Third Party Threat Hunters

Gregory Rasner, Third Party Threat Hunting™

Third Party Threat Hunters is the podcast for people who manage third-party risk: TPRM, vendor risk, cybersecurity, supply chain and AI risk, and the fourth parties hiding behind your vendors. Hosts Greg Rasner and Paul Kurtz talk with CISOs, risk leaders and researchers about what actually reduces vendor risk, not just what passes an audit. For TPRM, security and compliance teams at banks, credit unions, healthcare and beyond. New episodes weekly, plus short clips. Listen, and get the Fourth Party newsletter: https://www.thirdpartythreathunting.com/podcast

THIRD PARTY THREAT HUNTER

Ad free and exclusive episodes from all our shows

$0.99/mo or $6.99/yr after trial

  1. 2d ago

    Escaping The Vendor Renewal Trap with Jonathan of Docubark

    Vendor risk rarely blows up at onboarding. It blows up later, when renewals quietly roll through, business units buy new tools on a card, and your third-party risk management backlog grows faster than your team can review it. Greg sits down with Jonathan Mandel, founder and CEO of Docubark, to get specific about what actually helps when you are buried in questionnaires and still worried about the next vendor-driven incident. We dig into the renewal trap and why “continuous monitoring” often sounds good but falls apart on details. Jonathan shares a more grounded approach: stay aware of vendor breach news, acquisitions, and product sunsets, and keep governance tight around expiring SOC 2 reports, ISO 27001 certificates, and other evidence that ages out. We also challenge the idea that assessments prevent breaches and reframe the goal as resilience and impact reduction, because the breach question is usually “when,” not “if.” Then we get tactical on two big levers. First, shadow IT and shadow AI discovery using LLMs to compare accounts payable data, Okta app lists, and your system-of-record vendor inventory to quickly find what is missing. Second, backlog reduction through better risk tiering, including an impact-based sniff test that asks what happens if the vendor is breached and whether customer or regulator notifications are required. Finally, we talk AI automation for document analysis with a clear audit trail, plus how quantitative risk analysis like FAIR can translate vendor risk into dollars for executives and boards. Subscribe, share this with a TPRM teammate, and leave a review if it helped. What is the one vendor-risk workflow you want to speed up next? Send us a question for a future episode Support the show

  2. Nov 3

    Vendor Zero Trust with Jerry Chapman

    Your Zero Trust program can be rock solid internally and still collapse the moment a “trusted” vendor gets a VPN connection, broad IAM roles, or a long-lived API key. That’s the uncomfortable scenario we dig into with Jerry Chapman, co-founder and CTO of Numberline Security and a co-chair of the Cloud Security Alliance Zero Trust Working Group. We get practical about what breaks, why it breaks, and what to do next when third-party access is the real perimeter everyone keeps ignoring. We challenge the idea that vendors should be onboarded like employees and push a stricter model: treat every vendor identity like a potential threat actor, start with zero privileges, and grant explicit, time-bound access only to the specific resource they need. Jerry explains why traditional VPN and perimeter-based vendor access fails in flat networks, how Zero Trust Network Access (ZTNA) creates narrow point-to-point paths, and why segmentation down to the resource level is non-negotiable. We also cover “protect surfaces,” privileged access management, and how runtime role assignment supports zero standing privilege. Then we go after the compliance trap. Annual vendor security questionnaires rarely match real-world security posture, so we talk about continuous monitoring, observability across identity and network signals, and behavior analytics that actually lets you respond instead of staring at a dashboard “Christmas tree.” Finally, we translate Zero Trust maturity into boardroom language: risk, brand impact, and money, plus why AI workloads and cloud ecosystems are already forcing third-party risk management and Zero Trust architecture to converge. If you care about third-party risk, vendor access control, supply chain security, and modern Zero Trust strategy, hit play, share this with your security lead, and subscribe then leave a quick review with your biggest vendor-access red flag. Send us a question for a future episode Support the show

  3. Oct 27

    Beyond Checkbox Compliance with Ryan Patrick

    Third-party breaches keep happening even when everyone claims they’re “compliant.” So we get specific about what’s broken: the endless vendor security questionnaire loop, the false comfort of self-attestation, and the gap between checkbox compliance and real, validated assurance. Ryan Patrick from HITRUST joins us to talk through what actually changes outcomes when critical infrastructure and healthcare supply chains are under constant pressure from modern attack techniques.  We dig into why standardization matters, but only if the standard is worth adopting. HIPAA and other regulations set a floor, yet they can’t move fast enough to match cloud change, ransomware trends, and shifting attacker tradecraft. We also tackle the uncomfortable reality of common assurance reports in third-party risk management, including where SOC 2 can become inconsistent, hard to compare, and misaligned with today’s biggest threats. When ransomware dominates incident profiles, it’s worth asking whether your “proof” of security even tests what would help you recover.  Then we get practical: how to use HITRUST CSF within an existing TPRM program without a rip-and-replace, what E1 vs I1 vs R2 means, and how mapping your questionnaire to a threat-informed, independently validated control set can cut redundant work while improving confidence. We also unpack the quality assurance pipeline behind certification, from assessor methodology to automated checks and human review, and why that governance is the difference between a nice PDF and assurance you can trust.  If you want vendor risk management that reflects how breaches happen now, this is the conversation. Subscribe, share this with your risk team, and leave a review with the question you want us to tackle next. Free field guide: The Validated Assurance Field Guide, from Ryan's conversation. Read it at https://thirdpartythreathunting.com/podcast/ryan-patrick/ Send us a question for a future episode Support the show

  4. Oct 20

    Beyond Cyber Vendor Risk with Jenna Wells

    A vendor can look “approved” on paper and still be sliding toward a disruption you never saw coming. We talk with Jenna Wells, CEO of Supply Wisdom, about the single risk domain blind spot and why cyber-only vendor reviews miss the early warning signs that show up first in operations, financial health, leadership churn, regulatory exposure, ESG signals, reputation pressure, and location-based disruption. We get practical about what it takes to move from reactive third-party risk management to continuous monitoring and real-time risk intelligence. Jenna explains why questionnaires become stale instantly, how to use risk appetite and prioritization so you are not monitoring 8,000 vendors the same way, and how to fight alert fatigue with thresholds, scoped ownership, and reporting that points to action instead of noise. We also dig into how transparency across procurement, security, and customer teams builds trust and speeds decisions without sacrificing control. AI raises the stakes because it often arrives as an nth-party dependency inside “AI-enabled” SaaS tools. We break down the governance basics: policies and standards from the top, contract clauses for fourth-party disclosure, continuous visibility into downstream providers, and why AI risk management needs its own yardstick beyond traditional cybersecurity frameworks. If you need board-ready metrics, we cover how to summarize your vendor portfolio, event trends, and critical exposures in a way leaders can fund and understand. Subscribe, share this with a risk leader on your team, and leave a review with the biggest vendor risk blind spot you are seeing right now. Free field guide: The Early Warning Field Guide, from Jenna's conversation. Read it at https://thirdpartythreathunting.com/podcast/jenna-wells/ Send us a question for a future episode Support the show

  5. Trailer

    Third Party Threat Hunters: Trailer

    Third Party Threat Hunters, hosted by Gregory Rasner, is a podcast about third-party risk, vendor cyber risk and the supply chain threats hiding behind your questionnaires. Hear from practitioners in banks, credit unions and healthcare. New episodes weekly. Send us a question for a future episode Support the show

  6. Oct 15

    Change Healthcare and the Concentration Risk Nobody Chose, with Kayne McGladrey

    In February 2024, a ransomware attack on Change Healthcare froze roughly 40% of US medical claims and left hospitals and physicians unable to get paid for weeks, even though most were never touched by the attackers. vCISO and author Kayne McGladrey explains why Change is still the best case study for concentration risk, why AI dependency is set up to repeat it (this time on purpose), and why "cyber risk" is really business risk with a different trigger. We cover: - Why Change Healthcare wasn't a black swan, and what the architecture guaranteed - Same outage, two labels: ransomware vs. a hurricane - Exclusivity clauses, switching costs, and exit strategy as architecture - Why a backup AI model you've never tested isn't a backup - What resource-constrained teams get wrong about TPRM - This month's one move: three revenue processes, three owners, three conversations Kayne's three free starter documents: - Business Process Catalog: drive.proton.me/urls/EE82Y1609C#yMbrqTgQ2u58 - Business Systems Inventory: drive.proton.me/urls/WX6J4G3J18#433XPCYsHNLt - Component Ledger: drive.proton.me/urls/H7PYXX9CFR#MD0LCZrlEntR Free field guide from this episode: thirdpartythreathunting.com/podcast/kayne-mcgladrey/ Kayne's book, Cyber Risk is a Myth (CRC Press), is available wherever books are sold and at your library. All 60+ workshops and templates from the book are free at kaynemcgladrey.com/myth. Newsletter: kaynemcgladrey.com/newsletter. Kayne also offers vCISO services. Also mentioned: the June 2024 CDK Global outage, when thousands of car dealerships couldn't process sales and financing. Free field guides from every episode, plus the BEACON pack: thirdpartythreathunting.com/podcast Send us a question for a future episode Support the show

  7. Oct 13

    Third-Party AI Risk, Explained with Shankar Krishnan

    Your third-party vendors are not “adding AI” as a feature. They’re turning into fast-changing agent stacks with models, connectors, plugins, skills, MCP servers, and subprocessors that can shift underneath you in days or even minutes. That’s the uncomfortable backdrop for our conversation with Shankar Krishnan, co-founder of Prompt Armor and a longtime AI threat researcher, as we unpack what third-party AI risk really looks like when the attack surface won’t sit still. We get concrete about the threat that keeps creeping into everyday workflows: indirect prompt injection. Malicious instructions can hide in normal places like documents, emails, and web pages, then get “executed” by an LLM agent that has access to confidential data and powerful actions. We talk through why the scariest outcome is prompt injection leading to data exfiltration, how shadow AI shows up inside the supply chain when vendors enable AI by default, and why the shared responsibility model increasingly pushes risk decisions onto customer configuration. From there, we zoom out to the program level: why SOC 2 reports and standard security questionnaires still have value but fail to describe AI agent behavior, rapid model changes, or evolving dependencies. We cover practical steps for continuous monitoring, tighter alignment between third-party risk teams and AI governance, and the contract clauses that matter most when vendors can change models, features, and training practices without slowing down. We also dig into nth-party mapping and concentration risk, where a handful of foundation model providers can quietly become critical dependencies across your vendor ecosystem. If you’re responsible for AI vendor security, supply chain security, or third-party risk management, this one will help you reset your mental model and prioritize what to monitor next. Subscribe, share this with your risk or security team, and leave a review, then tell us: what’s the hardest AI vendor change for you to track? Send us a question for a future episode Support the show

  8. Oct 6

    Shadow AI Supply Chain Risk with Ken Huang

    Your vendor’s product might be running an LLM you never evaluated and that silent dependency can become the cleanest path into your data. We sit down with Ken Huang, author and AI security researcher, to unpack what “third-party AI supply chain” really means when GenAI features are stitched together from embedded models, vector databases, RAG pipelines, agent frameworks, and downstream APIs you do not directly control.  We get practical about the risks security teams are actually facing: indirect prompt injection where poisoned “data” becomes “instructions,” data exfiltration through third-party processing, and the way agentic AI turns a text problem into an action problem. Ken explains why overprivileged agents create a massive blast radius, and why identity for agents is still undefined enough that teams need to think in terms of blended identity with intent. We also dig into reward hacking and how multi-agent behavior can push toward unsafe shortcuts in the name of completing a task.  On governance, we talk about where frameworks help and where they stop. We reference OWASP Top 10 for LLM Applications, Cloud Security Alliance guidance, and NIST AI RMF, then connect them back to threat modeling that accounts for autonomy, indeterminism, and hallucinations. Finally, we translate all of it into vendor risk management upgrades: layer-by-layer questions about models, data/RAG sources, agent tooling, auth and identity pass-through, deployment, evaluation for drift, and observability plus options like AI endpoint detection and response to reduce blind spots.  If you’re trying to move beyond annual questionnaires toward continuous AI risk monitoring, this conversation gives you a clear map and a few immediate next steps. Subscribe, share this with your third-party risk team, and leave a review with the one AI supply chain question you wish every vendor had to answer. Send us a question for a future episode Support the show

See All (19)

Trailer

About

Third Party Threat Hunters is the podcast for people who manage third-party risk: TPRM, vendor risk, cybersecurity, supply chain and AI risk, and the fourth parties hiding behind your vendors. Hosts Greg Rasner and Paul Kurtz talk with CISOs, risk leaders and researchers about what actually reduces vendor risk, not just what passes an audit. For TPRM, security and compliance teams at banks, credit unions, healthcare and beyond. New episodes weekly, plus short clips. Listen, and get the Fourth Party newsletter: https://www.thirdpartythreathunting.com/podcast

Information

  • Creator
    Gregory Rasner, Third Party Threat Hunting™
  • Years Active
    2026
  • Episodes
    19
  • Rating
    Clean
  • Copyright
    © 2026 Third Party Threat Hunters
  • Show Website
    Third Party Threat Hunters
  • Provider
    Gregory Rasner