Security

Third-Party and Vendor Risk

• Dependency Review: A Checklist for Every Upgrade
• Vetting an Inference Provider's SDK Before You Add It
• Automating Dependency Review in CI: Checks, Gates and Failures
• Choosing an Inference Provider for Sensitive Agent Data
• Pinning Versus Floating: A Decision Rule for Production Deps
• Reading a Data Processing Agreement Against Your Feature
• Reading a Vendor SDK's Changelog for Breaking Changes
• Reading a Vendor SDK's Retry and Timeout Defaults Before You Ship
• Third-Party Risk Reviews for AI Vendors: a Questionnaire
• What Your AI Vendor's Incident Response Promise Actually Covers
• When the Gap Is in the Model Provider, Not Your Code