Custom components are user-defined extensions that add logic, integrations, or transformations to a platform. In workflow tools, they may encapsulate code that reads inputs, calls APIs, manipulates data, or triggers execution steps beyond the built-in blocks.
They matter in cyber security because every extension point widens the attack surface. If a platform loads custom components from untrusted sources, or runs them with broad privileges, a malicious component can act like a Trojan horse: it can steal secrets, alter workflows, or reach remote code execution paths. Defenders reduce this risk by reviewing component code, limiting permissions, isolating runtimes, signing trusted extensions, and disabling custom logic where it is not needed.