Here’s a question worth asking at your next vendor review, and one most companies genuinely can’t answer: the AI feature sitting inside a tool you already approved — whose model is actually running underneath it? Not the vendor’s name on the invoice. The actual model provider, several layers down, that you never contracted with, never vetted, and quite possibly never heard of. That’s a fourth party, and it’s already inside your systems. Third-party involvement in breaches dou