What are the key considerations when using AppExchange managed packages in a production org?

AppExchange managed packages are pre-built applications installed from Salesforce's marketplace. Key considerations:
Security review: All AppExchange packages listed publicly pass Salesforce's security review. Always review the package's permissions and data access requirements before installation.
Namespace prefix: Managed package components use a namespace prefix (e.g., cpq__Quote__c). Customising managed package components is limited — you can extend them but not modify the package's own code.
Governor limits sharing: Managed package Apex and triggers share the same governor limits as your org's custom code within the same transaction. High-volume packages can contribute to limit consumption.
Version upgrades: Managed packages can be upgraded to newer versions. Test upgrades in a sandbox before applying to production. Some upgrades may change API behaviour or deprecate features.
Uninstallation: Managed packages can typically be uninstalled if you remove all dependencies (custom fields referencing package objects, flows, reports). Uninstall in a sandbox first to identify and resolve dependency issues.
Test coverage: Package Apex code is covered by the publisher's test classes, not yours — you only need to maintain coverage for your own custom code.