Third-party and AI risk, assessed by people who have run the program.

Yes, and there is no typical starting point — some clients have no third-party risk function at all, others have one that isn't working, and the two need different first moves. The assessment establishes where you actually are, and the remediation plan doubles as the build plan.

CATRP is the Certified AI Third-Party Risk Professional credential — a dual-track credential in agentic architecture and enterprise AI risk management. It is earned by completing both flagship programs, the Security Agent Mesh Masterclass (build) and AI for TPRM Professionals (govern), plus an ethics attestation and a verified application. There is no proctored technical examination across the two programs; the ethics attestation is a thirty-question quiz you take online and can retake. Eight contact hours, 8 CPEs. It is for people who have to both build and govern AI systems, which is where the risk usually falls between the two. From Jan 1, 2027 the credential adds a third track, the BEACON™ Vendor AI Risk Class; anyone who enrolls before then completes on the current two-course requirement.

A fixed monthly cycle: tiering refresh and intake, assessments and findings, then remediation follow-up and an evidence pack we walk you through.

NIST CSF 2.0, NIST SP 800-161, ISO/IEC 27001 and 27036, SOC 2, the 2023 Interagency Guidance, FFIEC, DORA, NYDFS Part 500, PCI DSS 4.0, HIPAA, HITRUST, NIST AI RMF and ISO/IEC 42001.

The practitioner who scopes the engagement. Associates join for scale on larger programs, never as a hand-off.

Not formally accredited — we are exploring those options for 2027. What stands behind the training today is TPTH's own practice and Knowledge Network, and every course is built around hands-on workshops rather than a lecture. Certificates state the title, the date and the contact hours, one CPE per contact hour, and bodies that accept self-reported credit — ISC2 and ISACA among them — recognize those hours. TPTH is not a NASBA Registered Sponsor and does not award NASBA CPE, so if you need credit toward a CPA license, check with your state board before you book. We would rather you know that now than after.

Every certificate carries a credential ID in the form TPTH-CATRP-YYYY-NNNN. Enter that and the holder's surname at /verify → and you get an answer in seconds. No account, and the check runs in your browser — nothing you type is sent to us.

No. TPTH resells no software, and where we recommend a platform, no referral fee, commission or revenue share comes back to us. One disclosure that belongs in the answer rather than the small print: we do seek sponsorship for the podcast. That supports the show. Any sponsorship contract states that the relationship concerns the podcast alone, and it buys nothing in an assessment, a shortlist or a report.

It closes the velocity gap. A static questionnaire and an annual audit are obsolete the day they are finished — cloud environments and dependencies change daily, and a zero-day travels at machine speed while the response travels by email chain and spreadsheet. That difference is measured in weeks of exposure. SAM replaces point-in-time hope with continuous monitoring under TPTH supervision: four agents, each with one job — watching disclosure feeds, reasoning over which findings actually reach your estate, verifying exposure where a vendor grants access, and turning the result into a dossier your SOC can act on.

Absolutely, and it is usually the better version. In most programs the tools are the easy part; the hard part is making the thing work end to end. Running the course against your own vendor set, policies and templates is what shows you where that actually breaks.

All of it — the work materials are yours. Findings with their evidence references, the maturity score, the remediation tracker and the examiner briefing, in working files rather than only a PDF. We also agree with you what “done” looks like before the engagement starts, so the end is defined at the beginning instead of negotiated at it.

Please do. Our Trust Center → already publishes our policies, our sub-processors, 4 open control gaps with target dates and one disclosed limitation, because a firm that asks vendors to disclose should go first. Send your questionnaire and we will complete it against that register.

Yes — third-party breach and vendor-failure litigation, contract and SLA disputes, regulatory enforcement, and standard-of-care opinions. The detail is on the expert witness page →: CV, prior engagement history and fee schedule on request, and a conflict check before any substantive discussion.