Recent data shows that 59% of UK organisations experienced a cyber attack in the past year. As businesses integrate artificial intelligence into core operations, their exposure increasingly extends beyond their own systems to third-party models, datasets, APIs and AI services.
Traditional vendor audits are not enough for AI systems whose training data, model logic and development processes may be difficult to inspect. Data poisoning, model theft, prompt injection and unclear model provenance create risks that must be assessed continuously rather than at the point of procurement alone.
This guide explains how to identify vulnerabilities across the AI supply chain, assess third-party providers and monitor AI-related activity through Microsoft security technologies. It also considers the changing UK regulatory environment, including the proposed Cyber Security and Resilience Bill, which remains subject to the parliamentary process and may change before becoming law.
AI supply chain risk refers to vulnerabilities introduced through the external components and organisations involved in developing, delivering or operating an AI system. These dependencies may include third-party models, training datasets, cloud services, APIs, plugins, open-source libraries and outsourced development partners.
Unlike a conventional software supply chain, an AI supply chain depends on more than source code. The behaviour of a model can also be influenced by its training data, fine-tuning process, system instructions, connected data sources and subsequent updates.
This creates an assurance challenge. An organisation may have strong internal controls but still rely on an external model whose provenance, testing process or data-handling practices are not fully visible. When that model supports an important business process, weaknesses within the supplier environment can become risks to operational continuity, regulatory compliance and intellectual property.
Traditional software security focuses heavily on vulnerabilities in code, packages and update mechanisms. These controls remain important, but AI systems introduce additional risks that may not be resolved through conventional patching.
For example, an AI model may produce harmful or manipulated outputs because its training data has been poisoned. It may reveal sensitive information through carefully constructed queries or follow malicious instructions embedded in external content.
The priority therefore shifts from checking whether a component is technically up to date to verifying whether the wider AI system behaves securely and consistently. This requires visibility into how the model was developed, what data it uses, how it is tested and how changes are managed.
Employees often adopt public AI tools before formal governance processes are established. These tools can improve productivity, but they may also create unmanaged data flows and third-party dependencies.
Sensitive information can be entered into external platforms without a clear understanding of how prompts, uploaded documents or generated outputs are retained and processed. Security teams may also struggle to distinguish approved AI services from unsanctioned applications.
Managing shadow AI does not mean blocking every unfamiliar tool. It means creating enough visibility to identify which services are being used, what information they can access and whether their use aligns with organisational policy. For a broader governance approach, see CyberOne’s guide to governing the AI tools employees use.
The impact of an AI supply chain incident depends on the role the affected component performs. A compromised model used for experimentation presents a different level of risk from one that supports customer decisions, security operations or regulated services.
Organisations should evaluate threats according to the confidentiality of the data involved, the model’s permissions and the operational consequences of inaccurate or malicious output.
Data poisoning occurs when an attacker introduces manipulated or misleading information into a model’s training or fine-tuning data. The objective may be to reduce the model’s accuracy, introduce bias or create a hidden behaviour that activates when the model receives a particular input.
These weaknesses can be difficult for a customer to detect because they originate earlier in the AI lifecycle. Supplier assurance should therefore consider how providers source, validate and protect their training data, as well as how they test models for unexpected behaviour.
Model inversion involves using model responses to infer information about the data on which the system was trained. Depending on the model and its controls, this could expose personal information, proprietary research or other sensitive material.
Organisations should ask suppliers what safeguards prevent the model from revealing confidential training data and how these safeguards have been tested. Access controls, query monitoring and restrictions on model outputs can reduce exposure, but they do not remove the need for appropriate data governance.
Prompt injection attempts to manipulate an AI system through instructions contained in a user prompt or external source. Indirect prompt injection can occur when a model retrieves content from a website, message, document or plugin that contains malicious instructions.
The effect depends on the model’s permissions and connected systems. A model that only generates text presents less operational risk than an AI agent with access to email, business applications or sensitive data repositories.
Security teams should apply least privilege principles to AI integrations and treat retrieved content as untrusted input. They should also monitor the actions performed by AI-enabled services rather than relying solely on the text generated by the model.
Models, system prompts, configuration files and fine-tuning datasets may represent valuable intellectual property. Attackers may attempt to copy these assets through compromised development environments, exposed repositories or repeated interaction with a deployed model.
Controls should cover both the model endpoint and the systems used to develop, store and update it. Organisations should also clarify contractual ownership of models, outputs, fine-tuning data and derivative assets before integrating a supplier’s technology.
Open-source frameworks and models can accelerate AI development, but they may also introduce dependencies whose origin and maintenance status are unclear.
Teams should record where each component came from, which version is in use and whether it has been modified. Models and packages should be obtained from trusted sources, scanned before deployment and reviewed whenever they are updated.
A clear inventory makes it possible to identify affected systems quickly when a vulnerability or compromised component is disclosed.
A standard vendor questionnaire rarely provides enough information to evaluate an AI provider. The assessment must consider the system’s technical design, data lifecycle, permissions and role within the organisation.
The depth of assessment should reflect risk. A low-impact productivity tool does not require the same scrutiny as an AI service that processes personal data, automates decisions or connects directly to critical systems.
Begin by documenting each AI dependency and the business process it supports. The assessment should establish:
This information allows organisations to group suppliers into risk tiers and apply more detailed assurance to the services with the greatest potential impact.
Supplier assessments should examine where the model and its underlying components originated. Relevant questions include:
Not every provider will disclose proprietary model details. Where transparency is limited, organisations should document that limitation and decide whether alternative controls reduce the residual risk sufficiently.
AI suppliers should have defined processes for identifying, containing and reporting security incidents. Contracts should specify notification expectations, investigation responsibilities, evidence preservation requirements and access to relevant logs.
The proposed Cyber Security and Resilience Bill places greater emphasis on supply chain accountability and faster incident reporting for organisations within scope. However, the Bill remains under parliamentary consideration, so organisations should monitor its progress rather than treating proposed requirements as final law. [cyberone.security], [cyberone.security]
A structured assessment can help organisations identify gaps across governance, data protection, identity, monitoring and incident response.
CyberOne’s AssureMAP provides a method for mapping cyber maturity and prioritising improvement. When assessing AI dependencies, the review should include:
The outcome should be a prioritised improvement plan rather than a one-off compliance score.
Supplier assessments provide a snapshot of risk. They do not show how an AI service behaves after deployment or whether its activity changes over time.
Continuous monitoring can help organisations identify unusual API traffic, unexpected data movement, repeated authentication failures and anomalous access to sensitive systems. It can also provide evidence when investigating whether a third-party service contributed to an incident.
Microsoft Sentinel can collect and analyse security telemetry from connected applications, cloud services, identities and infrastructure. Where suitable logs are available, organisations can use this data to identify patterns such as:
Sentinel does not inspect the internal weights of a proprietary model. Its value lies in analysing the activity around the model, including identities, endpoints, integrations, API calls and data flows.
Organisations considering this approach can explore Managed SOC and Microsoft Sentinel services to strengthen monitoring and response across their environment.
AI services should receive only the permissions needed for their defined purpose. Microsoft Entra can support this by applying identity, access and authentication controls to users, applications and service identities.
Security teams should review privileged permissions, inactive integrations and service accounts that can access sensitive AI assets. They should also ensure that access is removed promptly when a supplier relationship, project or employee role changes.
For AI agents capable of performing actions, identity controls are particularly important. The organisation must be able to determine which human or service identity initiated an action and what permissions were used.
Microsoft Purview can support the discovery, classification and protection of sensitive data across Microsoft environments. These capabilities can help organisations understand which information may be exposed to AI tools and apply policies to reduce inappropriate sharing.
Purview does not replace supplier due diligence. It strengthens the organisation’s control over its own information before that data reaches a third-party model.
For security teams addressing unmanaged AI use, CyberOne’s guide to Microsoft Purview and shadow AI explains how visibility and data governance can support safer adoption.
Monitoring AI integrations can generate alerts that require technical context and investigation. MXDR as a Service combines security telemetry with continuous detection and response, helping organisations investigate suspicious activity across identities, endpoints, cloud services and third-party connections.
The objective is not to assume that every unusual model interaction is malicious. It is to establish enough context to determine whether the behaviour represents expected use, misconfiguration, compromised credentials or an active attack.
Managing AI supply chain risk requires more than selecting reputable technology providers. Organisations need a repeatable governance model that covers procurement, deployment, monitoring, incident response and supplier exit.
The following principles provide a practical foundation:
AI supply chain security is ultimately an operational discipline. Organisations that understand their dependencies, verify supplier controls and monitor behaviour are better positioned to adopt AI without losing control of their data or critical processes.
CyberOne’s AssureAI framework helps organisations assess AI-related risk, establish governance priorities and define a practical roadmap for secure adoption. Supported by Microsoft security expertise and managed detection capabilities, CyberOne helps connect governance decisions with the controls and monitoring needed to sustain resilience.
Contact CyberOne to discuss an AI supply chain risk assessment and establish where your most important dependencies, visibility gaps and control priorities sit.