AI Supply Chain Risk

What is AI Supply Chain Risk?

AI Supply Chain Risk is the inherited cybersecurity, operational, and integrity exposure an organization incurs by integrating external, third-party, or open-source components into its artificial intelligence (AI) and machine learning (ML) systems.

While traditional software supply chain risk focuses on static code vulnerabilities, open-source libraries, and application dependencies, the AI supply chain encompasses non-deterministic and data-centric artifacts. It spans pre-trained foundation models, fine-tuning datasets, public model hub weights, prompt templates, vector databases, synthetic data pipelines, orchestration frameworks, and autonomous agent plugins. A compromise or manipulation at any upstream stage cascades directly into downstream enterprise workflows, corrupting model outputs, creating backdoors, or exposing proprietary data.

Primary Layers of the AI Supply Chain

The AI supply chain consists of five foundational layers, each introducing distinct security risks:

• Data Ingestion and Training Layer: External datasets, web-scraped corpora, third-party labeling services, and Retrieval-Augmented Generation (RAG) data stores used to pre-train or fine-tune models.

• Model and Weight Layer: Base foundation models, model checkpoints, parameter weights, and serialized model files downloaded from public hubs (such as Hugging Face) or accessed via commercial API providers.

• Framework and Orchestration Layer: Machine learning libraries (such as PyTorch, TensorFlow, and NumPy), orchestration tools (such as LangChain and LlamaIndex), and agent communication protocols (such as Model Context Protocol servers).

• Infrastructure and Inference Layer: Hardware accelerators (GPUs/TPUs), container images, cloud-hosted serving engines (such as vLLM and Triton), and inference API endpoints.

• Integration and Tooling Layer: Third-party extensions, web browsing plugins, enterprise database connectors, and automated execution webhooks assigned to autonomous AI agents.

Core Cyber Risks Across the AI Supply Chain

Integrating external AI assets exposes the enterprise to critical threats that traditional security controls often fail to detect:

• Model Serialization and Arbitrary Code Execution: Downloading pre-trained model weights stored in unsafe serialization formats (such as standard Python pickle files) enables attackers to embed executable payloads that run arbitrary code when the model artifact loads into memory.

• Training Data Poisoning: Malicious actors manipulate public training datasets or RAG knowledge repositories to inject covert biases, alter decision-making logic, or insert trigger phrases that force the model to fail under specific conditions.

• Pre-Poisoned and Backdoored Model Weights: Attackers upload backdoored models to public model hubs. While the model performs normally on standard evaluation benchmarks, it triggers specific malicious actions, generates misleading outputs, or bypasses safety filters when presented with a hidden adversarial trigger.

• Dependency Confusion and Package Hallucination Exploits: Threat actors exploit AI coding assistants that hallucinate non-existent software package names by publishing malicious libraries under those exact names to public repositories (such as PyPI or npm), leading developers or automated CI/CD pipelines to install rogue packages.

• Non-Human Identity (NHI) and API Key Exposure: Upstream AI vendors and downstream enterprise applications rely heavily on high-privilege programmatic credentials, API tokens, and service accounts. Compromising an upstream AI provider’s infrastructure can expose enterprise API keys, allowing attackers to hijack model instances or pivot into cloud environments.

• Silent Upstream Model Drift: Commercial foundation model providers frequently update, retrain, or adjust system instructions for hosted models without prior notice. These silent modifications can degrade enterprise application accuracy, break automated parsing routines, or disable security guardrails.

• Excessive Agency and Insecure Plugin Integrations: Autonomous AI agents granted external tool access (such as reading mailboxes, querying SQL databases, or making payments) inherit supply chain vulnerabilities if connected third-party tools lack granular, least-privilege permission controls.

Traditional Software Supply Chain vs. AI Supply Chain

Securing the AI lifecycle requires recognizing fundamental operational differences from traditional software security:

• Artifact Composition: Traditional software supply chains consist of deterministic source code, compiled binaries, and open-source libraries. The AI supply chain consists of non-deterministic model weights, probabilistic neural architectures, floating-point tensors, and vast training datasets.

  Vulnerability Tracking: Traditional supply chain risks are cataloged with distinct Common Vulnerabilities and Exposures (CVE) identifiers. In contrast, most AI supply chain risks stem from poisoned data, algorithmic logic manipulation, unsafe loading practices, and unverified data provenance that do not produce traditional CVE records.

• Inspection and Auditability: Static application security testing (SAST) and software composition analysis (SCA) can parse standard application code line-by-line. Model weights, however, function as opaque black boxes, so static text inspections cannot detect embedded backdoors.

Defensive Strategies to Mitigate AI Supply Chain Risk

Securing the AI supply chain requires continuous governance across development, procurement, and deployment:

• Implement an AI Bill of Materials (AI-BOM): Maintain an updated, machine-readable inventory documenting foundation model lineages, dataset provenance, fine-tuning configurations, training sources, licenses, and external API dependencies.

• Enforce Safe Model Loading Standards: Prohibit unsafe, executable model formats (such as pickle) in favor of secure, memory-mapped, tensor-only serialization formats like Safetensors.

• Cryptographic Signing and Provenance Verification: Validate digital signatures and cryptographic hashes of pre-trained model weights against trusted provider baselines using frameworks like Supply-chain Levels for Software Artifacts (SLSA) before deploying models into production environments.

• Continuous Vendor and Third-Party AI Assessment: Continuously assess external AI platform providers, cloud model hosting services, and third-party AI SaaS tools for security configurations, data retention policies, and public attack surface exposure.

• Isolate Inference and Execution Environments: Sandbox model execution environments and restrict network egress for autonomous AI agents, ensuring agents cannot directly access internal networks or execute unsanctioned system commands.

• Audit Non-Human Identities: Enforce least-privilege access, strict scoping, and automated rotation for all API tokens, webhooks, and service principals connecting internal systems to external AI models.

Frequently Asked Questions

What is the most critical difference between an SBOM and an AI-BOM?

A Software Bill of Materials (SBOM) details software libraries, package versions, and build dependencies. An AI Bill of Materials (AI-BOM) must also track data provenance, training dataset sources, model checkpoints, parameter weights, system prompt templates, and external inference endpoints.

How do attackers poison an AI model through the supply chain?

Attackers poison models by subtly altering public training datasets, injecting adversarial samples into web scraping pipelines, or uploading backdoored model weights to public repositories. When an enterprise fine-tunes or deploys these tainted components, the model exhibits targeted malicious behaviors when prompted with specific trigger phrases.

Why are standard vulnerability scanners insufficient for AI supply chain security?

Standard scanners search for known vulnerable software versions and CVE signatures in compiled code. They cannot analyze model weights for hidden backdoors, verify training dataset integrity, inspect vector embeddings for poisoning, or evaluate dynamic risks associated with autonomous AI agent integrations.

Mitigating AI Supply Chain Risk with ThreatNG

AI Supply Chain Risk encompasses the inherited vulnerabilities, unauthorized external data paths, untrusted model pipelines, and third-party dependencies introduced when enterprises integrate external foundation models, commercial Large Language Model (LLM) APIs, open-source model weights, and autonomous agent frameworks. Unlike traditional software supply chains that focus on deterministic code libraries and static dependencies, the AI supply chain is continuous, non-deterministic, and dynamic. Upstream compromises—such as poisoned datasets, backdoored model checkpoints, exposed non-human identity (NHI) credentials, or insecure external vector databases—cascade directly into internal business workflows.

Traditional internal risk assessments and static Third-Party Risk Management (TPRM) surveys rely heavily on subjective questionnaires, point-in-time attestations, and internal agent installations. This creates a severe visibility gap: security teams remain blind to unmanaged developer repositories, rogue third-party AI staging instances, unsanctioned external SaaS AI adoption, and leaked machine secrets that threat actors discover externally.

ThreatNG resolves this visibility gap by functioning as an unauthenticated external scout. By unifying External Attack Surface Management (EASM), Digital Risk Protection (DRP), and continuous Security Ratings into a single platform, ThreatNG discovers, evaluates, categorizes, and monitors an enterprise’s complete public digital perimeter and extended AI supply chain from an outside-in, adversary-centric perspective. By validating reachability, detecting exposed AI keys, mapping multi-stage supply chain exploit chains via DarChain, and delivering Legal-Grade Attribution, ThreatNG eliminates deployment friction without requiring internal software agents, API access keys, or administrative credentials.

External Discovery

Adversaries exploit transitive trust by scanning global infrastructure to locate unmanaged touchpoints between an enterprise and its upstream AI providers, contractors, and third-party SaaS vendors. ThreatNG identifies this extended perimeter through connectorless external discovery.

• Connectorless Supply Chain and Perimeter Discovery: ThreatNG maps the entire public-facing digital footprint using unauthenticated discovery with zero internal connectors, software agents, or network credentials. It inspects public domain registries, authoritative DNS zone files, SSL/TLS certificate transparency logs, Regional Internet Registry (RIR) databases, and global BGP routing tables to catalog every public IP block, subdomain, cloud environment, and web application connecting to external AI services.

• Patented Recursive Discovery Across AI Ecosystems: Starting from an initial seed (such as an apex domain, brand entity, or ASN), ThreatNG iteratively expands outward. As newly discovered subdomains, DNS records, or netblocks emerge, the engine feeds them back in as fresh discovery seeds. This recursive process uncovers developer test environments, unmanaged AI staging gateways, and third-party contractor environments hosting proprietary corporate data models across AWS, Azure, Google Cloud Platform, and regional hosting providers.

• Unauthenticated AI SaaS and Vendor Discovery (SaaSqwatch): ThreatNG discovers sanctioned and unsanctioned external AI vendors by monitoring public digital exhaust—including DNS CNAME routing chains, HTTP headers, and SSL/TLS certificates. It catalogs third-party dependencies across commercial model providers (such as OpenAI, Anthropic, and Cohere), vector database hosts (such as Pinecone and Weaviate), and autonomous agent frameworks without requiring internal access.

• Subsidiary, Acquisition, and Vendor Footprint Scoping: Because ThreatNG operates without internal credentials or vendor permissions, organizations can execute unauthenticated discovery across corporate subsidiaries, prospective acquisition targets, and third-party AI software vendors. This brings unmanaged AI footprints across the extended supply chain into a unified governance view.

• Adversary Lookalike and Typosquat Discovery: ThreatNG continuously discovers newly registered, typosquatted, and lookalike domain permutations (such as homoglyphs and transposed characters) registered across global domain registrars. It identifies active MX records and SSL/TLS certificates configured to impersonate approved third-party AI platforms or enterprise AI portals before adversaries launch credential-harvesting campaigns.

External Assessment

ThreatNG elevates AI supply chain evaluation from self-attestation questionnaires to deterministic, evidence-backed assessment using its Known Vulnerability Exposure Verification (KVEV) engine, proprietary Security Ratings, and 4-Dimensional (4D) Data Model. The 4D model cross-references National Vulnerability Database (NVD) baselines, 30-day Exploit Prediction Scoring System (EPSS) probabilities, CISA Known Exploited Vulnerabilities (KEV) listings, and verified Proof-of-Concept (PoC) exploit code in DarCache eXploit.

• Detailed Assessment Example 1: Non-Human Identity (NHI) and Leaked AI API Secret Assessment: ThreatNG evaluates external exposure variables—including open non-standard ports, accessible environment variables, public cloud configurations, and unvetted webhook endpoints—to locate exposed programmatic machine identities. It identifies hardcoded OpenAI API keys, Anthropic tokens, Hugging Face user tokens, and LangChain orchestration secrets. It computes an NHI Exposure Rating (A through F) to help teams revoke exposed machine secrets before adversaries use them to drain API budgets, hijack model instances, or compromise downstream applications.

• Detailed Assessment Example 2: Sensitive Code Exposure and Third-Party AI Pipeline Secrets: ThreatNG continuously monitors public code repositories (such as GitHub, GitLab, and Bitbucket) and paste sites for leaked corporate secrets. It detects proprietary application source code containing third-party AI integration keys, vector database connection strings, and webhook tokens committed by internal developers or external software contractors, providing exact commit URLs and author metadata to confirm valid leaks and neutralize exposed programmatic credentials.

• Detailed Assessment Example 3: Cloud Storage and Training Data Exposure Across Vendors: ThreatNG inspects public cloud storage containers (such as AWS S3 buckets, Azure Blobs, and Google Cloud Storage) across the extended perimeter. It evaluates Data Leak Susceptibility, assigning an A through F rating to flag open buckets containing proprietary training datasets, fine-tuning corpora, or exported model weights shared with third-party vendors, preventing unauthorized data exfiltration or training data poisoning.

• Detailed Assessment Example 4: Subdomain Takeover Susceptibility on Decommissioned AI Services: ThreatNG inspects discovered subdomains routing to third-party AI tools or cloud hosts for dangling CNAME records pointing to decommissioned services. The platform cross-references hostnames against an extensive catalog of over 60 cloud services and executes validation checks to confirm if the resource is unclaimed, assigning an A through F Subdomain Takeover Susceptibility rating to stop attackers from hijacking trusted corporate subdomains to host malicious AI prompts or rogue bots.

• Detailed Assessment Example 5: Known Vulnerability Exposure Verification (KVEV) on AI Infrastructure: When ThreatNG discovers an exposed AI gateway, model inference API, or MLOps portal (such as MLflow, Ray, or Kubeflow) operated by an enterprise or key vendor, the KVEV engine performs live, unauthenticated checks. It evaluates 30-day EPSS weaponization probabilities and verified exploit code in DarCache eXploit to confirm whether the host is vulnerable to unauthenticated remote code execution flaws.

Strategic Reporting

ThreatNG standardizes the communication of AI supply chain risks by converting raw external discoveries, infrastructure graphs, and technical exposure telemetry into structured, auditable records for technical practitioners, executive leadership, and compliance auditors.

• Executive Security Ratings Reports: ThreatNG converts complex vulnerability metrics, exposed configurations, and digital risk indicators into standardized A through F security ratings across categories including Cyber Risk Exposure, Data Leak Susceptibility, Supply Chain & Third Party Exposure, and Non-Human Identity (NHI) Exposure. This lets CISOs present empirical third-party exposure trends and AI risk-reduction metrics directly to executive boards.

• Correlation Evidence Questionnaires (CEQs): ThreatNG dynamically generates Correlation Evidence Questionnaires based on confirmed external discovery and assessment results. The CEQ acts as an EASM-to-Audit Translation Layer, transforming unauthenticated outside-in discoveries into targeted, auditable inquiries mapped directly to regulatory frameworks across four functional pillars: Technical, Strategic, Operational, and Financial.

• Defensible Regulatory Compliance Mapping: ThreatNG maps discovered external AI exposures, shadow models, and exposed secrets directly to key regulatory frameworks and reporting mandates, including ISO 42001 (Artificial Intelligence Management System), the EU AI Act, the NIST AI Risk Management Framework (AI RMF), MITRE ATLAS, SEC Form 8-K material breach disclosure rules, and SOC 2.

• Forensic Evidence Packages: When ThreatNG verifies an active vulnerability on an AI server, an exposed vector database, a leaked third-party secret, or a dangling DNS record, it generates a detailed forensic evidence package containing technical markers, DNS resolution histories, HTTP response headers, affected URLs, and proof of ownership to support vendor accountability, engineering remediation, and audit substantiation.

Continuous Monitoring

Because third-party AI vendors deploy frequent updates, developers push continuous CI/CD commits, and external dependencies shift dynamically, periodic vendor audits fail to maintain protection. ThreatNG delivers 24/7 continuous external surveillance across the extended digital footprint.

The platform tracks asset state changes, newly registered subdomains, modified DNS records, fresh certificate issuances, and emerging supply chain exposures in real time. Automated real-time observation captures supply chain drift immediately: if a contractor exposes a staging environment or a vendor's inference gateway suffers a configuration error, ThreatNG detects the configuration drift instantly. Furthermore, ThreatNG incorporates its Overwatch capability—a cross-entity vulnerability intelligence system that instantly evaluates exposure across an entire portfolio of subsidiaries, business units, and supply chain partners whenever a zero-day vulnerability affecting an AI framework or model server is disclosed, identifying every affected external asset within seconds.

Investigation Modules

ThreatNG features specialized investigation modules that allow security analysts to investigate discovered infrastructure, trace developer leaks, and evaluate the full technical context of AI supply chain exposures.

• Detailed Module Example 1: The DarChain Exploit Path Mapping Engine: DarChain (Digital Attack Risk Contextual Hyper-Analysis Insights Narrative) chains isolated technical, credential, and environmental exposures into predictive attack graphs. For example, DarChain maps how an attacker discovers an unmanaged staging subdomain maintained by a third-party developer, correlates that finding with a leaked Hugging Face API key identified in a public code repository, and demonstrates how that path leads directly to proprietary vector embeddings in production cloud storage, pinpointing the critical Attack Path Choke Point needed to sever the chain.

• Detailed Module Example 2: Sensitive Code Exposure Module: ThreatNG continuously monitors public code repositories (such as GitHub, GitLab, and Bitbucket) and paste sites for leaked corporate secrets. This module uncovers hardcoded OpenAI keys, Hugging Face tokens, Pinecone API credentials, private SSH keys, and database connection strings committed by internal developers or third-party contractors, providing exact commit URLs and author metadata to confirm valid leaks and neutralize exposed AI credentials.

• Detailed Module Example 3: Cloud and SaaS Exposure Module (SaaSqwatch): This module investigates public cloud storage environments and unauthenticated SaaS deployments. It actively scans for exposed open cloud buckets and data repositories across AWS S3, Azure Blob, Azure Data Lake, and Google Cloud Platform, while identifying unsanctioned third-party AI platforms and autonomous agent services used by employees or vendors without security oversight, allowing security teams to close unauthenticated entry points before adversaries discover them.

• Detailed Module Example 4: Domain Intelligence and Subdomain Intelligence Modules: The Domain Intelligence module analyzes DNS records, SSL/TLS certificate chains, and IP infrastructure. Concurrently, the Subdomain Intelligence module catalogs HTTP and HTTPS status codes (100–599) and performs deep Header Analysis, evaluating server version banners and redirect chains on AI endpoints to identify misconfigured reverse proxies and exposed model APIs.

• Detailed Module Example 5: Cybersecurity AI Prompts (DarcPrompt): DarcPrompt packages verified AI supply chain exposure context and attack path discoveries into structured prompt blueprints. Featuring specialized personas—such as Shadow IT and AI, External Attack Paths, and External GRC Assessment—DarcPrompt applies strict architectural constraints that bind the prompt to ThreatNG's proprietary ground truth. Through an Air-Gapped Handoff, security analysts safely copy these blueprints into their internal private enterprise AI systems to draft vendor risk assessments, ISO 42001 audit responses, and executive risk briefings without exposing sensitive asset data to public AI services.

Intelligence Repositories

ThreatNG centralizes and structures threat intelligence through the DarCache intelligence engine, providing an interconnected dynamic ecosystem that grounds AI supply chain defense in empirical adversary reality:

• DarCache Vulnerability & eXploit: Integrates NVD baselines, CISA KEV listings, 30-day EPSS probabilities, and verified PoC exploit pointers to evaluate whether external AI servers and third-party inference gateways host software flaws that are actively weaponized in the wild.

• DarCache Dark Web & Rupture: Scans underground forums, paste sites, and dark web sources for threats to brand assets and personnel, while tracking compromised corporate credentials, session cookies, and data leaks across all domain permutations.

• DarCache Infostealer: Parses dark web logs for compromised corporate credentials and active browser session tokens, allowing teams to neutralize stolen accounts before attackers use them to access third-party AI platforms or enterprise developer consoles.

• DarCache Ransomware: Tracks active ransomware cartels and their specific tactics, techniques, and procedures (TTPs), monitoring threat actor targeting patterns directly against an organization's extended supply chain footprint.

• DarCache Bug Bounty: Aggregates and analyzes historical bug bounty program disclosures, researcher activity trends, and crowdsourced exploit patterns to evaluate AI assets and public endpoints under active scrutiny by external researchers.

• DarCache Mobile: Detects hardcoded AI access credentials, API keys, and model-serving URLs embedded in public mobile applications.

• DarCache 8-K & ESG: Tracks SEC Form 8-K filings and global ESG violations, providing non-technical governance indicators that correlate with corporate cyber risk and vendor stability.

• DarCache BIN: Monitors Bank Identification Numbers (BINs) to identify and prevent potential payment card fraud across digital transactional services.

Cooperation with Complementary Solutions

ThreatNG functions as an external intelligence scout that cooperates seamlessly with complementary solutions across the enterprise governance, risk, and supply chain operations ecosystem.

• Cooperation with Third-Party Risk Management (TPRM) and Vendor Risk Platforms: ThreatNG feeds continuous, objective A through F security ratings, supply chain exposure metrics, and dynamically generated Correlation Evidence Questionnaires into complementary solutions (TPRM and vendor risk management platforms). Risk teams use this outside-in telemetry to validate vendor security questionnaires with real-world technical data, monitoring AI SaaS suppliers continuously rather than relying on annual self-attestations.

• Cooperation with AI Security Posture Management (AI-SPM) Solutions: ThreatNG pushes unauthenticated outside-in discovery data—such as discovered shadow AI endpoints, rogue LLM gateways, exposed vector databases, and unmapped AI subdomains—directly into complementary solutions (internal AI-SPM platforms). While internal AI-SPM tools evaluate prompt safety, model weights, and pipeline configurations within known environments, ThreatNG acts as an external discovery scout, uncovering third-party AI connections and shadow infrastructure where internal tools were never deployed.

• Cooperation with Security Orchestration, Automation, and Response (SOAR): ThreatNG delivers pre-correlated Context Objects, verified third-party credential leaks, and DarChain attack paths to complementary solutions via an API. When ThreatNG identifies an exposed Hugging Face token or OpenAI key belonging to a third-party vendor, the SOAR platform automatically executes containment playbooks, revoking the API key, alerting vendor security contacts, and opening high-priority Jira tickets.

• Cooperation with Cyber Asset Attack Surface Management (CAASM) and CMDBs: ThreatNG feeds external supply chain asset inventories, newly discovered partner subdomains, and shadow IT infrastructure into complementary solutions (CAASM platforms and configuration management databases). IT and procurement teams use this feed to reconcile external discoveries against internal vendor catalogs, ensuring every external AI integration is mapped and governed.

• Cooperation with Security Information and Event Management (SIEM) and Data Loss Prevention (DLP): ThreatNG feeds discovered external AI endpoints, third-party indicators of compromise (IoCs), and brand threat data into complementary solutions. SOC analysts correlate internal network event logs and egress traffic against confirmed external AI entry points to detect unauthorized data extraction to unapproved third-party models.

Examples of ThreatNG Helping Organizations

• Identifying an Exposed Third-Party Fine-Tuning Pipeline: A third-party machine learning consultancy contracted to fine-tune a customer service model deployed an unmonitored staging gateway on a subdomain pointing back to the enterprise's domain space. ThreatNG’s recursive discovery engine uncovered the subdomain, and the External Assessment revealed that the host was running an unauthenticated MLOps dashboard containing fine-tuning datasets with proprietary customer transaction histories. ThreatNG generated an alert and forensic package, enabling the enterprise to require the contractor to secure the interface immediately before external threat actors could scrape or tamper with the training data.

• Neutralizing Leaked Third-Party AI API Credentials in a Public Developer Commit: An external software development agency building an AI-powered search tool committed an application configuration file containing production Anthropic and Pinecone API keys to a public GitHub repository. ThreatNG’s Sensitive Code Exposure module discovered the repository within minutes of the commit. ThreatNG validated that the keys were active and used DarChain to map their connection to corporate cloud resources. ThreatNG generated an alert with exact commit timestamps and repository URLs, allowing security engineers to revoke the keys and update vendor access policies before attackers could exploit the credentials.

Examples of ThreatNG Working with Complementary Solutions

• Working with TPRM and Vendor Portals to Replace Questionnaires with Empirical Data: ThreatNG discovers that a critical third-party AI analytics vendor has multiple unpatched vulnerabilities listed on the CISA KEV catalog and an exposed cloud storage container, downgrading the vendor's Supply Chain & Third Party Exposure rating to an F. ThreatNG transmits a pre-populated Correlation Evidence Questionnaire and forensic evidence package to complementary solutions (a TPRM platform). The TPRM platform automatically triggers a vendor security review, requiring the vendor to remediate the exposed storage bucket before renewal.

• Working with SOAR and IAM to Revoke Compromised Partner Machine Secrets: ThreatNG detects an exposed service account token used by an external AI vendor committed to a public paste site and transmits a Context Object to complementary solutions (a SOAR platform). The SOAR platform triggers complementary solutions (enterprise IAM systems) to immediately revoke the exposed token, generate a replacement credential, and notify the vendor's technical lead, neutralizing the access vector without operational downtime.

Frequently Asked Questions

How does ThreatNG discover AI supply chain risks without internal access to vendor networks?

ThreatNG functions entirely as an unauthenticated external scout. It continuously analyzes public DNS records, CNAME routing chains, SSL/TLS certificate transparency logs, BGP routing announcements, public code repositories, and internet-facing port handshakes across the open internet, discovering external AI dependencies, partner connections, and third-party SaaS implementations strictly from an external adversary's viewpoint.

How does ThreatNG evaluate Non-Human Identity (NHI) risks in the AI supply chain?

ThreatNG evaluates external exposure variables—including open ports, public cloud storage configurations, and public code repositories—to identify exposed machine identities such as API keys, service principals, and webhook tokens. It assigns an NHI Exposure Rating (A through F) to help organizations identify and revoke leaked machine secrets before adversaries use them to bypass perimeter controls.

How does ThreatNG support AI governance under frameworks like ISO 42001 and the NIST AI RMF?

ThreatNG continuously maps discovered external AI assets, third-party dependencies, and security ratings directly to frameworks like ISO 42001, the EU AI Act, and the NIST AI RMF. It generates Correlation Evidence Questionnaires (CEQs) and forensic evidence packages that provide auditors and risk managers with empirical, machine-verified proof of external AI governance and supply chain risk management.