A security review that approves the foundation model and stops there misses most of the system around it. Risk in an AI application enters through the packages it installs, the datasets and model files it loads, the adapters and merges layered on top, the build pipeline that packages it, the agent tools it can call, and the external APIs that receive its data. Seven entry points cover those handoffs: packages and transitive dependencies, datasets and fine-tuning inputs, pretrained model artifacts, adapters and merge or conversion workflows, build pipelines and artifact distribution, agent tools and MCP servers, and third-party model APIs.
This seven-part grouping is our synthesis of OWASP and NIST guidance; neither publisher issues this exact list. Conventional package and CI/CD controls still apply. What AI systems add is model and dataset provenance, adapters, and agent tool integration.
As an Amazon Associate I earn from qualifying purchases.
The seven entry points
1. Packages and transitive dependencies
AI applications depend on libraries for development, fine-tuning, inference, connectors, SDKs, and vector database clients, and each of those brings its own dependencies. A flaw or malicious update several levels down can reach production even though no one reviewed it by name.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Questions to ask:
- What is the full resolved dependency tree, including transitive packages, rather than the lines in the top-level manifest?
- Which registry supplied each package, and at which exact version?
- Is the package still maintained, with recent releases and a working route for security reports?
- Can build or runtime resolution change what gets installed between two runs?
2. Datasets and fine-tuning inputs
Poisoned or manipulated training data can change model behavior in ways code review will not catch. Licensing is a separate exposure: a dataset license may limit use, distribution, or commercialization, and those limits carry over to any model trained on that data.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Ask where each dataset came from, what rights attach to it, whether its integrity has been assessed, and whether external data was tested in isolation before it reached training or fine-tuning.
3. Pretrained model artifacts and repository provenance
A model pulled from a public repository can be outdated, tampered with, backdoored, or published under a lookalike name that makes it appear to come from a trusted source. A model card describes the model. It does not prove where the file came from or that the file matches what the publisher released.
Ask whether the publisher’s identity is verified, whether the version is immutable, whether the artifact matches a checksum or signature you obtained independently, what its provenance and maintenance status are, and whether you have run your own tests against it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Adapters, merges, and conversion workflows
LoRA adapters and shared model-merging or format-conversion services form a trust boundary separate from the base model. A malicious adapter can change how a trusted base model behaves once loaded. Collaborative workflows can also move changes into a model outside the ordinary code review path.
Ask who produced each adapter, what went into each merge, which conversion tool and version touched the weights, and whether the output was checked after the transformation as well as before it.
5. Build pipelines and artifact distribution
CI/CD pipelines turn source code into tested, packaged, deployed releases. A compromised build system, registry, or manifest can substitute an artifact or insert configuration nobody reviewed. Because the pipeline output is what runs in production, the pipeline is part of the AI supply chain even when the application code is clean.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Ask who holds the build identity and its secrets, which inputs the build pulls in, whether provenance records are produced for each release, and whether the deployed artifact is checked against those records.
6. Agent tools, MCP servers, connectors, and plugins
Tools decide what an agent can read, change, and execute. OWASP’s MCP Top 10, a list of risks for the Model Context Protocol, covers tool poisoning, dependency tampering, excess scope, command execution, weak authentication, missing audit telemetry, and shadow servers. It is a beta project that OWASP says remains subject to further review and release. In entry MCP04:2025 it states: “A compromised dependency can alter agent behavior or introduce execution-level backdoors.”
Ask which servers and tools exist in your environment, including any a team connected without approval; what each can reach over the network and filesystem; how callers authenticate; whether tool schemas and updates are reviewed when they change; and whether consequential actions are logged.
7. Third-party model APIs and service providers
Every prompt sent to an external model API moves data outside your control. Review the provider’s data handling and retention, terms, privacy commitments, authentication and transport security, availability, and subcontracted dependencies, meaning the suppliers the provider itself relies on. Record which categories of data leave the organization, not only which APIs are approved.
For APIs that handle sensitive information, a March 2026 Cloud Security Alliance note recommends encryption in transit, mutual authentication, and immutable audit logging. That is an industry recommendation, not a binding standard.
Free tools Windows power users keep installed
One-click scans. No signup required.
Questions to ask at every handoff
Run each entry point through the same seven questions:
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Who supplied it?
- What exact version or artifact is in use?
- Can its origin and integrity be checked independently?
- What can it read, change, execute, or send?
- How is it updated?
- Which downstream systems inherit its behavior?
- What logs or evidence would reveal a compromise?
Rank the answers by business criticality, privilege level, access to sensitive data, reach, blast radius, and how easily a compromise would be detected. A dataset feeding an internal prototype deserves less scrutiny than a model artifact serving customer-facing answers with access to records.
NIST SP 800-161 Rev. 1 Update 1 frames cybersecurity supply chain risk management (C-SCRM) as multilevel risk management across products and services. Tie AI component reviews to enterprise, mission, and system-level risk processes. An isolated model checklist sits outside the procurement and incident-response processes that would act on its findings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls, mapped to the entry points
Each control addresses one or more entry points. The inventory comes first, because every other control needs a list of what it is protecting.
Recommended Free Tools
| Control | Entry points | What it involves |
|---|---|---|
| Component inventory | All seven | Track models, datasets, adapters, packages, and tool integrations in one register. OWASP describes AI bills of materials and ML SBOM practice as emerging rather than universally settled, so choose a format your tooling can read, and sign entries where your tooling supports it. |
| Version pinning and approved sources | 1, 3, 5 | Pin exact versions, avoid floating “latest” references, and pull from approved registries or internal mirrors. |
| Integrity verification | 3, 4, 5 | Check hashes, signatures, and attestations before an artifact loads or deploys, and repeat the check after any merge or conversion. |
| Dependency scanning | 1 | Run software composition analysis that includes transitive dependencies. It identifies known vulnerabilities in packages; it does not establish model or dataset provenance, which needs separate review. |
| Build pipeline protection | 5 | Protect CI/CD identities, secrets, build inputs, manifests, and release artifacts, and apply supply-chain controls across the build, test, package, and deploy stages. NIST SP 800-204D addresses software supply-chain security in CI/CD pipelines. |
| Sandboxing and permission limits | 6 | Run third-party plugins in a sandbox and restrict their filesystem and network access. |
| Supplier evidence | 3, 7 | Review supplier security processes and request signed evidence where appropriate. A questionnaire is not conclusive artifact assurance. |
What the usage figures show, and what they do not
The figures below come from Yujie Ma, Lili Quan, Xiaofei Xie, Qiang Hu, Jiongchi Yu, Yao Zhang, and Sen Chen’s 2025 preprint, which analyzed real-world LLM applications and the models, datasets, and libraries they use.
| Measure | Reported figure | Scope |
|---|---|---|
| Real-world LLM applications analyzed | 3,859 | Applications in the study sample |
| Models identified | 109,211 | Identified in the analyzed ecosystem |
| Datasets identified | 2,474 | Identified in the analyzed ecosystem |
| Libraries identified | 9,862 | Identified in the analyzed ecosystem |
| Risk-related issues collected | 1,555 | Issues collected across the study |
The model, dataset, and library counts are identified entities in the study, not a census of every LLM application. The 1,555 issues are not a vulnerability rate and should not be converted into one. The practical point is scale: an application can depend on many models, datasets, and libraries that nobody has listed, which is why the inventory comes first.
How current the guidance is
The labels below are the ones each publisher applies to its own document.
Quick Recap
- OWASP LLM03:2025 (Supply Chain): project guidance for LLM applications, not a standard.
- OWASP MCP Top 10: a beta project that OWASP says remains subject to further review and release.
- NIST SP 800-161 Rev. 1 Update 1: a final government publication on cybersecurity supply chain risk management across products and services.
- NIST SP 800-204D: a final government publication covering software supply-chain security in CI/CD pipelines.
- March 2026 Cloud Security Alliance note: an unofficial, AI-assisted note. Its recommendations can shape review questions, but its predictions about future compliance are forward-looking inference, not established requirements.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
