Embedded Components
External scripts, third-party libraries and resources present on your assets are identified and attributed to your surface.
DIGITAL SUPPLY CHAIN
Your exposure includes code that is not yours.
Modern applications depend on third-party components: external scripts, APIs, libraries, and embedded services in assets. CSURFACE maps this digital supply chain as part of your attack surface and monitors changes that could become a risk.
THE CHALLENGE
The attack surface does not end with your own assets
Every application runs third-party code: scripts served by external providers, APIs consumed at runtime, and libraries with multiple levels of dependencies. Each of these components is part of the exposed surface—and each can change control, be discontinued, or compromised without any warning.
Traditional supplier management programs evaluate contractual partners in periodic cycles. But the real digital supply chain is deeper and constantly changing. Without visibility into the embedded components within assets, the organization assumes a risk it cannot see.
CAPABILITIES
The digital supply chain, mapped as part of your exposure
The map of third-party components that actually operate on your assets — scripts, APIs and embedded services.
Third-Party APIs and Services
External services consumed by applications are mapped, revealing dependencies that do not appear in any formal inventory.
Depth of the Supply Chain
The supply chain is mapped beyond the direct supplier, reaching third-party components embedded in third-party components.
Criticality Classification
Each component receives context of impact, according to the role it plays in the assets where it is present.
Change Signals
Changes to control, configuration or availability of a component are detected and signaled.
Always Monitored Dependencies
The digital supply chain is continuously re-evaluated — the map follows changes instead of aging.
| Component | Where Loaded | Version | Risk |
|---|---|---|---|
| analytics.jsanalysis provider | checkout.exemplo.com.br | 3.4.1 | critical |
| cdn-ui.jsUI library | app.exemplo.com.br | 2.11 | attention |
| pay-sdk.jspayment gateway | loja.exemplo.com.br | 1.8 | monitored |
| tag-mkt.jsmarketing tag | www.exemplo.com.br | 5.2 | attention |
Each third-party component embedded in your assets enters the inventory — the exposure that comes through your own code.
AN EXTENSION OF THE SURFACE
Third-party components are an exposure to you
A third-party component embedded in an organization's asset is part of the attack surface that the organization needs to know and track. When this component changes control or is compromised, the impact falls directly on the assets where it operates.
That’s why the digital supply chain is treated within the same inventory as the external attack surface — with the same discipline of attribution, classification, and continuous monitoring applied to any other asset.
HOW IT WORKS
From Assets to Full Digital Supply Chain
01
Mapping
Starting from the organization's assets, CSURFACE identifies third-party components operating within them and reconstructs the digital supply chain.
02
Classification
Each component is evaluated based on its criticality of impact, according to the role it plays and the assets where it is present.
03
Continuous Monitoring
The supply chain is continuously reassessed. Relevant changes in control or configuration generate alerts.
WHAT YOU GET
Visibility into the risk that comes from outside
The digital supply chain enters the security program as a continuously monitored dimension.
Familiar supply chain
Third-party components embedded in your assets become visible, rather than invisible.
Alert before the incident
Significant changes in the supply chain are signaled while it is still possible to act.
Evidence for compliance
A digital supply chain inventory with a change history, applicable to third-party governance requirements.
FREQUENTLY ASKED QUESTIONS
FAQ
What does CSURFACE consider part of the digital supply chain?
Third-party components operating on the organization's assets: external scripts, APIs and services consumed by applications, and embedded libraries. They are treated as part of the attack surface, not as separate entities.
Do I need to install agents or provide a list of suppliers?
No. The mapping is external and based on assets already discovered in the organization's attack surface. There are no agents to install nor lists to provide — the platform operates autonomously.
Optionally, CSURFACE integrates with cloud environments, WAFs, CIEMs, and other sources to enrich analysis — integrations that expand context but are not necessary for mapping to function.
Does the mapping reach components beyond the direct supplier?
Yes. The supply chain is mapped in depth, reaching third-party components embedded in other third-party components already present in your assets.
Does this replace the supplier management program?
No. Supplier management programs evaluate contractual partners. CSURFACE adds technical and continuous visibility on the components that actually operate in your assets — a complementary layer, based on external observation.
See the embedded digital supply chain in your assets.
Enter your company domain and receive a preliminary analysis of your external exposure. No card, no meeting required.
Receive preliminary analysis