Security & Privacy
Supply-chain risk
Risk introduced through third-party software, models, datasets, packages, or services.
Example
A compromised package quietly sends application secrets to an attacker.
Why it matters
It makes dependencies visible before problems in another product affect yours.
You'll hear it
“This update comes from a component we don't maintain ourselves.”
Can you control it?
Set by the team
The people building or running the AI choose this setup. An everyday user generally needs their help to change how this part works.
Common questions
- Does a trusted supplier remove all risk?
- No. Mistakes, compromised updates or changed services can still affect customers.
- Can an indirect supplier matter?
- Yes. A product may depend on components from companies you do not deal with directly.
- Does checking a supplier once cover future updates?
- No. Changes can introduce different behavior or weaknesses.