Management Framework (voluntary risk guidance), ISO/IEC 42001 (certifiable AI management system), and the EU AI Act (binding regulation in the EU) are the primary anchors, supported by MITRE ATLAS and the OWASP Top 10 for LLM Applications for AI-specific threats. Most organizations map controls across several rather than adopting one exclusively.

What role does AI play in AI governance?

AI is both the subject and the instrument of governance. Platforms like Onyxia use agentic AI to operationalize oversight — Nexa continuously monitors security performance across the data fabric, predicts compliance issues up to 30 days ahead, and turns governance findings into prioritized action plans — making AI governance measurable, not aspirational.

Onyxia for AI Governance

Onyxia's Operational Cyber Resilience Platform turns AI governance from a policy binder into a measurable security capability. The platform's cross-domain security data fabric — powered by 40+ integrations — unifies the signals governance depends on. Cybersecurity Performance Indicators (CPIs) mapped to NIST CSF, ISO 27001, and other frameworks make governance performance trackable in real time, while board-ready reporting translates AI risk into the language boards and regulators expect — business outcomes, not technical fragments.

Nexa, Onyxia's AI Security Agent, is governance in practice: Nexa Assist answers natural-language questions across the security data fabric, Nexa Mobilize builds AI-powered mitigation plans, and Nexa Predict forecasts security performance up to 30 days ahead — surfacing compliance issues before they become findings. And because Onyxia is a SOC 2 Type II, ISO 27001-certified, Validated AI Security Vendor, it meets the same governance bar it helps customers set.