Operating systems 1/5 Windows Microsoft Desktop OS. Patch cadence is the single biggest lever. macOS Apple Desktop OS with a fast, forced update channel. Linux Distribution Patch cadence depends on the distribution, not the kernel. iOS Apple Phone OS. Update aggressively during an active wave. Android Google Phone OS. Vendor skins can delay patches by weeks.
Devices 2/4 Windows PC Microsoft The machine that holds your sessions and SSH keys. Mac Apple The machine that holds your sessions and SSH keys. Android phone Google Banking apps, OTPs, and the second factor. iPhone Apple Banking apps, OTPs, and the second factor.
Browsers 2/5 Edge Microsoft Chromium-based. Inherits Chromium's certificate and TLS fixes. Chrome Google Chromium-based. Fastest certificate blocklist in the industry. Firefox Mozilla Independent TLS stack. OneCRL blocks compromised intermediates. Brave Brave Software Chromium-based with additional fingerprint defences. Safari Apple Shares Apple's trust store with the OS.
Runtimes 2/6 Node.js OpenJS Foundation Bundles its own CA store. npm install is executable code. Python Python Software Foundation certifi is a vendored CA bundle — it does not follow Windows Update. PHP PHP Group Only relevant when it is serving requests, not when it is installed. Java Oracle / OpenJDK Keeps its own cacerts trust store, separate from the OS. Go Go team Uses the system trust store on Windows. .NET Microsoft Uses the Windows certificate store by default.
Web servers 0/4 NGINX F5 Internet-facing reverse proxy. One third of the web runs it. Apache HTTP Server Apache Foundation Common PHP front end. Module surface is the risk. IIS Microsoft Windows-native web server. Rarely internet-facing on a laptop. Caddy Caddy Automatic TLS. Smaller attack surface, same HTTP/3 caveats.
Platform & services 3/24 Vercel Vercel Static and serverless hosting. Patches its own edge. Netlify Netlify Static and function hosting. Cloudflare Cloudflare Edge proxy and DNS. Terminates TLS for a huge share of the web. AWS Amazon Cloud control plane. IAM keys are the real asset. Google Cloud Google Cloud control plane. Service-account keys are the real asset. Azure Microsoft Cloud control plane. Managed identity beats stored secrets. GitHub GitHub Source of truth for code. Account takeover is supply-chain risk. GitLab GitLab Self-managed instances carry their own patch burden. GitHub Actions GitHub CI has your secrets. A malicious workflow is a key ceremony. Railway Railway PaaS with injected secrets. Zeabur Zeabur PaaS; the company is winding down after its breach. Onamae Onamae Japanese hosting and domain control plane. OVHcloud OVHcloud European cloud and bare metal. TiDB Cloud PingCAP Managed distributed SQL. Plex Media Server Plex Home media server, often exposed to the internet by accident. Signal Signal Foundation Messaging. Endpoint capture bugs live at the OS boundary. Tor Tor Project Anonymity network. Exit relays do not provide integrity. WordPress WordPress Plugin supply chain is the dominant risk. AOMEI Backupper AOMEI Backup tooling sees every file you have. Palo Alto firewall Palo Alto Networks Enterprise edge appliance. Siemens industrial software Siemens Engineering workstations and OT networks. Bullhorn Bullhorn Staffing and CRM platform. Supabase Supabase Postgres plus auth. Row-level security is the boundary. Neon Neon Serverless Postgres.
Certificate authorities 2/4 eMudhra / emSign eMudhra Compromised roots still present in some non-browser trust stores. Let's Encrypt ISRG Short-lived certificates limit the damage of a misissuance. DigiCert DigiCert Commercial CA with broad enterprise trust. ISRG Root X1 ISRG The root behind Let's Encrypt.
Accounts 2/6 GitHub account GitHub Owns code, tokens, and often deployment rights. GitLab account GitLab Owns code and CI variables. Google account Google Email is the reset path for almost everything else. Microsoft account Microsoft Often the same identity as the Windows login. SBI banking State Bank of India Money and identity in one place. Another bank Bank Any bank account with net banking enabled.
Package ecosystems 2/3 npm packages npm Install scripts execute with your user's privileges. PyPI packages PyPI Wheels can execute code at import time. LiteLLM BerriAI Runs inside the app process and can read every key it can see.
AI surfaces 1/4 Meta AI / Muse Meta Cloud agent with retrieval over your data. OpenAI API OpenAI API keys are billing and data-access credentials. Anthropic API Anthropic API keys are billing and data-access credentials. Local model Self-hosted No cloud egress, but model files are still executable supply chain.