OWASP Top 10 for LLM Applications, 2025
LLM03: Supply Chain
LLM supply chain risk is the chance that something you did not build is compromised before it reaches your application. OWASP says the supply chain is exposed at the level of training data, models and deployment platforms, and that machine learning adds risks beyond ordinary code and dependency flaws, because third-party pre-trained models and data can be tampered with or poisoned.
Supply Chain in more detail
Open-access models, LoRA and PEFT fine-tuning, collaborative model development and on-device models each add new ways in. A published model may have weak provenance, so an attacker can compromise a supplier account or pose as one. Licensing is part of the risk too, since models and datasets come under many different terms. This is the risk that model scanners, signing tools, AI bills of materials and registry controls address.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- An outdated or deprecated package or model that nobody patches stays in production.
- A pre-trained model carries a hidden backdoor or bias that evaluations did not reveal.
- A published model has weak provenance, so a compromised supplier account ships a tampered version.
- A malicious LoRA adapter compromises a base model when the two are merged.
- Terms and privacy policies change and the operator starts using your application data for training.
Controls that reduce it
- Vet data sources and suppliers, including their terms and privacy policies, and re-check them regularly.
- Use models only from verifiable sources, and check integrity with signatures and file hashes.
- Keep a signed software bill of materials, and evaluate AI and ML bills of materials such as CycloneDX.
- Patch components and use maintained APIs and model versions.
- Run red teaming and evaluations on third-party models for your own use cases, since benchmarks can be gamed.
- Track licenses through the bill of materials and audit them on a schedule.
Controls reduce risk, they do not remove it
No single control covers supply chain on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM03 names the control the layer delivers. Our analysis means we drew the link.
- L1 Governance and risk Source states
- L2 Discovery and posture Our analysis
- L3 Model and supply chain Source states
- L4 Testing and red teaming Source states
Tools mapped to LLM03
Our analysis19 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| ModelAuditOpenAI (Promptfoo) · Supply chain | Open sourceMIT |
| Free |
| 86 out of 100 | |
| ModelScanPalo Alto Networks (Protect AI) · Supply chain | Open sourceApache-2.0 |
| Free |
| 84 out of 100 | |
| model-transparencySigstore · Supply chain | Open sourceApache-2.0 |
| Free |
| 78 out of 100 | |
| picklescanMatthieu Maitre · Supply chain | Open sourceMIT |
| Free |
| 73 out of 100 | |
| FicklingTrail of Bits · Supply chain | Open sourceLGPL-3.0 |
| Free |
| 68 out of 100 | |
| Evo AI-SPMSnyk · AI-SPM | Commercial |
| Usage-based |
| 64 out of 100 | |
| Cisco MCP ScannerCisco · Agent security | Open sourceApache-2.0 |
| Free |
| 61 out of 100 | |
| HiddenLayer ScannerHiddenLayer · Supply chain | Commercial |
| Not published |
| 58 out of 100 | |
| safetensorsPyTorch Foundation (Linux Foundation) · Supply chain | Open sourceApache-2.0 |
| Free |
| 58 out of 100 | |
| Lasso MCP GatewayLasso Security · Agent security | Open sourceMIT |
| Free |
| 57 out of 100 | |
| Defender AI-SPMMicrosoft · AI-SPM | Commercial |
| Included with platform |
| 55 out of 100 | |
| Wiz AI-SPMGoogle (Wiz) · AI-SPM | Commercial |
| Not published |
| 54 out of 100 | |
| JFrog ML SecurityJFrog · Supply chain | Commercial |
| Paid |
| 53 out of 100 | |
| Noma SecurityNoma Security · AI-SPM | Commercial |
| Not published |
| 53 out of 100 | |
| AQtive Guard AI-SPMSandboxAQ · AI-SPM | Commercial |
| Not published |
| 50 out of 100 | |
| Zscaler AI-SPMZscaler · AI-SPM | Commercial |
| Not published |
| 49 out of 100 | |
| Prisma AIRSPalo Alto Networks · AI-SPM | Commercial |
| Not published |
| 44 out of 100 | |
| Hub scanningHugging Face · Supply chain | Commercial |
| Included with platform |
| 42 out of 100 | |
| Orca AI-SPMOrca Security · AI-SPM | Commercial |
| Not published |
| 40 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- ModelAudit: Scans downloaded and internal model files, writes an SBOM and checks licenses.
- ModelScan: Scans downloaded and internally built model files for unsafe serialized code.
- model-transparency: Signing and verification let a consumer check that model files match what the publisher signed.
- picklescan: Scans pickle-based model files, including Hugging Face repositories, for suspicious globals before they are loaded.
- Fickling: Analyzes pickle files inside model artifacts and can block unexpected imports while loading them.
- Evo AI-SPM: Inventories models, datasets and MCP servers and writes an AI-BOM, which gives supply chain checks a starting list.
- Cisco MCP Scanner: Can scan the PyPI and npm packages and dependencies behind an MCP server.
- HiddenLayer Scanner: Scans third-party and in-house models and lists their origin, licenses and components before deployment.
- safetensors: Offers a weights format that avoids pickle, which the README table marks as not safe because a downloaded file can run arbitrary code.
- Lasso MCP Gateway: The scan option checks MCP server reputation and tool descriptions before servers are loaded.
- Defender AI-SPM: Lists AI components in an AI-BOM, scans AI library dependencies, and (in a separate preview plan) scans model files for malware.
- Wiz AI-SPM: An AI bill of materials inventories AI services, technologies and SDKs.
- JFrog ML Security: Scans and gates third-party models, including license checks, as they enter Artifactory.
- Noma Security: Scans models from open registries and inventories models, MCP servers and skills.
- AQtive Guard AI-SPM: Evaluates AI assets for insecure dependencies and runs security checks on MCP connectors.
- Zscaler AI-SPM: Records model publisher, origin and license, and lets teams approve or block each detected model.
- Prisma AIRS: Scans third-party model files for malicious code and maps AI assets across the environment.
- Hub scanning: Checks model files in Hub repositories for malware and risky pickle imports before users download them.
- Orca AI-SPM: An AI bill of materials records the AI components in the environment.