How Dynatrace identifies vulnerable AI services through RVA and AI observability

The article explains how a CISO can determine which AI services on the Dynatrace platform contain vulnerable libraries and actually run in production. A repository export is insufficient because listed dependencies are not necessarily loaded at runtime. Dynatrace combines Runtime Vulnerability Analytics with AI observability, using a ready-made dashboard that matches GenAI entities in Smartscape against RVA scan events. The author warns that a zero vulnerability count can be misleading, since unscanned AI services may appear clean, so coverage must be checked first. The piece also covers OpenInference instrumentation requirements, including endpoint and token scope details, and notes that the author could not verify whether the features apply to SaaS or Managed deployments.