If you work in third-party risk management, you’ve probably heard the same promise over and over: AI will make vendor risk easier, faster, and smarter. The reality is more complicated. In banking, where compliance, documentation, and ongoing monitoring matter, AI can help a lot - but only if you know where it fits and where it doesn’t.In this conversation with Paul Kurtz, a long-time financial services leader focused on third-party risk management, we explored how AI is changing vendor oversight in regulated environments. The big takeaway: AI is not a magic bullet. It’s a tool that can help you focus on the risks that actually matter, especially in ongoing monitoring, vendor assessments, and cross-functional risk conversations.
Why AI in Third-Party Risk Management Feels Different in Banking
Banks were early leaders in third-party risk management because regulators pushed them there. That history matters. It means most banks already have structured processes, documented reviews, and a healthy respect for auditability.But AI changes the equation. It doesn’t just fit inside cyber or IT. It creates a broader risk surface that touches legal, compliance, privacy, operations, and information security. That’s why the conversation around AI in third-party risk management has to be wider than “Is this tool secure?”Paul described himself as an AI generalist rather than a specialist, and that’s an important mindset for risk professionals. You don’t need to become a data scientist. You do need to understand enough to ask the right questions, challenge the right assumptions, and know when to pull in subject matter experts.That’s especially true when a vendor introduces AI into your environment. A vendor using Copilot to take meeting notes is not the same thing as a vendor using AI to make decisions about your customers. The risk impact is not equal, and your program should reflect that.
To learn more, check out my podcast and subscribe: https://thirdpartythreathunters.buzzsprout.com
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →