Guest blog courtesy of D3 Security.
Welcome to another episode of "Let's SOC About It." Today, we dive into the complex world of third-party risk management with Ketan Nilangekar, CEO and co-founder of ThreatWorx.
Third-party risk management involves assessing and mitigating risks associated with external vendors who have access to an organization's data and systems. Traditionally, it has relied on security questionnaires, which, despite their widespread use, are often slow, laborious, and inaccurate. These questionnaires can include hundreds of questions, yet the data they produce may not accurately reflect true risk exposure.
For over a decade, the industry has been stuck in a rut, leaning heavily on questionnaires and self-attestation to evaluate vendor risk. This approach frequently offers a limited view of the vendor ecosystem’s risk, especially as breaches increasingly stem from vendor vulnerabilities.
The expansion of networks beyond traditional boundaries to include fourth and fifth-party vendors, coupled with increased data sharing, exacerbates the problem. Traditional methods are failing to adequately address the evolving threats. Here, AI offers a promising path toward more effective, evidence-based solutions.
In this episode, Amy and Ketan discuss why innovation in this space has lagged and why assessing third-party risk takes so long. While some automation exists, human involvement is still needed to complete questionnaires, which vendors are often incentivized to rush through rather than answer honestly. This creates a challenge in verifying the accuracy of their self-reported risk profiles.
Episode Highlights:
The State of Third-Party Risk Management (00:00-02:30)
Ketan sheds light on the flaws of traditional security questionnaires in third-party risk management, describing them as slow, labor-intensive, and prone to inaccurate data. He notes that the industry has seen little progress in over a decade, with most solutions still tethered to these outdated tools.
Challenges in Assessing Vendor Security (02:30-09:15)
Innovation lags because enterprises struggle to thoroughly evaluate vendors’ security. Unlike inspecting a house, where you can peek inside, assessing a vendor’s security posture means peering “over their firewalls”—a daunting task. While automation helps to some extent, the process still hinges on vendors completing questionnaires, which they may rush through without full honesty. The lack of robust mechanisms to cross-check vendor-provided information only compounds the problem.
The Role of AI and Future Trends (09:15-17:22)
AI is beginning to transform third-party risk management by sifting through vast pools of threat and vulnerability intelligence. It can correlate data, analyze snapshots of vendor ecosystems, and pinpoint relevant risks, paving the way for more focused vendor discussions. Looking ahead, Ketan predicts that mandates and growing awareness will drive the future of risk management, pushing security considerations to third- and fourth-party vendors. Ideally, vendors will become active participants, gaining valuable insights into their own exposure.
The Importance of Evidence-Based Approaches (17:23-21:16)
The conversation underscores the need to move beyond good-faith efforts and embrace evidence-based risk management. Vendors may exaggerate or misrepresent answers on questionnaires due to a lack of incentive or expertise—small vendors, in particular, often lack the knowledge to respond accurately. To strengthen third-party risk management, Ketan advocates for a new approach rooted in evidence, offering a consistent and realistic view of vendor risk.
