A customer-managed component is software that the customer installs, configures, and runs in its own environment rather than consuming it entirely as a vendor-hosted service. In cyber security, this matters because the security boundary shifts: the vendor may supply patches and guidance, but the customer is responsible for hardening the host, restricting access, monitoring logs, and applying updates.
These components often sit in sensitive bridge roles, such as connecting a cloud service to private storage or internal systems. That makes them attractive targets: a flaw in a customer-managed control layer can expose code execution, validation bypasses, or unauthorized file writes, even if the main SaaS platform remains intact. Defenders should inventory these deployments carefully, track exact versions, and treat them as privileged infrastructure, not ordinary application servers.