Foreign Risk: Review and Investigate Policy Violations

Foreign Risk analysis helps government, defense, and other security-conscious organizations identify geopolitical exposure in the open-source components they use. The Manifest Platform analyzes the contributors of open-source repositories, not the code itself, surfacing affiliations and associations that may violate your organization's or your customer's Foreign Risk policies.

Foreign Risk is available on products, assets, and AI models.

Contact your Manifest account team to request access.

---

How it works

When you upload or generate a software bill of materials (SBOM), the platform automatically enriches each open-source component with Foreign Risk data. It does this by:

1. Extracting the source repository URL from each component in the SBOM
2. Fetching contributor and ownership data from that repository
3. Evaluating each contributor and owner against your organization's configured Foreign Risk policies
4. Calculating a risk assessment and surfacing any policy violations

Note: Manifest automatically escalates the affiliations noted below. The alert severity can be adjusted in the individual settings of each affiliation type.

---

Prerequisites

• Your organization has the Foreign Risk feature enabled
• You have an SBOM uploaded to a product, asset, or AI model in the platform
• Foreign Risk policies are configured in Settings (see Configure Foreign Risk policies)

---

Review Foreign Risk on a product

Foreign Risk summary card (Product Overview)

Navigate to a product's Product Overview tab to see a Foreign Risk summary card. It shows the total number of policy violations detected across the product, so you can gauge exposure without opening the full tab.

Foreign Risk tab

Click the Foreign Risk tab at the top of the product detail page to view the full breakdown. The tab label displays the total number of policy violations detected (for example, "Foreign Risk 8").

At the top of the tab, a summary surface shows:

• Policy violations: the total number of distinct policy violations detected
• High risk components: the number of components flagged as high risk
• High risk contributors: the number of contributors flagged as high risk

The tab includes two sub-tabs:

Component sub-tab

Lists all components with Foreign Risk violations. Each row shows:

• Risk: the severity level (Critical, High, Medium, Low, or N/A)
• Component: the repository name
• Policy severity: a graphical bar representing the distribution and severity of violations

Contributor sub-tab

Lists all contributors across the product. Each row shows:

• Risk: the severity level
• Contributor: the contributor's name
• Last commit: the date of their most recent commit
• Location: the contributor's associated location
• Source: the asset the contributor's commits are tied to
• Policy severity: a graphical bar representing the number and severity of their violations

Click the arrow (>) on any row, in either sub-tab, to open a detail drawer on the right. For a contributor, the drawer shows:

• The contributor's name, GitHub profile link, and commit count
• Associated countries: every country tied to the contributor's affiliations
• The assets the contributor has contributed to
• Policy violations, grouped by country. Each entry lists the violation's severity, a description of the affiliation, and the specific entities involved (for example, a university or organization name)

For a component, the drawer shows the specific policy violations for that component, the number of contributors associated with it, and a link to its source repository on GitHub.

---

Review Foreign Risk on an asset

Risk Overview card

After uploading and enriching an SBOM, navigate to the asset's Risk Overview tab. A Foreign Risk card appears on the right side of the page showing a summary of:

• Policy violations: number of distinct policies violated
• Components: number of components flagged as high risk
• Contributors: number of contributors flagged as high risk

The overall Foreign Risk for each component or contributor inherits the highest severity of any individual violation associated with it.

Foreign Risk tab

Click the Foreign Risk card or the Foreign Risk tab at the top of the asset detail page to view the full Foreign Risk breakdown. The tab label displays the total number of policy violations detected (for example, "Foreign Risk 8").

At the top of the tab, a summary surface shows:

• Riskiest component: the component with the most or highest-severity policy violations
• Riskiest contributor: the contributor with the most or highest-severity policy violations
• Policy violated: the total number of distinct policy violations across the asset

The tab includes two sub-views:

Component view

The default view lists all components with Foreign Risk violations, sorted with the highest-severity violations first. Each row shows:

• Risk: the severity level (Critical, High, Medium, Low, or N/A)
• Component: the repository name (for example, pytorch/pytorch)
• Policy severity: a graphical bar representing the distribution and severity of violations

Click the arrow (>) on any component row to open a detail panel on the right. This panel shows:

• The specific policy violations for that component and their severities
• The number of contributors associated with that component
• A link to the component's source repository on GitHub

From the component detail panel, click the arrow (>) next to a contributor to view that individual's policy violations.

Contributor view

Click the Contributor tab within the Foreign Risk tab to see all contributors across the asset. Each row shows:

• Contributor name
• Last commit date
• Location
• A graphical bar representing the number and severity of their violations

Click the arrow (>) on any contributor row to open a contributor detail panel showing:

• All policy violations for that contributor, with severity
• A link to the contributor's GitHub profile
• University or organizational affiliations where available

---

Review Foreign Risk on an AI model

Navigate to a model's page in AI Explorer and open the model card. A Foreign Risk card appears alongside the model's other risk data, showing:

• Riskiest component: the component with the most or highest-severity policy violations, where applicable
• Riskiest contributor: the contributor with the most or highest-severity policy violations
• Policies violated: the total number of distinct policy violations detected

Like the product and asset views, the card includes Component and Contributor sub-tabs listing each item's risk level, name, and policy severity. Origin-country evidence, where a component or contributor's country of origin factors into a policy violation, surfaces directly on the risk overview so you can assess geopolitical exposure without leaving the model card.

Use the Rescan button in the top right of the card to trigger a fresh Foreign Risk analysis for the model.

---

Configure Foreign Risk policies

Navigate to Settings > Foreign Risk Policies to view and manage your organization's Foreign Risk policies.

Available risk categories

The platform supports 18 Foreign Risk categories sourced from proprietary intelligence data:

The following categories are enabled by default: CYB, SIS, RES, and MIL.

Enable or disable a policy

1. Go to Settings > Foreign Risk Policies
2. Use the toggle next to each policy category to enable or disable it
3. Use the search bar to find a specific policy by name or keyword

Set alert severity and target countries for a single policy

1. Click the Settings icon next to any enabled policy
2. Select the alert severity: Critical, High, Medium, or Low
3. Add one or more countries this policy should apply to
4. Click Save

Apply countries to all enabled policies at once

Instead of setting target countries one policy at a time, you can apply a country selection across every enabled Foreign Risk policy in a single step.

1. Go to Settings > Foreign Risk Policies
2. Click the Settings icon next to any enabled policy to open its policy drawer
3. Under Country specific, add or remove countries in the selector
4. Click Apply to all enabled policies

Only the countries you select will be scanned. The platform applies that same country list to every other enabled policy, so you don't have to repeat the selection one by one.

This is useful when your organization wants a consistent set of countries applied broadly, for example, when standing up Foreign Risk policies for the first time or aligning to an updated restricted-country list. You can still override individual policies afterward by opening that policy's drawer and adjusting its countries separately.

When you save changes to a policy, the platform automatically re-triggers Foreign Risk analysis for all applicable assets. Allow a few minutes for updated results to appear.

---

What to expect

After you upload an SBOM and enrichment completes, the Foreign Risk tab or card populates with any detected violations. If the SBOM is still processing, Foreign Risk displays an empty state until the scan is complete.

A component or contributor with no policy violations will not appear in the violation lists. Products, assets, and models where no violations are detected will show a clear state on their respective summary card.

---

Troubleshooting

• Foreign Risk tab shows empty state after upload

  • Cause: The SBOM may still be processing or enrichment has not completed
  • Fix: Wait a few minutes and refresh the page. If the tab remains empty after enrichment completes, verify that Foreign Risk policies are enabled in Settings

• Expected violation not appearing after policy change

  • Cause: Re-analysis triggered by a policy update can take a few minutes
  • Fix: Wait two to three minutes, then reload the detail page

• Foreign Risk not showing for older SBOMs

  • Cause: Older SBOMs are not included in Foreign Risk
  • Fix: Foreign Risk applies to net new SBOMs that are uploaded. Reupload the SBOM or upload the latest version

• Data not refreshing

  • Cause: Foreign Risk data syncs occur upon ingest, but are not currently refreshed automatically
  • Fix: Rescan the product, asset, or model by clicking the "Rescan" button on the top right corner of the Foreign Risk tab or card
  • Note: GitHub profile information is pulled on a weekly basis