Enterprise Data Warehouse & AI Pipeline Security Posture Kit

The highest-value data an organisation holds ends up concentrated in one place, and that place is now the raw material its AI is trained on, embedded from and given write access to. This kit treats those as one continuous risk surface: the SDLC discipline of protecting the warehouse itself, and the newer, far less mature discipline of governing what happens when AI is layered on top of it. Vendor-agnostic across Snowflake, Databricks, BigQuery and Redshift, because the failure modes are not vendor-specific.

The same platform, breached twice, two years apart, through different doors. In 2024 a campaign working from infostealer-harvested credentials reached more than 165 organisations and over 100 million people's records on one warehouse platform without exploiting a single platform vulnerability — every account hit lacked MFA, and the platform's own mandatory MFA rollout was not complete until two years later. In 2026 customers of the same platform were hit again through an entirely different vector: attackers breached a third-party AI analytics integrator with privileged warehouse access, stole its authentication tokens, and used them to steal data before extorting the victims. Same warehouse, entirely different failure mode. That is the whole argument for assessing the SDLC of protecting the data, not one control.

One BI tool as a skeleton key. A 2026 SQL-injection bug in a popular BI tool gave full administrator access from a single unauthenticated request — and because the tool stores connection credentials for every warehouse a customer connects, one BI-layer bug became a master key across five companies' entire data stacks. Vulnerability exploitation has overtaken stolen credentials as the top initial-access vector, and the third-party BI surface is scored accordingly.

The AI layer is not hypothetical, and the number to sit with is 95. A 2026 case documented by Wharton's AI & Analytics Initiative found an AI agent's back end open to basic, well-known attacks: 22 unauthenticated endpoints and a SQL-injection flaw gave full read-write access in under two hours, reaching 46.5 million plaintext chat messages, 3.68 million RAG document chunks and 95 writable system prompts controlling how the AI behaved for every user. Had that been an attacker rather than a research team, the outcome would not have been data theft alone. It would have been silently poisoned AI output, firm-wide, indefinitely. That single figure drove two of this kit's four blast-radius surfaces, and neither exists anywhere else in the series.

Why it happens: one table, three consumers. A single warehouse table is read by a Sunday retraining job, embedded by a RAG layer, and updated by a write-back agent — and the warehouse's role-based access control was written for none of them. It was written for an analyst with a query editor. That is file 01's teaching device and the reason the warehouse and the AI layer are one assessment rather than two.

What you get

01 Assessment Methodology (DOCX) — the incident history in two acts, the one-table-three-consumers device, the five modules, run order, cross-links and assumptions.

02 Identity & Access Review Workbook (XLSX) — MFA & Authentication (no exceptions, service accounts included, IdP federation), Network Access Policy (allow-lists, private connectivity), Role-Based Access (schema-scoped roles, read-only BI roles by default, review cadence, stale credentials) and Third-Party Integration Access (inventory, scope, token rotation), rolling into one identity posture score.

03 Blast Radius Scoring Tool (XLSX) — the flagship module. Record the Platform & AI Layer first — warehouse platform, whether an AI pipeline sits on it, which third-party tools connect — then answer the control questions across warehouse credential/access, third-party BI and analytics tools, AI/RAG pipeline exposure and AI write-back & system-prompt integrity. The AI rows score N/A where no pipeline exists. One score, a band on the same bands as every posture kit, and a closure list ranked by risk-weighted points.

04 Hardening Checklist (XLSX) — Warehouse Hardening, Integration Hardening (self-hosted BI tools patched and monitored, credentials rotated, read-only by default), AI-Layer Data Governance (separate explicit approval for AI ingestion, lineage into the AI layer, entitlement-filtered retrieval, purpose-specific service roles) and AI Write-Back & Integrity (system prompts stored with restricted write access and change monitoring, narrowly scoped write-back, training-data provenance, retrieval-to-response traceability). No benchmark covers this surface, so the README tab discloses the composite.

05 Data Governance Review (DOCX) — classification and lineage, separate governance approval for AI ingestion versus analytics use, and encryption and masking coverage — whether a table approved for a quarterly report is quietly also feeding a chatbot nobody signed off on.

06 Detection Readiness Matrix (XLSX) — from warehouse query history and audit logs, which are mature, through RAG retrieval logging and system-prompt change monitoring, which mostly do not exist yet anywhere. The gap between the two layers is the expected finding, and file 06 says so rather than treating it as a red flag unique to one client.

07 Executive Summary Template (DOCX) — one page with a plain-language section and a technical-detail section, because this kit's reader is as likely to be a data platform lead as a board.

data01.json — scoring bands, surfaces, platform-and-AI-layer components and the module map.

A worked example throughout. Rosewood Partners, a fictional professional-services firm with a warehouse and an internal AI assistant that retrieves from client engagement documents — MFA enforced for standard users and one legacy service account still exempt.

Where it sits. The Vibe-Coded App Security Posture Kit scores the AI-agent risk at the application layer this kit meets at the data layer. The cloud infrastructure trilogy covers the account the warehouse runs in; the GitHub / GitLab Security Posture Kit covers the pipeline code that moves the data; the Okta kit covers federated warehouse access. The TPRM Program Kit is where the privileged third-party integrator belongs. Above it all, The 2026 AI Risk Register is where these findings become governed risks, and the Shadow AI Inventory finds the AI tools that reached the data without approval. The IR Runbook Library is the response layer; hand file 07 to the Director's Cyber Oversight Kit.

Written against warehouse platform names and defaults, public incident reporting and AI-data-governance practice as of Q3 2026, marked verify. The AI-layer material moves faster than most of this series, and the files say so. Not a penetration test. Scores are a prioritisation aid, not a certification, an audit opinion or an insurance-underwriting determination. Not legal advice.