Assessing third-party vendor risk in modern AI infrastructure