Contributor-level foreign risk detection, now inside your own environment
Manifest Cyber now brings Manifest Foreign Risk to self-hosted and air-gapped environments. Security teams that run Manifest on their own infrastructure can identify open source contributors tied to sanctioned nations, foreign militaries, and intelligence agencies, with no data leaving their network.
In June, Manifest launched Manifest Foreign Risk, giving security teams contributor-level visibility into the open source components inside their software. This release fills a void in air-gapped software supply chain security, where foreign risk checks have depended on cloud services that disconnected networks cannot reach.
The teams that need foreign risk visibility most are often the ones that cannot use SaaS tools at all. Defense contractors, federal agencies, and highly regulated enterprises run critical systems on networks that never touch the internet. Until now, that meant choosing between their deployment requirements and knowing who wrote the code in their software.
They no longer have to choose. A security capability that only exists in the cloud is one the most sensitive missions cannot use, so we built Foreign Risk to run wherever our customers do.
[Optional embed: product video or demo clip, placed here to match the June post]
Why This Matters
Foreign Ownership, Control, or Influence (FOCI) requirements now reach commercial software vendors in the defense supply chain, and many affected organizations run disconnected networks.
In May 2024, the Department of War (DoW) issued Instruction 5205.87, extending FOCI requirements to any company holding unclassified DoW contracts over $5 million. That reach includes subcontracts, and DoW can now cancel contracts or require mitigation if FOCI is found. We explored what this shift means for software in an earlier post.
The question for defense suppliers is no longer whether FOCI applies. It is whether they can show compliance when a contracting officer, auditor, or customer asks. Foreign influence in software rarely shows up in a vendor questionnaire. It shows up in the open source components and the people who wrote them.
Those people change constantly. New maintainers join projects, contributors switch employers, and a component that was clean last quarter can carry foreign risk today. FOCI compliance in software is not a one-time check. It requires continuous monitoring.
Here is the problem. The organizations under the most pressure to answer that question are also the most likely to run software on disconnected or classified networks. A foreign risk check that depends on a call to a cloud API simply does not work there. Self-hosted Foreign Risk closes that gap.
What Manifest Foreign Risk Does in Self-Hosted Environments
Self-hosted Foreign Risk delivers the same detection as our SaaS platform. It runs against a local copy of the foreign risk dataset, covering 20 billion records across 18 risk categories, stored inside your environment. Scans and policy checks never call out to Manifest's cloud or to any outside service.
- Component and contributor-level detection. Manifest traces every component in a software bill of materials (SBOM) or open source repository to its authors and flags three risk types: contributors in a sanctioned jurisdiction, contributors or employers tied to a foreign military, intelligence agency, or state-controlled lab, and contributors whose identity cannot be verified.
- The same workflows your team already knows. The Foreign Risk section on Product Overview, the Foreign Risk tab with Component and Contributor views, and the Foreign Risk card on AI Model Cards all work the same way they do in SaaS.
- Policies built around your requirements. Turn each risk category on or off, set your own prohibited country list, gate flagged packages before they enter the codebase, and export findings as audit evidence mapped to NIST 800-53 SR-3 and SR-4 or Cybersecurity Maturity Model Certification (CMMC) supply chain controls.
For security leaders, that means one consistent foreign risk program across every deployment, with no separate tooling for disconnected networks. Each new SBOM and each rescan is checked against the latest Foreign Risk data, so monitoring keeps pace as contributors change. Learn more about how Manifest helps you expose foreign influence in your supply chain.
How the Data Stays Current
Self-hosted customers receive regular dataset updates packaged for their own infrastructure. Each update loads into the customer's local database through a repeatable refresh process, so findings stay closely aligned with what SaaS customers see.
Foreign risk data is only useful if it is fresh. Open source code frequently adds new contributors, so a one-time FOCI check goes stale quickly.
The result is current foreign risk intelligence without opening a connection your security posture does not allow.
Who This Is For
Self-hosted Foreign Risk is built for CISOs and security leaders who carry FOCI and supply chain obligations but cannot send software data to the cloud:
- Defense contractors and subcontractors working toward compliance with DoW Instruction 5205.87.
- Federal agencies and programs running software on classified or disconnected networks.
- Regulated enterprises in sectors like financial services, critical infrastructure, medical devices, manufacturing, and more, where on-premise deployment is a hard requirement.
If your team has been tracking foreign influence in software manually, because SaaS Foreign Risk solutions are not an option, this release is for you. See how Manifest supports defense contractors and government agencies.
What Comes Next
Self-hosted Foreign Risk is rolling out now to select self-hosted and air-gapped customers as part of The Manifest Platform. We are already working on lighter, more frequent updates so local data stays even closer to real time.
Open source risk changes every time a new contributor commits code to a project you depend on. This release reflects a simple commitment. The organizations protecting national security and critical infrastructure deserve the same software supply chain visibility as everyone else, on their terms and inside their walls. Manifest will keep building for them first.
See Manifest Foreign Risk in action. Request a demo and bring your software. We will show you what's inside, including who wrote it.
