Guide to protect SQL Server against speculative execution side-channel vulnerabilities I am going through this link.  My question is regarding Scenario 1 under recommendation as most of our SQL Servers run on physical machine


  SQL Server runs on "bare metal" (no virtual machines)
  
  AND no other untrusted application logic (application tier) is run on
  the same machine
  
  AND no untrusted SQL Server extensibility interfaces are being used
  (see below for list).


What does it mean by untrusted application logic?  

Does a webserver running on the same server with internally developed site constitute untrusted application logic?

What about a third party services that monitors the server?
Untrusted application logic means any application or service running any logic that you(r organization) does not trust.

For your purpose, if you want to be lenient (potentially less secure) you can substitute "unauthorized" for "untrusted" - if the server is running any unauthorized code, it falls under that category.

If you want to be conservative (potentially more secure), assume all your servers run untrusted application logic and move on with that as a founding security assumption, applying the more secure recommendations to them.