AI is changing how teams handle vendor operations, but faster does not automatically mean safer. In this conversation with Rachel Curran, founder of Loctivity and leader of GRC Meetup, we dig into the real tension behind
AI in third-party risk management: how to move quickly without turning security into “security theater at speed.”
If you’re responsible for vendor onboarding, security reviews, compliance, or risk decisions, this post breaks down where AI helps, where it creates new blind spots, and why the basics - access, data, dependencies, and prioritization - matter more than ever. You’ll also see why point-in-time assessments are starting to show their age, and what a more dynamic model could look like.
Why AI in Third-Party Risk Management Can Create “Security Theater at Speed”
The biggest mistake organizations make is trying to bolt AI onto a broken process.If your vendor review workflow is already noisy, slow, or overly checkbox-driven, AI does not fix the underlying problem. It just makes the same bad process move faster. Rachel called this out clearly: if you use automation to accelerate a weak control model, you get “security theater at speed.”That phrase is worth sitting with.A lot of teams believe they’re improving security because they can send a questionnaire, collect a report, and mark the task as done. But a completed workflow is not the same thing as a reduced risk. If the process only proves that paperwork exists, not that risk was actually assessed, AI simply helps you generate paperwork faster.The better question is not, “How do we do more, faster?” It’s, “What does this help us prioritize?”That is where AI can be useful. Not as a replacement for judgment, but as a filter that helps people focus on the things that really matter. If the tool helps you identify which vendors need attention, where the biggest exposure lives, or which controls are missing, that creates value. If it only speeds up a shallow review, it creates the illusion of progress
Catch the episode here and subscribe: https://thirdpartythreathunters.buzzsprout.com