Your Third-Party Risk Management Program Is Bad and You Should Feel Bad
summary
Argues that current TPRM eats security resources without improving security and urges publish SOC 2s and pentests for transparency. Recommends preferring independent audits over custom 400–500 question forms, using a three-question gate (SOC 2, pen test, named security executive) to triage risk, and hosting artifacts in a public portal (example: SafeBase portal) to cut buyer wait time (security review time drops from weeks to days). Uses click‑through NDAs (e.g., Bonterms) and contract levers like liability and audit rules when controls are missing.
AI-written summary · about
chapters (7)
- 0:00Introduction and thesis
- 3:09History of TPRM standards
- 9:19Critique of current practices
- 18:40Tooling and market analysis
- 25:04Implementing a new approach
- 36:36Defining success in TPRM
- 41:27Summary and Q&A
related talks
27mThird-party Risk Management: SOC 2s, Security Questionnaires...
51mThe Overlooked Security Risk: 3rd Party Risk Management
53mYou Gotta Fight For Your Right To Third Party
31mThird-Party Risk Management: Preventing the Next Stuxnet
44mA Matter Of Trust: When Security Is Not Enough
41mAim-Ready-Fire
49mPragmatic Approaches To Building Secure Software
44mApplication Security: Everything we know is wrong