Reliance on Insufficiently Trustworthy Component

Modern products are often assembled from various third-party components, like open-source libraries or supplier hardware. Each part must be trustworthy; otherwise, it introduces risks like unfixable vulnerabilities, hidden malware, or components that can't be updated when security flaws are discovered. Even internally developed components can become untrustworthy if their source code is lost or their original developers are no longer available. Trust is subjective—different teams and stakeholders have varying criteria for security, safety, and cost. This means architects must make conscious trade-offs, understanding that relying on an insufficiently vetted component can compromise the entire system's integrity, regardless of where that component originated.