Show Notes
Third-party breaches keep happening even when everyone claims they’re “compliant.” So we get specific about what’s broken: the endless vendor security questionnaire loop, the false comfort of self-attestation, and the gap between checkbox compliance and real, validated assurance. Ryan Patrick from HITRUST joins us to talk through what actually changes outcomes when critical infrastructure and healthcare supply chains are under constant pressure from modern attack techniques. We dig int...
More from Third Party Threat Hunters
A vendor can look “approved” on paper and still be sliding toward a disruption you never saw coming. We talk with Jenna Wells, CEO of Supply Wisdom, about the single risk domain blind spot and why cyber-only vendor reviews miss the early warning signs that show up first in operations, financial health, leadership churn, regulatory exposure, ESG signals, reputation pressure, and location-based disruption. We get practical about what it takes to move from reactive third-party risk management t...
Third Party Threat Hunters, hosted by Gregory Rasner, is a podcast about third-party risk, vendor cyber risk and the supply chain threats hiding behind your questionnaires. Hear from practitioners in banks, credit unions and healthcare. New episodes weekly. Send us a question for a future episode Support the show
In February 2024, a ransomware attack on Change Healthcare froze roughly 40% of US medical claims and left hospitals and physicians unable to get paid for weeks, even though most were never touched by the attackers. vCISO and author Kayne McGladrey explains why Change is still the best case study for concentration risk, why AI dependency is set up to repeat it (this time on purpose), and why "cyber risk" is really business risk with a different trigger. We cover: - Why Change Healthcare wasn...
Your third-party vendors are not “adding AI” as a feature. They’re turning into fast-changing agent stacks with models, connectors, plugins, skills, MCP servers, and subprocessors that can shift underneath you in days or even minutes. That’s the uncomfortable backdrop for our conversation with Shankar Krishnan, co-founder of Prompt Armor and a longtime AI threat researcher, as we unpack what third-party AI risk really looks like when the attack surface won’t sit still. We get concrete about ...
Your vendor’s product might be running an LLM you never evaluated and that silent dependency can become the cleanest path into your data. We sit down with Ken Huang, author and AI security researcher, to unpack what “third-party AI supply chain” really means when GenAI features are stitched together from embedded models, vector databases, RAG pipelines, agent frameworks, and downstream APIs you do not directly control. We get practical about the risks security teams are actually facing...