Open Model Watch: find exposed self-hosted LLM endpoints before attackers run up your bill

The endpoint census idea is already taken in pieces. CNAPP and AI-SPM vendors (Wiz, Orca, Palo Alto, Noma) find model servers inside cloud accounts. EASM and vulnerability scanners (Tenable, UpGuard, Indusface) and Shodan, Censys and LeakIX already flag unauthenticated Ollama from the outside. A mid-size fintech CISO who already pays for Wiz or Tenable will see a standalone census as a feature they mostly own. What none of the sources I found show is depth below "Ollama port open". That means vLLM, TGI, SGLang, LiteLLM proxies and generic OpenAI-compatible servers, checking which model is loaded and how much traffic it serves, and mapping each endpoint to the team that owns it. That could work as a wedge, but platforms can add it quickly. The spend tripwire looks much less contested. I found plenty of reporting on LLMjacking against self-hosted servers (GreyNoise, Kaspersky and CSA honeypot data, Sysdig's original research) and plenty of performance and cost observability (Langfuse, vLLM metrics, OpenLIT). I found no product that watches token throughput, prompt patterns and tool calls on a self-hosted endpoint to tell an autonomous attacker apart from internal users. A new entrant's best bet is to lead with that runtime detection. It could be sold as a lightweight sidecar or proxy, or through MSSPs, and feed alerts into the SIEMs banks already run, with the census as the free entry point rather than the main product. The risks are that Noma, Palo Alto (via Protect AI) or Sysdig add the same runtime signal, and that most fintechs run open weights at too small a scale for the spend loss to justify a separate purchase.

• Wiz AI-SPM

  Agentless AI-BOM that finds AI services, technologies and SDKs across cloud accounts and flags shadow AI through the Wiz Security Graph. It already covers the cloud-API half of the endpoint census for customers who run Wiz.

• Orca Security AI-SPM

  Agentless SideScanning that claims coverage of 50+ AI models and packages, managed and unmanaged, including shadow AI. Overlaps directly with discovering self-hosted model servers inside cloud accounts.

• Palo Alto Networks Cortex Cloud AI-SPM

  Finds AI software packages running on cloud workloads and markets this as shadow AI workload discovery. It is bundled into a platform that large banks already buy.

• Tenable Nessus (Ollama Unauthenticated Access plugin)

  A March 2026 plugin rates unauthenticated Ollama as critical (CVSS 10.0). Vulnerability scanners that banks already run now detect the most common exposure.

• UpGuard

  External attack surface management vendor that scans for exposed Ollama on port 11434 and publishes guidance on fixing it. Overlaps with the outside-in scan.

• Indusface

  Says its attack surface discovery finds exposed AI infrastructure, including publicly reachable Ollama servers.

• Noma Security

  Funded AI security platform that inventories models, agents and MCP servers and enforces guardrails at runtime. It is the closest single-vendor overlap with both product ideas, though its pitch is guardrails rather than spend or abuse.

• Cisco Talos Shodan research tool

  Research Python tool that uses Shodan to find unsecured Ollama endpoints. It shows the scanning technique is well known and easy to copy. It is not a commercial product.

• LeakIX

  Internet-wide leak search engine that counts and indexes exposed Ollama instances (12,269 with zero authentication). Gives anyone a ready data source for outside-in checks.

Checked 2026-10-23