Vendor-supplied code is software shipped by a hardware or software vendor, such as drivers, firmware updaters, helper services, or setup components. It is often trusted more than ordinary applications because it is expected to integrate with the operating system and may run with elevated privileges.
This trust makes it security-sensitive. Attackers may try to abuse a vendor package’s installation path, update mechanism, or signed driver to gain higher privileges, persist on a system, or bypass security controls. In practice, this can matter most when the code is allowed to execute in a protected context such as SYSTEM or kernel mode. Defenders should treat vendor packages as part of the attack surface: verify signatures, restrict who can trigger installs or updates, monitor driver and service activity, and remove unnecessary vendor software. A trusted package is not automatically safe; it can still be misused if the surrounding workflow is weak.