A critical application uses third-party libraries but has no dependency inventory. What risk-management limitation follows?

1. Only licensing costs can be affected
2. Every third-party component is necessarily malicious
3. The application cannot run at all
4. Affected components may be difficult to identify when a vulnerability is announced