From context I assume they mean threat levied against the company or data entrusted to it. They should probably change it to "any server-side threat", or just

From context I assume they mean threat levied against the company or data entrusted to it. They should probably change it to "any server-side threat", or just nix that portion entirely. (Nixing it is probably most reasonable, given that they could theoretically push an update that steals secret keys, AFAIK.)