Show Notes
Your vendor’s product might be running an LLM you never evaluated and that silent dependency can become the cleanest path into your data. We sit down with Ken Huang, author and AI security researcher, to unpack what “third-party AI supply chain” really means when GenAI features are stitched together from embedded models, vector databases, RAG pipelines, agent frameworks, and downstream APIs you do not directly control. We get practical about the risks security teams are actually facing...
More from Third Party Threat Hunters
A vendor can look “approved” on paper and still be sliding toward a disruption you never saw coming. We talk with Jenna Wells, CEO of Supply Wisdom, about the single risk domain blind spot and why cyber-only vendor reviews miss the early warning signs that show up first in operations, financial health, leadership churn, regulatory exposure, ESG signals, reputation pressure, and location-based disruption. We get practical about what it takes to move from reactive third-party risk management t...
Third Party Threat Hunters, hosted by Gregory Rasner, is a podcast about third-party risk, vendor cyber risk and the supply chain threats hiding behind your questionnaires. Hear from practitioners in banks, credit unions and healthcare. New episodes weekly. Send us a question for a future episode Support the show
In February 2024, a ransomware attack on Change Healthcare froze roughly 40% of US medical claims and left hospitals and physicians unable to get paid for weeks, even though most were never touched by the attackers. vCISO and author Kayne McGladrey explains why Change is still the best case study for concentration risk, why AI dependency is set up to repeat it (this time on purpose), and why "cyber risk" is really business risk with a different trigger. We cover: - Why Change Healthcare wasn...
Your third-party vendors are not “adding AI” as a feature. They’re turning into fast-changing agent stacks with models, connectors, plugins, skills, MCP servers, and subprocessors that can shift underneath you in days or even minutes. That’s the uncomfortable backdrop for our conversation with Shankar Krishnan, co-founder of Prompt Armor and a longtime AI threat researcher, as we unpack what third-party AI risk really looks like when the attack surface won’t sit still. We get concrete about ...
“100% automated vendor risk assessments” sounds seductive right up until you are staring at unstructured SOC 2 reports, mismatched ISO certificates, and a queue you cannot clear. Greg sits down with Brian Shaw, a long-time third-party risk and compliance leader, to talk about what AI can realistically do in third-party risk management today, and what it absolutely should not do yet. We start with a blunt warning: do not automate a broken process. If a question does not change a risk decision...