Third Party Threat Hunters
Third Party Threat Hunters is a podcast hosted by Gregory Rasner, a leader in cybersecurity and third-party risk management. Each episode features conversations with experts in the field, covering topics related to third-party risk and security threats. Rasner is the author of several books on TPRM and privileged access management (PAM).
Episodes
Third-Party AI Risk, Explained with Shankar Krishnan
Send us Fan MailYour third-party vendors are not “adding AI” as a feature. They’re turning into fast-changing agent stacks with models, connectors, plugins, skills, MCP servers, and subprocessors that can shift underneath you in days or even minutes. That’s the uncomfortable backdrop for our conversation with Shankar Krishnan, co-founder of Prompt Armor and a longtime AI threat researcher, as we u
Short: Shadow AI in the Workplace with Ken Huang
Send us Fan MailIn this short from the podcast, Ken explains how organizations are failing to capture all the AI risk in their enterprise.Support the show
Shadow AI Supply Chain Risk with Ken Huang
Send us Fan MailYour vendor’s product might be running an LLM you never evaluated and that silent dependency can become the cleanest path into your data. We sit down with Ken Huang, author and AI security researcher, to unpack what “third-party AI supply chain” really means when GenAI features are stitched together from embedded models, vector databases, RAG pipelines, agent frameworks, and downst
AI That Actually Helps TPRM with Brian Shaw
Send us Fan Mail“100% automated vendor risk assessments” sounds seductive right up until you are staring at unstructured SOC 2 reports, mismatched ISO certificates, and a queue you cannot clear. Greg sits down with Brian Shaw, a long-time third-party risk and compliance leader, to talk about what AI can realistically do in third-party risk management today, and what it absolutely should not do yet
Continuous Third-Party Risk Monitoring with Girish Redekar
Send us Fan MailSupport the show
Beyond SOC 2: Real Vendor Risk with Nivathan of SecureOS
Send us Fan MailVendor risk programs fail in a predictable way: we obsess over forms, feel good about a clean SOC 2, and then act surprised when a “trusted” third party becomes the fastest path to sensitive data or operational outage. Greg sits down with Nivedan, co-founder and CEO of SecureOS, to unpack why traditional third-party risk management (TPRM) and EPRM workflows often measure the wrong
Short: Surprise! There's AI in your Enterprise with Bill Haber
Send us Fan MailMany organizations don't realize how far AI is into their systemsSupport the show
The Vendor Trust Gap with Bill Haber
Send us Fan MailYour vendors are not “outside” your business anymore. When an MSP, SaaS platform, or security provider plugs into your environment, they inherit your data, your uptime, and often your privileged access. We talk with Bill Haber, co-founder and CEO of Tekrisq, about how to build third-party risk management that earns real trust instead of producing paper compliance that looks good un
Short: Tech Gians and OFAC with Michael Volkov
Send us Fan MailIn this short video, Mike explains how this is an unappreciated riskSupport the show
Short: How to Identify Material Third Parties with Julie Giaischi
Send us Fan MailIn this short video, we hear Julie explain how to identify the vendors risks that really matter - with your "material" third-parties.Support the show
Sanctions Ready Third-Party Risk with Michael Volkov
Send us Fan MailSanctions enforcement is starting to feel like the new FCPA, and that is not just a catchy line, it is a warning. When more and more OFAC and export controls violations trace back to distributors, agents, and vendors, “third-party risk” stops being an onboarding task and becomes a real legal and operational threat. We talk through how strict liability changes the stakes, why divers
Treat Vendors As Part Of The Enterprise with Julie Giaischi
Send us Fan MailVendor risk feels like it’s turning into paperwork at scale: endless security questionnaires, overwhelmed vendors, and yet third-party breaches keep climbing. We sit down with Julie Giaischi, CEO and co-founder of the Third Party Risk Association, to challenge the habits that quietly keep programs stuck in compliance theater and to map a path toward measurable risk reduction.We dig
Short: Communicate Risk in Business Terms for Success with Becky Newton
Send us Fan MailIn this short video, Becky explains how to do this best.Support the show
Short: How TPRA is Accelerating Threat Intelligence Sharing with Heather Kadavy
Send us Fan MailIn this short video, Heather provides examples of how this is being accomplished. Support the show
Vendor Risk Beyond The SOC Report with Becky Newton
Send us Fan MailA vendor hands you a clean SOC 2 Type II report, the boxes look checked, and everyone relaxes. Then the breach happens anyway. That’s the control assurance paradox, and it’s why we sat down with Becky Newton, founder and managing partner of Newton Risk Intelligence, to get brutally practical about what third-party risk management should look like when the goal is real operational s
Relationships Beat Tools In Vendor Risk with Heather Kadavy
Send us Fan MailVendor risk doesn’t fail because you picked the wrong platform. It fails because nobody trusts the program, nobody speaks the business unit’s language, and everyone thinks it’s someone else’s job. We’re joined by Heather Kadavy, Director of Membership Success at the Third Party Risk Association (TPRA), to get honest about what actually moves third-party risk management forward when
Short: AIs Impact on Third-Party Risk Governance with Michael Berman
Send us Fan MailIn this short video, Michael explains AI's impact on how we process and develop and run our TPRM programs.Support the show
Third Party Risk Management in the Age of AI and Fourth Parties with Michael Berman
Send us Fan MailGreg hosts Michael Berman, CEO of End Contracts and author of The Upside of Third Party Risk Management, for a practical conversation about how vendor risk is changing. The discussion focuses on moving beyond static compliance, managing fourth party and shadow AI exposure, and using contracts and frameworks to make third-party governance more actionable.Key topicsGreg introduces th
From Check-the-Box to True Third-Party Operational Security with Ronen Gottlib
Send us Fan MailIn this episode of Third Party Threat Hunters, Greg speaks with Ronan, co-founder and CEO of Shift Security, about how third-party risk management needs to evolve beyond questionnaires and static assessments. Ronan shares how years of working inside enterprise security, including at Barclays, led him to build a product focused on real operational visibility into vendors, access, an
Short: Map your critical dependencies before it's too late
Send us Fan MailMichael Rasmussen shares a practical way to begin third-party and dependency risk work without getting lost in an enterprise-wide transformation. The focus is on one business-critical service, the people who know it best, and a small set of questions that reveal where resilience and risk really live.In this short segment, he outlines a simple, actionable approach for identifying de
Short: Starting Small with a Critical Service Dependency Map with Michael Rasmussen
Send us Fan MailMichael Rasmussen shares a practical way to begin third-party and dependency risk work without getting lost in an enterprise-wide transformation. The focus is on one business-critical service, the people who know it best, and a small set of questions that reveal where resilience and risk really live.In this short segment, he outlines a simple, actionable approach for identifying de
AIs Impact on Enterprise Boundaries with Michael Rasmussen
Send us Fan MailThe enterprise no longer ends at the org chartThe ideaThe real organization is the network around the organization. Vendors, contractors, platforms, data brokers, APIs, and outsourced processes are not support functions - they are part of the operating system.Why it mattersRisk, performance, and control can no longer be understood by looking only inside the company. If you treat th
Short: The most dangerous assumption in third-party risk with Michael Rasmussen
Send us Fan MailMichael Rasmussen explains why the biggest mistake in third-party risk is assuming you already know who your suppliers are and what risk they bring. Rather than focusing only on contract size or spend, he argues for measuring value at risk, because small vendors can create outsized operational or security impact.Key topicsMichael Rasmussen says the most dangerous assumption is that
The Evolution of GRC and Future Risks in Third-Party Ecosystems with Michael Rasmussen
Send us Fan MailIn this episode, Michael Rasmussen, a leading expert in governance, risk, and compliance, shares insights into the origins of GRC, its ongoing evolution, and its critical role in managing complex third-party ecosystems amid rapid technological change. Discover how organizations can stay ahead of regulatory pressures and operational risks through innovative frameworks and proactive
AI, Third Party Risk, and the Real Work of Operationalizing It with Paul Kurtz
Send us Fan MailGreg reviews how AI is changing third party risk management with Paul Kurtz, a 30 plus year financial services veteran and current third party risk leader at First Century Bank. They focus on what actually changes in banking when AI enters vendor risk workflows, from ongoing monitoring to questionnaire design and regulator conversations.This episode matters because it cuts through
Navigating Third-Party Risk and AI in Cybersecurity with Rachel Curran
Send us Fan MailIn this episode, Rachel Curran, co-founder of Loctivity, shares insights on how AI is transforming third-party risk management, the importance of governance at speed, and practical steps to strengthen security postures. Discover how to balance automation with human oversight and keep your organization resilient in a rapidly evolving threat landscape.Key TopicsRachel’s background in
Beyond Questionnaires: AI Agents, Zero-Day Breaches, and TPRM with Clarence Chio
Send us Fan MailIn this episode, Clarence Chio, CEO of Coverbase, discusses the evolving landscape of AI in cybersecurity, third-party risk management, and the implications of autonomous AI agents. We explore real-world incidents, innovative solutions, and strategic insights for security professionals navigating the AI-driven future.key topicsAI's role in cybersecurity and risk managementImpl
Recommended
Hard Knocks Podcast
Effective Weight Loss for Moms | High protein, Strength Training, Lose Weight, Meal Planning, Fat Loss, Healthy Habits
The Human-Animal Connection - Pet Life Radio Original
Infinite Health with Dr. Arasi Maran
The Daily
World News Tonight with David Muir
The Joe Rogan Experience
English Vocabulary Help
TED Talks Daily
Learn English B1 with Daily News | English Listening Practice
Talk About Talk - Executive & Leadership Communication Skills
English with Olivia | Slow Conversations & Vocabulary
