Third Party

Third Party

If you manage third-party cyber risk, you’ve seen it all: meaningless scorecards, black-box tools, and endless frameworks that never quite connect to business impact. Third-Party is the podcast built for the people behind the dashboards. The ones managing 5,000 vendors with a team of three. Hosted by Jeffrey Wheatman, Ferhat Dikbiyik, and Bob Maley, this show unpacks what actually works (and what doesn’t) in TPRM. No fear tactics. No buzzwords. Just unfiltered conversations, sharp insights, and the occasional roast of a really bad SIG questionnaire.

  1. Aug 12

    Your TPRM Program Isn't Fixable

    Your third-party risk program is probably built on questionnaires, and you already know they don't really work. So the real question is not how to make them better. It's whether you should tear the whole thing down and start over.In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik get honest about what it takes to rebuild a TPRM program from the ground up. They dig into why the hardest part isn't the tooling, it's breaking the mental model you've been committed to for years. Drawing on the idea of creation and destruction, they walk through what they would keep, what they would throw out, and why using AI to speed up a broken process just gets you to the wrong answer faster. In this episode, you will learn: Why incremental improvement is the trap, and when a program needs a full rebuild instead of a refreshWhat the questionnaire industry is really protecting, and what could actually disrupt itThe three things Bob and Ferhat would build first if they started from scratchWhether you can outsource a TPRM program, and where that logic breaks downWhy AI model cards may replace stacks of AI questionnairesHow to shift from assess-everybody to monitor-everybody and assess by exception If you have ever inherited a program you did not build and wondered whether to fix it or start over, this conversation is for you.

  2. Jul 29

    You Can't Say No to Your Vendors

    You can't actually say no to a vendor. Ask any room of CISOs how many of them have the power to walk away from a vendor relationship over cyber risk, and the honest answer is almost none. So if leverage is mostly an illusion, what actually moves a vendor to fix their exposure? In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik dismantle the idea that third-party risk is about power and rebuild it around something more useful: collaboration. They dig into why the questionnaire-led, finger-wagging approach fails, how to communicate risk in dollars and cents that the business will actually act on, and why the relationship you build before an incident matters far more than any contract clause after one. In this episode, you will learn: Why "saying no" was never the CISO's job, and what the real role is How to turn a contract into a collaboration tool instead of a weapon Why intelligence-led outreach beats questionnaire fatigue every time How to communicate vendor risk so business stakeholders actually respond What to do when a hard-to-replace vendor won't budge Why the first interactions with a vendor set the tone for the entire relationship If you have ever felt ignored by a vendor who has bigger customers than you, this conversation will change how you show up to the table.

  3. Jul 15

    Why Manufacturing Supply Chains Are Ransomware’s Favorite Target

    Manufacturing cybersecurity risk is rising faster than most organizations realize—and many teams are still missing the basics. In this episode, we break down manufacturing cybersecurity risk and why this industry has become one of the most targeted sectors for cyber attacks. If your business depends on uptime, supply chains, or physical operations, this conversation will show you where the real risks are hiding. Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik explore why manufacturing environments are especially vulnerable, from legacy systems and operational technology (OT) to the real-world consequences of downtime. They unpack new research showing how far behind many organizations are, why cyber attacks in manufacturing are shifting from data theft to operational disruption, and what leaders need to understand to protect production lines and critical infrastructure. Understand why manufacturing is a top target for cyber attacks Learn how downtime risk outweighs traditional data breach concerns Discover the gap between IT security and operational technology (OT) Explore why many organizations still struggle with basic cyber hygiene Get insights into how cyber threats are evolving across global supply chains Don’t risk production downtime or supply chain disruption. Learn how to identify and prioritize the cyber risks that matter most.

  4. Jul 1

    The #1 Mistake Boards Make on Cyber Risk

    Cyber risk communication with boards is broken—and most organizations don’t realize how much it’s costing them. In this episode, we unpack cyber risk communication with boards and reveal why even well-prepared security leaders fail to get buy-in where it matters most. If you’ve ever struggled to explain risk in a way executives actually understand, this conversation will show you how to fix it. Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik break down what boards actually care about, why traditional reporting (like risk heat maps and technical metrics) often falls flat, and how to reframe third-party cyber risk in a way that drives action. Drawing from real-world experience and industry research, they explore the gap between cybersecurity teams and board-level decision-makers—and how to close it with clearer storytelling, smarter prioritization, and business-aligned messaging. Learn how to translate complex cyber risk into language boards care about Discover why common tools like heat maps often fail executives Understand the 3 things boards prioritize—and how to align your messaging Get practical strategies for answering “bad” board questions effectively See how better communication can directly improve organizational resilience Don’t risk your message getting lost in complexity. Learn how to communicate cyber risk in a way that drives real decisions.

  5. Jun 17

    The Hidden Signals Predicting Vendor Collapse

    Third-Party Risk Prediction is the future of cybersecurity, but can you actually predict when a vendor will fail? In this episode of Third Party, we explore third-party risk prediction and whether forecasting vendor failure is realistic or just another false promise. If you’ve ever wondered how to identify hidden risks before they explode, this conversation delivers practical insights you can act on immediately. Hosted by Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik, this episode dives into the real signals behind vendor instability, from layoffs and geopolitical conflict to ransomware targeting patterns and operational blind spots. The team breaks down why correlation is often mistaken for causation, how attackers exploit chaos, and why most organizations still miss early warning signs. You’ll walk away with a clearer understanding of what can actually be predicted, what cannot, and how to build a smarter third-party risk strategy that goes beyond surface-level metrics. What you’ll learn: How to identify early warning signals of vendor failure before a breach happens Why layoffs, automation, and global conflict can increase third-party risk exposure The difference between correlation and causation in risk modeling How attackers exploit chaos and weak vendor ecosystems Why vendor self-reporting often fails and what to rely on instead Don’t risk missing the signals that matter. Learn how to spot risk earlier and make smarter third-party decisions before it’s too late.

  6. Jun 4

    Mythos Hype Check: TPRM Paradigm Shift or Big Nothing Burger

    A new AI model called Mythos promises to find vulnerabilities faster than any human team. But what does that actually mean for the security leaders responsible for managing third-party risk? In this special episode, Jeffrey Wheatman is joined by Bob Maley, Ferhat Dikbiyik, and Black Kite co-founder and CTO Candan Bolukbas to break down what Mythos and Project Glasswing actually change, and what they don't. The numbers are already alarming. Forty-eight thousand CVEs published in 2025. A 43-day mean time to patch. An exploitation window that has gone negative, meaning threat actors are exploiting vulnerabilities an average of seven days before defenders even know they exist. Mythos accelerates vulnerability discovery, but as the team makes clear, discovering more vulnerabilities faster only matters if you have a program built to handle it. In this episode, you will learn: What Mythos and Project Glasswing actually are and why the hype may be outpacing the reality Why the vulnerability deluge is already unmanageable with traditional CVSS-based prioritization How the 135-day embargo window affects your third-party exposure Why fourth-party risk, meaning what your vendors run rather than just who they are, is becoming the real blind spot What SBOMs have to do with the future of supply chain vulnerability management The three things security leaders should do right now to prepare their programs This is not a theoretical conversation. It's the one your program needs before the window closes.

  7. May 20

    Are You Measuring the Right Risks…Or Just the Easiest Ones?

    Are you measuring the right risks in your third party risk management program—or just the easiest ones? In this episode, we break down how most teams approach third party risk management metrics and why those metrics often fail to reflect real business risk. If you’ve ever wondered whether your TPRM strategy is actually driving better decisions or just producing reports, this conversation will challenge how you think about risk measurement. Hosts Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik unpack the gap between what organizations track and what actually matters—from misleading metrics and “top vendor” lists to the struggle of communicating risk to executives who don’t see the value. You’ll learn how to rethink your approach to third party cyber risk management, move beyond surface-level reporting, and focus on the signals that truly impact your business. In this episode, you’ll learn: Why most third party risk metrics are based on convenience, not impact The difference between measuring activity vs. measuring real risk How to make risk meaningful to boards and executive stakeholders What “good” risk metrics actually look like in practice How to avoid false confidence from incomplete or misleading data Don’t risk building your strategy on the wrong signals. Learn how to measure what actually matters—and make better decisions because of it.

  8. May 6

    Why Automation Is Creating More Cyber Risk

    Automation vs Accuracy in TPCRM is one of the biggest challenges in modern third-party risk management. In this episode, we break down how the push for faster automation is impacting accuracy, and what that means for your TPCRM program. If you’re relying on automation to scale vendor risk assessments, this conversation will help you avoid costly blind spots and make smarter decisions. Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik unpack the real tradeoffs between speed and accuracy in TPCRM, exploring how automation can both strengthen and weaken your risk posture. They discuss the dangers of over-relying on data, where AI-driven decisions fall short, and why human judgment still plays a critical role in identifying real risk. This episode is essential for anyone responsible for vendor risk, cybersecurity, or compliance who wants to scale effectively without sacrificing confidence in their decisions. In this episode, you’ll learn: How automation in TPCRM can unintentionally increase risk The hidden tradeoffs between speed and accuracy in vendor assessments Why more data doesn’t always lead to better decisions Where AI and algorithms fall short in real-world risk scenarios How to balance automation with human judgment for better outcomes Practical ways to improve visibility and decision-making in your TPCRM program Don’t risk scaling bad decisions faster. Learn how to balance automation and accuracy to protect your business.

See All (24)

Trailer

Ratings & Reviews

5
out of 5
5 Ratings

About

If you manage third-party cyber risk, you’ve seen it all: meaningless scorecards, black-box tools, and endless frameworks that never quite connect to business impact. Third-Party is the podcast built for the people behind the dashboards. The ones managing 5,000 vendors with a team of three. Hosted by Jeffrey Wheatman, Ferhat Dikbiyik, and Bob Maley, this show unpacks what actually works (and what doesn’t) in TPRM. No fear tactics. No buzzwords. Just unfiltered conversations, sharp insights, and the occasional roast of a really bad SIG questionnaire.

Information

  • Creator
    Third Party
  • Years Active
    2025 - 2026
  • Episodes
    24
  • Rating
    Clean
  • Copyright
    © Third Party
  • Show Website
    Third Party

You Might Also Like