AI vendor dependency is becoming a resilience risk | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

AI vendor dependency is becoming a resilience risk

AI use will be determined by governance and resilience strategies

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Now that AI has quickly become embedded in global enterprise operations, it has the ability to impact everything from data analysis to decision-making and even security.

Most conversations, however, focus on AI capability, power, productivity, and accuracy, but leave out one major issue.

While everyone is focused on what happens as AI is implemented, very few are asking what happens when access to AI capability suddenly disappears.

Director of Security & Regulatory Services at Origina.

A prominent example of this is the debate around Anthropic restoring access to its Fable and Mythos AI models, which primarily revolved around compliance timelines and export control mechanics.

Yet, few have questioned why so many organizations discovered that one external decision, out of their control, removed a business-critical capability seemingly overnight. In short, AI access disruptions are a symptom of a much larger operational resilience issue, and expose an overlooked governance gap around dependency.

Mythos shows why AI governance must catch up to the speed of risk discovery

Understanding cyber resilience in the age of internal threats, AI, and emerging data loss risks

As organizations integrate AI deeper into their business operations, they need to shift their focus from exploring whether AI is secure enough right now to start asking whether their organizations can even continue operating if or when those very AI services become unavailable.

These little discussed topics bring up an important point that security and resilience are not synonymous.

Security prevents and protects systems from compromise. This keeps attackers from gaining access, reduces the number of vulnerabilities, and defends against malicious entities - all crucial elements of security operations. Resilience is the ability to continue business operations when systems, services, or data become unavailable, regardless of the cause.

We tend to associate resilience with situations such as cyberattacks or IT infrastructure failures. AI has changed the threat landscape for organizations, how they work with AI, and protect themselves from it. Organizations must now increasingly plan for disrupted access to critical tools and functions caused by geopolitical decisions, regulations, or changes made by technology providers themselves.

A service doesn't have to be hacked to become unavailable. A policy decision on the other side of the world can have the exact same operational effect. We saw exactly that with Anthropic.

Why cybersecurity needs hybrid AI, not platform consolidation

AI agents in live operations require new standards and management

With this in mind, resilience has to be built into how the enterprise operates and include any new AI infrastructure, so business continuity is ensured even through policy interference.

Where traditional software dependency usually involves a single or small amount of vendors, enterprise AI often depends on an interconnected ecosystem that organizations do not own or control. Every additional layer in the AI ecosystem represents a dependency, and therefore a potential point of failure.

This creates four risk factors that leadership needs to be mindful of:

Data sovereignty: Enterprise data may be processed under legal jurisdictions the organization doesn't control, with limited visibility into who can access it or whether it feeds future model training

Model sovereignty: Organizations often have little to no control over model availability, feature capabilities and changes, or access decisions, leaving them exposed if a provider suddenly decides to restrict access or withdraw capabilities.

Infrastructure dependency: Much of today’s enterprise AI ecosystem relies on a small handful of cloud providers operating under specific national jurisdictions.

AI supply chain risks: An interconnected system of foundation models, cloud platforms, and software vendors means disruption at even one layer can quickly cascade across the wider technology stack.

These factors increasingly depend on geopolitics rather than technology.

The reality is that a vendor contract alone cannot guarantee uninterrupted access to the tools and platforms that an enterprise has invested in. But governance frameworks haven’t truly evolved to account for this issue. Only newly emerging frameworks like NIS2 and DORA recognize that resilience must go beyond fending off cybersecurity threats.

Best practice for an organization as they approach vendor contracts and governance frameworks of their own is to understand where dependencies lie across suppliers and develop contingency plans that allow them to operate smoothly through eras of disruption.

Whether the dependency is within an AI platform, ITSM solution, a CRM, or another business critical technology, organizations should assess how they would continue operating if access changed overnight. AI should be subjected to the same scrutiny as any other critical third-party vendors.

Begin Resilience Frameworks Before the Next Disruption

On top of this, boards should be cautious about accepting AI capability claims at face value. Organizations should require evidence that vendor claims deliver measurable outcomes.

While AI can quickly identify an overwhelming amount of potential vulnerabilities, discovery alone does not improve resilience. Human expertise here remains essential to validate findings, prioritize fixes based on order of immediate business impact and ensure resources are focused where true risk exists.

The biggest lesson from recent AI disruption is how many organizations have underestimated their dependence on technologies they don’t have assured control over. And with renewed conversation from U. S. legislators around a potential AI “kill switch,” this has to be top of mind.

Business leaders must recognize that with all the opportunity AI unlocks, the risk of vendor dependency is close to follow. If I were head of technology at a major enterprise today, I would ensure teams across the entire technology and security departments understand where critical AI capabilities originate, the dependencies that exist across the supply chain, and how operations can remain resilient if access changed overnight.

Ultimately, the future of successful enterprise AI use will be determined by organizations baking governance and resilience strategies into business plans so that through commercial, political, and operational disruptions, business can continue as securely as usual.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Director of Security & Regulatory Services at Origina.

You must confirm your public display name before commenting

NATO wants thousands of AI drones guarding its borders — but there’s one thing they won’t be allowed to do

Tesla’s Robotaxi gets caught crashing through bollards, just as it readies the purpose-built Cybercab for public roads

US Space Force and Japan launch new satellites to boost surveillance across the Pacific and further beyond

Apple TV 4K fans are begging for these 3 upgrades from the leaked Siri Remote — but one is already possible today

Ukraine drone maker launches self-driving wagon capable of lugging 210kg across bumpy terrain — could this be its next secret weapon to turning the tide of war?

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards