Dynatrace adds dashboard for runtime vulnerabilities in AI services

Why AI services need their own view

According to Dynatrace, AI services are a fast-growing attack surface in production environments. The processes that run models, agents and inference pipelines tend to rely on open-source dependencies. These range from AI-specific frameworks such as LangChain and Hugging Face to more traditional libraries used elsewhere in a stack.

The company says the core problem is visibility and context. Any exploitable vulnerability in an environment can reach production, yet teams rarely have a focused view of which vulnerable code is running inside their AI workloads. The new dashboard is meant to make those findings easier to find and act on.

What the dashboard shows

The dashboard focuses only on GenAI entities in Dynatrace. AI processes are identified from GenAI Smartscape entities and checked for any vulnerability scan event. Only covered processes contribute to the vulnerability counts. For a current snapshot, Dynatrace suggests setting the timeframe to roughly the last 30 minutes, so the view reflects what is running right now rather than a historical rollup.

Four summary tiles give a quick read on posture:

• Vulnerability findings: the number of vulnerability-and-process pairs, which is higher than the unique count when the same vulnerability appears across multiple processes.
• Unique vulnerabilities: the number of distinct vulnerabilities detected.
• Affected processes: the number of processes carrying at least one vulnerability.
• Affected packages: the number of distinct packages with at least one vulnerability.

Below the summary, tables list each vulnerability with its severity, CVSS score and affected process count, alongside the affected packages. Dynatrace says this context lets teams triage and route work without leaving the dashboard.

Coverage and runtime context

The dashboard includes a dedicated Coverage section. Its table lists every AI process and whether RVA is scanning it. If a process shows "Not covered," RVA is not scanning it yet and its findings will not appear, which Dynatrace describes as a prompt to adjust monitoring rules. If no rows appear at all, there are either no running AI service processes or AI Observability is not instrumented. As Dynatrace puts it, a zero count is only reassuring if you know it is complete.

Because RVA works at runtime, the dashboard reflects vulnerabilities in code that is loaded and executing, not a static inventory of everything that might be installed. Dynatrace says this keeps noise down and helps security and platform teams find real and reachable vulnerabilities in production AI workloads.

Getting started

The dashboard is available now, and Dynatrace says no new queries are needed to populate it. Teams need to make sure their AI services are instrumented and RVA is enabled for the processes running them:

• Set up AI Observability so Dynatrace discovers GenAI entities. Dynatrace recommends instrumenting with OpenLLMetry.
• Set up Runtime Vulnerability Analytics and configure monitoring rules so RVA scans those processes.
• Open the dashboard, set the timeframe to the last 30 minutes, and check the Coverage section first if the view looks empty.

Once coverage is complete, Dynatrace says teams get a single, continuously updated view of runtime vulnerabilities in their AI services, ready to share with the teams who need to act on them.