Organizations increasingly rely on cloud vendors that are rapidly embedding artificial intelligence into SaaS platforms, managed services, and cloud-native applications. Although these capabilities can accelerate innovation, they also introduce a complex and often poorly understood cloud AI supply chain. When a vendor integrates embedding models, vector databases, agentic frameworks, model registries, AI APIs, or large language models from multiple cloud and fourth-party providers, customers may inherit security, privacy, and operational risks without having sufficient visibility into those dependencies.

This session breaks down the cloud AI supply chain into practical, accessible layers including cloud infrastructure, identity and access management, APIs, data pipelines, embedding services, vector databases, orchestration frameworks, and foundation models. It examines threats at each layer, such as excessive cloud permissions, exposed AI endpoints, insecure service identities, cross-tenant data leakage, model and data poisoning, compromised model artifacts, retrieval pipeline manipulation, secrets exposure, unauthorized data egress, and opaque fourth-party dependencies.

The session introduces the AI Bill of Materials (AI BOM) as a mechanism for identifying the cloud services, models, datasets, APIs, libraries, and external providers supporting a vendor’s AI capabilities. It also demonstrates how cloud-focused threat modeling can be applied to AI-enabled vendor platforms by mapping data flows, cloud trust boundaries, identities, control-plane dependencies, and cross-provider integrations.

GIAC and ISC2 members can earn CPE credits for attending this webcast live.

This webcast is sponsored by Wiz. Wiz transforms cloud security for customers with an operating model built to automate risk reduction and threat response, enabling security teams to operate at AI speed.