In July 2024 a faulty update from one security vendor took down airline check-in, hospital systems and Windows machines around the world. And things only got worse since then. A supplier questionnaire asks how a vendor protects itself - it rarely asks what happens to you when that vendor fails.

This technical session treats the supply chain as a dependency map you can inventory: the software components you ship (SBOM), the cryptography they rely on (CBOM), the models and AI services embedded in tools you already run (AIBOM), and the providers nobody marked as critical.

From that map we find the single points of failure and ask suppliers about post-quantum readiness in a way that produces answers you can verify. We also look at what NIS2 and the Cyber Resilience Act make you answerable for.

You leave with a method for ranking suppliers by how hard they are to replace instead of by spend, and a set of contract questions on PQC readiness and embedded AI.