Third Party Threat Hunters

Beyond Cyber Vendor Risk with Jenna Wells

A vendor can look “approved” on paper and still be sliding toward a disruption you never saw coming. We talk with Jenna Wells, CEO of Supply Wisdom, about the single risk domain blind spot and why cyber-only vendor reviews miss the early warning signs that show up first in operations, financial health, leadership churn, regulatory exposure, ESG signals, reputation pressure, and location-based disruption. We get practical about what it takes to move from reactive third-party risk management to continuous monitoring and real-time risk intelligence. Jenna explains why questionnaires become stale instantly, how to use risk appetite and prioritization so you are not monitoring 8,000 vendors the same way, and how to fight alert fatigue with thresholds, scoped ownership, and reporting that points to action instead of noise. We also dig into how transparency across procurement, security, and customer teams builds trust and speeds decisions without sacrificing control. AI raises the stakes because it often arrives as an nth-party dependency inside “AI-enabled” SaaS tools. We break down the governance basics: policies and standards from the top, contract clauses for fourth-party disclosure, continuous visibility into downstream providers, and why AI risk management needs its own yardstick beyond traditional cybersecurity frameworks. If you need board-ready metrics, we cover how to summarize your vendor portfolio, event trends, and critical exposures in a way leaders can fund and understand. Subscribe, share this with a risk leader on your team, and leave a review with the biggest vendor risk blind spot you are seeing right now. Free field guide: The Early Warning Field Guide, from Jenna's conversation. Read it at https://thirdpartythreathunting.com/podcast/jenna-wells/ Send us a question for a future episode Support the show

• Transcript
• Chapters

Third Party Threat Hunters: Trailer

Third Party Threat Hunters, hosted by Gregory Rasner, is a podcast about third-party risk, vendor cyber risk and the supply chain threats hiding behind your questionnaires. Hear from practitioners in banks, credit unions and healthcare. New episodes weekly. Send us a question for a future episode Support the show

Change Healthcare and the Concentration Risk Nobody Chose, with Kayne McGladrey

In February 2024, a ransomware attack on Change Healthcare froze roughly 40% of US medical claims and left hospitals and physicians unable to get paid for weeks, even though most were never touched by the attackers. vCISO and author Kayne McGladrey explains why Change is still the best case study for concentration risk, why AI dependency is set up to repeat it (this time on purpose), and why "cyber risk" is really business risk with a different trigger. We cover: - Why Change Healthcare wasn't a black swan, and what the architecture guaranteed - Same outage, two labels: ransomware vs. a hurricane - Exclusivity clauses, switching costs, and exit strategy as architecture - Why a backup AI model you've never tested isn't a backup - What resource-constrained teams get wrong about TPRM - This month's one move: three revenue processes, three owners, three conversations Kayne's three free starter documents: - Business Process Catalog: drive.proton.me/urls/EE82Y1609C#yMbrqTgQ2u58 - Business Systems Inventory: drive.proton.me/urls/WX6J4G3J18#433XPCYsHNLt - Component Ledger: drive.proton.me/urls/H7PYXX9CFR#MD0LCZrlEntR Free field guide from this episode: thirdpartythreathunting.com/podcast/kayne-mcgladrey/ Kayne's book, Cyber Risk is a Myth (CRC Press), is available wherever books are sold and at your library. All 60+ workshops and templates from the book are free at kaynemcgladrey.com/myth. Newsletter: kaynemcgladrey.com/newsletter. Kayne also offers vCISO services. Also mentioned: the June 2024 CDK Global outage, when thousands of car dealerships couldn't process sales and financing. Free field guides from every episode, plus the BEACON pack: thirdpartythreathunting.com/podcast Send us a question for a future episode Support the show

• Transcript
• Chapters

Third-Party AI Risk, Explained with Shankar Krishnan

Your third-party vendors are not “adding AI” as a feature. They’re turning into fast-changing agent stacks with models, connectors, plugins, skills, MCP servers, and subprocessors that can shift underneath you in days or even minutes. That’s the uncomfortable backdrop for our conversation with Shankar Krishnan, co-founder of Prompt Armor and a longtime AI threat researcher, as we unpack what third-party AI risk really looks like when the attack surface won’t sit still. We get concrete about the threat that keeps creeping into everyday workflows: indirect prompt injection. Malicious instructions can hide in normal places like documents, emails, and web pages, then get “executed” by an LLM agent that has access to confidential data and powerful actions. We talk through why the scariest outcome is prompt injection leading to data exfiltration, how shadow AI shows up inside the supply chain when vendors enable AI by default, and why the shared responsibility model increasingly pushes risk decisions onto customer configuration. From there, we zoom out to the program level: why SOC 2 reports and standard security questionnaires still have value but fail to describe AI agent behavior, rapid model changes, or evolving dependencies. We cover practical steps for continuous monitoring, tighter alignment between third-party risk teams and AI governance, and the contract clauses that matter most when vendors can change models, features, and training practices without slowing down. We also dig into nth-party mapping and concentration risk, where a handful of foundation model providers can quietly become critical dependencies across your vendor ecosystem. If you’re responsible for AI vendor security, supply chain security, or third-party risk management, this one will help you reset your mental model and prioritize what to monitor next. Subscribe, share this with your risk or security team, and leave a review, then tell us: what’s the hardest AI vendor change for you to track? Send us a question for a future episode Support the show

• Transcript
• Chapters

Third-Party AI Risk, Explained with Shankar Krishnan

Send us Fan Mail The most dangerous part of third-party AI risk is how ordinary it looks. A “helpful” gen AI assistant gets added to a vendor’s product, then a normal email, document, or webpage slips a malicious instruction into the agent’s workflow and suddenly you’re dealing with indirect prompt injection and potential data exfiltration. That’s the thread we pull on with Shankar Krishnan, co-founder of Prompt Armor, as we talk about why the AI supply chain is expanding faster than most security programs can track. We get specific about what breaks first: point-in-time vendor assessments, standard security questionnaires, and even a fresh SOC 2. They can still tell you something about baseline controls, but they rarely capture what matters most for LLM security and autonomous agents: agent configurations, skills, connectors, plugins, MCP servers, shifting model providers, and the growing web of subprocessors. Shankar explains why a hybrid approach works better, pairing traditional intake with continuous monitoring and real-world testing for prompt injection and agent behavior. We also tackle shadow AI in the supply chain, including the uncomfortable version where a long-trusted vendor turns on AI by default after you already signed the contract. From there, we move into practical governance and contracting: what change notifications to demand, how to think about training on customer data, and how to plan for concentration risk when so many vendors depend on the same few foundation model providers. If you want a clearer, more actionable way to vet and monitor third-party AI vendors, this conversation gives you a strong starting map. Subscribe for more deep dives on third-party risk and AI security, share this with your vendor risk team, and leave a review with your biggest question about managing AI vendor risk. Support the show

• Transcript
• Chapters

Short: Shadow AI in the Workplace with Ken Huang

In this short from the podcast, Ken explains how organizations are failing to capture all the AI risk in their enterprise. Send us a question for a future episode Support the show

Shadow AI Supply Chain Risk with Ken Huang

Your vendor’s product might be running an LLM you never evaluated and that silent dependency can become the cleanest path into your data. We sit down with Ken Huang, author and AI security researcher, to unpack what “third-party AI supply chain” really means when GenAI features are stitched together from embedded models, vector databases, RAG pipelines, agent frameworks, and downstream APIs you do not directly control. We get practical about the risks security teams are actually facing: indirect prompt injection where poisoned “data” becomes “instructions,” data exfiltration through third-party processing, and the way agentic AI turns a text problem into an action problem. Ken explains why overprivileged agents create a massive blast radius, and why identity for agents is still undefined enough that teams need to think in terms of blended identity with intent. We also dig into reward hacking and how multi-agent behavior can push toward unsafe shortcuts in the name of completing a task. On governance, we talk about where frameworks help and where they stop. We reference OWASP Top 10 for LLM Applications, Cloud Security Alliance guidance, and NIST AI RMF, then connect them back to threat modeling that accounts for autonomy, indeterminism, and hallucinations. Finally, we translate all of it into vendor risk management upgrades: layer-by-layer questions about models, data/RAG sources, agent tooling, auth and identity pass-through, deployment, evaluation for drift, and observability plus options like AI endpoint detection and response to reduce blind spots. If you’re trying to move beyond annual questionnaires toward continuous AI risk monitoring, this conversation gives you a clear map and a few immediate next steps. Subscribe, share this with your third-party risk team, and leave a review with the one AI supply chain question you wish every vendor had to answer. Send us a question for a future episode Support the show

• Transcript
• Chapters

AI That Actually Helps TPRM with Brian Shaw

“100% automated vendor risk assessments” sounds seductive right up until you are staring at unstructured SOC 2 reports, mismatched ISO certificates, and a queue you cannot clear. Greg sits down with Brian Shaw, a long-time third-party risk and compliance leader, to talk about what AI can realistically do in third-party risk management today, and what it absolutely should not do yet. We start with a blunt warning: do not automate a broken process. If a question does not change a risk decision, answering it faster does not improve your TPRM program. From there, we get practical about the best use case most teams feel immediately, evidence collection and normalization. Brian explains how AI and natural language processing can extract risk signals from SOC reports, contracts, and policies, then compare sources to flag contradictions with citations so a human can make a defensible call. We also dig into the human side: analysts are not getting replaced if they build strength in materiality, investigation, mitigation, and relationship management. Then we zoom out to modern vendor risk architecture: annual assessments as a photograph, risk as a movie. We talk continuous monitoring, material events, and why context must stay connected from intake through renewal. Finally, we tackle fourth-party and concentration risk, including the uncomfortable truth that “vendor diversity” can collapse into one shared cloud or model provider dependency, and how risk graphs can help you see the real blast radius. Subscribe for more practitioner-level conversations, share this with your risk team, and leave a review with the one TPRM workflow you would automate first. Send us a question for a future episode Support the show

• Transcript
• Chapters

Continuous Third-Party Risk Monitoring with Girish Redekar

Compliance often looks like a snapshot, but vendor risk changes between audits. In this conversation, Greg talks with Girish Redekar about why point-in-time compliance gives a false sense of security, why questionnaires break down at scale, and how to spot a vendor that is drifting before it becomes an incident. We also get into governing AI agents and the privileged access they hold, how to think about nth-party risk without pretending you can map every connection, and which board-level metrics show the return on a third-party risk program. Girish closes with one practical step you can take this week. If you manage third-party risk, vendor risk or security for a bank, credit union or healthcare organization, this one will help you move past audit snapshots. Subscribe, share it with your risk team, and leave a review. Send us a question for a future episode Support the show

• Transcript
• Chapters

Beyond SOC 2: Real Vendor Risk with Nivathan of SecureOS

Vendor risk programs fail in a predictable way: we obsess over forms, feel good about a clean SOC 2, and then act surprised when a “trusted” third party becomes the fastest path to sensitive data or operational outage. Greg sits down with Nivedan, co-founder and CEO of SecureOS, to unpack why traditional third-party risk management (TPRM) and EPRM workflows often measure the wrong thing and miss what matters most: the context of how your business uses a vendor. We dig into questionnaire fatigue and the trap of treating checklists as controls. A static security questionnaire can’t tell you whether a control exists today, whether it’s sufficient for your specific integration, or whether your internal use case has quietly drifted since onboarding. We walk through concrete examples like marketing analytics tools that are low risk with anonymized data but high risk when fed PII or tied to business critical operations. The takeaway is a simple shift: stop asking “is the vendor secure” and start asking “are our use cases secure.” Then we get practical about AI in cybersecurity and vendor risk management. Forget the hype about AI agents auto-filling 400 questions. The real value is correlation: pulling context scattered across contracts, documentation, procurement systems, emails, and Slack into one place so a human can make a defensible decision and prioritize the right actions. We also connect third-party risk to zero trust, covering privileged access management, identity-bound sessions, and just-in-time access, plus why continuous assessment matters far more than an annual review. If you want a step you can take this week, we share a lightweight “context graph” exercise for your 10 most critical vendors that clarifies data access, dependencies, and what happens if a vendor fails. Subscribe, share this with a teammate in security or procurement, and leave a review with your biggest vendor risk blind spot. Send us a question for a future episode Support the show

• Transcript
• Chapters

Short: Surprise! There's AI in your Enterprise with Bill Haber

Many organizations don't realize how far AI is into their systems Send us a question for a future episode Support the show

The Vendor Trust Gap with Bill Haber

Your vendors are not “outside” your business anymore. When an MSP, SaaS platform, or security provider plugs into your environment, they inherit your data, your uptime, and often your privileged access. We talk with Bill Haber, co-founder and CEO of Tekrisq, about how to build third-party risk management that earns real trust instead of producing paper compliance that looks good until it fails. We get blunt about security questionnaires: why flat, self-attested checklists create an attestation gap, why yes-no scoring collapses nuance, and how branching, point-and-click assessments can surface clearer risk signals using language vendors actually understand. We also dig into what business leaders and TPRM teams should ask for when evaluating service providers, including architecture choices, back-end tooling exposure, incident readiness, and the financial risk dimension like coverage limits and breach preparedness. Then we move into the messiest frontier: AI in the supply chain. We break down how AI agents increase speed and blast radius, why shadow AI is spreading across organizations, and how fourth-party risk grows when your vendor’s “AI features” depend on external LLM providers and shared cloud platforms. We close with a practical action item: what continuous monitoring should mean in 2026, with EDR, logging, and vulnerability management that goes beyond point-in-time scans. If you want a vendor risk program that’s defensible, collaborative, and built for modern supply chain security, subscribe, share this with a teammate, and leave a review with the toughest vendor question you think everyone should be asking. Send us a question for a future episode Support the show

• Transcript
• Chapters

Short: Tech Gians and OFAC with Michael Volkov

In this short video, Mike explains how this is an unappreciated risk Send us a question for a future episode Support the show

Short: How to Identify Material Third Parties with Julie Giaischi

In this short video, we hear Julie explain how to identify the vendors risks that really matter - with your "material" third-parties. Send us a question for a future episode Support the show

Sanctions Ready Third-Party Risk with Michael Volkov

Sanctions enforcement is starting to feel like the new FCPA, and that is not just a catchy line, it is a warning. When more and more OFAC and export controls violations trace back to distributors, agents, and vendors, “third-party risk” stops being an onboarding task and becomes a real legal and operational threat. We talk through how strict liability changes the stakes, why diversion risk through transshipment points can catch even well-meaning companies, and what happens when regulators decide your controls were never built to see the end user in the first place. We also dig into the enforcement trend line: DOJ’s National Security Division is leaning in, and sanctions cases can now resemble classic FCPA outcomes with coordinated settlements, criminal exposure, and painful fines. The practical question is simple: if the government asks why you did business with a third party, can you pull a complete, auditable due diligence file that shows your screening, your OSINT research, your beneficial ownership checks, and your documented compliance sign-off? If your evidence lives in emailed questionnaires and scattered attachments, we explain why that approach breaks the moment there is a subpoena, an investigation, or a breach. Then we widen the lens to today’s vendor ecosystem, where cybersecurity and AI governance are inseparable from third-party due diligence. Vendors can become the pathway into your systems, and AI tools can create liability when they act on your behalf, especially in HR hiring decisions. We share a clear next-step mindset: automate onboarding workflows, build cross-functional partnerships with procurement and IT, and put AI guardrails and a framework in place so the program can evolve without chaos. If this helps, subscribe, share the episode with a colleague, and leave a review with the biggest third-party risk you are tackling right now. Send us a question for a future episode Support the show

• Transcript
• Chapters

Treat Vendors As Part Of The Enterprise with Julie Giaischi

Vendor risk feels like it’s turning into paperwork at scale: endless security questionnaires, overwhelmed vendors, and yet third-party breaches keep climbing. We sit down with Julie Giaischi, CEO and co-founder of the Third Party Risk Association, to challenge the habits that quietly keep programs stuck in compliance theater and to map a path toward measurable risk reduction. We dig into a core myth that still drives bad decisions: scaling third-party risk management based on the number of vendors. Julie explains why mature TPRM scales by risk and strategic impact, not raw volume, and why soft skills like communication and relationship building become even more critical as AI changes what “doing the work” looks like. We also unpack why standardized questionnaires can create assessment fatigue when they’re treated as a checkbox, and how evidence-based testing and continuous monitoring better reflect the real control environment. From there, we get practical about the future: AI-powered vendor risk tools, trust portals, and the move toward near real-time assurance that can become predictive, not just reactive. We also address the governance side of AI, including the risk of feeding vendor data into frontier AI when contracts and confidentiality rules say you cannot. Finally, we break down nth-party and fourth-party supply chain risk, including a simple set of questions to identify which sub-tier providers are truly material, plus how to translate benchmarks and risk metrics into board-level messaging that supports budget and action. If you found this useful, subscribe, share it with a risk leader who is drowning in questionnaires, and leave a review with your biggest TPRM challenge. Send us a question for a future episode Support the show

• Transcript
• Chapters

Short: How TPRA is Accelerating Threat Intelligence Sharing with Heather Kadavy

In this short video, Heather provides examples of how this is being accomplished. Send us a question for a future episode Support the show

Short: Communicate Risk in Business Terms for Success with Becky Newton

In this short video, Becky explains how to do this best. Send us a question for a future episode Support the show

Vendor Risk Beyond The SOC Report with Becky Newton

A vendor hands you a clean SOC 2 Type II report, the boxes look checked, and everyone relaxes. Then the breach happens anyway. That’s the control assurance paradox, and it’s why we sat down with Becky Newton, founder and managing partner of Newton Risk Intelligence, to get brutally practical about what third-party risk management should look like when the goal is real operational security, not paperwork comfort. We unpack why TPRM is neither “just audit” nor “just security,” but a risk management discipline that translates vendor controls into business exposure and informed decisions. Becky explains a surprisingly common miss in SOC and ISO reviews: CUECs (complementary user entity controls). If we aren’t performing our side of the controls like access removal and internal mapping, vendors can’t truly assure outcomes, no matter how polished the report looks. We also talk about the biggest vendor red flag: inconsistency without transparency, and how to spot it across questionnaires, evidence, and documentation. From there, we move into what actually closes the gap: understanding the service, the data, the access, and the vendor’s criticality, then backing it up with continuous conversations and operational testing. We dig into business continuity, disaster recovery, and incident response table-tops with vendors, plus how to prioritize limited resources across tiered vendor populations. Finally, we tackle AI vendor risk and AI governance, including why you should audit the system the model runs in, focus on permissions, and ask your top critical vendors what changed with AI bolt-ons and expansion. If you want a vendor risk assessment approach that executives understand and attackers don’t laugh at, hit play, then subscribe, share, and leave a review so more teams can build stronger third-party risk programs. Send us a question for a future episode Support the show

• Transcript
• Chapters

Relationships Beat Tools In Vendor Risk with Heather Kadavy

Vendor risk doesn’t fail because you picked the wrong platform. It fails because nobody trusts the program, nobody speaks the business unit’s language, and everyone thinks it’s someone else’s job. We’re joined by Heather Kadavy, Director of Membership Success at the Third Party Risk Association (TPRA), to get honest about what actually moves third-party risk management forward when teams are lean, vendors are complex, and AI is changing the rules. We dig into the biggest myth in TPRM and supply chain risk management: that technology “solves” the problem. Heather lays out why relationships and governance matter more than automation in the early days of fixing a broken program, and how to earn first line buy-in by shifting from compliance talk to business impact. If your stakeholders only care about sales and speed, we walk through how to translate cyber vendor risk into outcomes they already track like revenue loss, operational disruption, customer impact, and regulatory exposure. From there, we get practical about resilience. Heather shares her “depth of three” strategy for training successors so TPRM survives turnover, plus the cultural marker of mature programs: leaving egos at the door and treating risk management as a team sport across security, compliance, finance, and the business. We also tackle shadow AI, AI governance, and fourth-party dependencies with concrete approaches like mapping critical business services, identifying concentration risk, asking direct AI questions, and combining continuous monitoring with human judgment where it counts. If you want a clearer, more effective vendor risk management program that partners with the business and improves nth-party visibility, hit play. Subscribe, share this with a colleague, and leave a review so more practitioners can find the conversation. Send us a question for a future episode Support the show

• Transcript
• Chapters