Are Your Vendors Lying to You?

Your vendor says they have MFA everywhere. They say their data is encrypted. They say the right things on every questionnaire you send. So why is there almost always a gap between what a vendor tells you and what is actually happening inside their environment?

In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik dig into the uncomfortable space between attestation and reality. Jeffrey wants to call it lying. Bob and Ferhat push back hard, arguing most of it is bad data, missing inventory, and answers that are aspirational rather than dishonest. From there they get into the harder problem: how do you verify anything when you cannot send an auditor into Google or Amazon, and what happens to verification itself when the answers you receive were generated by AI in the first place?

In this episode, you will learn:

Why yes or no questionnaire answers measure compliance, not the efficiency of a control
The three types of verification, from signals to behavior analysis to vendor testimony
Why every signal needs a confidence level before you decide which battles to fight
How to get real value from SOC 2 reports and where third-party audits fall short
Why most programs are built to discover and ask questions, but never to follow up
What happens to trust but verify when AI is producing the answers on both sides

If your program collects a lot of vendor answers and verifies almost none of them, this conversation is worth your time.

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(27)

Is AI the End of Humanity or Just Another Y2K?

Some of the people building AI are warning it could end humanity. Others say it's all hype. Meanwhile, AI agents have already escaped a testing sandbox and attacked another company's infrastructure. S...

23 Sep 37min

The AI Scanner Hype Test

AI-powered vulnerability scanners can now find tens of thousands of flaws in a matter of weeks. That sounds like a breakthrough until you look at the other number: the patch rate is under one percent....

26 Aug 37min

Your TPRM Program Isn't Fixable

Your third-party risk program is probably built on questionnaires, and you already know they don't really work. So the real question is not how to make them better. It's whether you should tear the wh...

12 Aug 37min

You Can't Say No to Your Vendors

You can't actually say no to a vendor. Ask any room of CISOs how many of them have the power to walk away from a vendor relationship over cyber risk, and the honest answer is almost none. So if levera...

29 Jul 41min

Why Manufacturing Supply Chains Are Ransomware’s Favorite Target

Manufacturing cybersecurity risk is rising faster than most organizations realize—and many teams are still missing the basics. In this episode, we break down manufacturing cybersecurity risk and why t...

15 Jul 33min

The #1 Mistake Boards Make on Cyber Risk

Cyber risk communication with boards is broken—and most organizations don’t realize how much it’s costing them. In this episode, we unpack cyber risk communication with boards and reveal why even well...

1 Jul 32min

The Hidden Signals Predicting Vendor Collapse

Third-Party Risk Prediction is the future of cybersecurity, but can you actually predict when a vendor will fail? In this episode of Third Party, we explore third-party risk prediction and whether for...

17 Jun 37min