"100% automated vendor risk assessments" sounds great until you're staring at unstructured SOC 2 reports, mismatched ISO certs, and a review queue you can't clear. Brian Shaw, a longtime third-party risk and compliance leader, joined us to talk about what AI can realistically do in TPRM today — and what it absolutely shouldn't do yet.
Brian's rule of thumb: don't automate a broken process. If a question doesn't change a risk decision, answering it faster doesn't improve your program. The use case that's actually paying off right now is evidence collection and normalization — AI pulling risk signals out of SOC reports, contracts, and policies, then flagging contradictions across sources with citations so a human can make the final call.
We also talked about what doesn't change: analysts aren't getting replaced, they're getting freed up to build real strength in materiality, investigation, mitigation, and relationship management. And we zoomed out to a bigger shift in how vendor risk should be architected — from annual assessment as a single photograph to continuous monitoring as a movie, with context carried from intake all the way through renewal. We closed on a sharp point about "vendor diversity" quietly collapsing into one shared cloud or model-provider dependency, and how risk graphs can help you see the real blast radius.
Which TPRM workflow would you automate first? Let us know.
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →