One of the strongest points in the discussion was the distinction between compliance and security.Compliance artifacts matter. You may need a SOC 2, an ISO report, or a completed SIG questionnaire. But those are proof points, not the entire picture. A company can be compliant and still be breached. In fact, many breached organizations were compliant right before the incident.That is why the goal should not be “compliance first.” The goal should be building a security program strong enough that compliance becomes a byproduct of doing the right things well.
The Real Governance Gap: What’s Written Down vs. What’s Actually Happening
When people talk about the governance gap, they often focus on missing policies. But the deeper issue is usually execution.A policy can look perfect on paper and still fail in practice. That came through strongly in both perspectives during the conversation. The biggest breakdown usually happens when the documented process and the real-world process drift apart. Someone follows “their” way of doing things instead of the approved way. A control point gets skipped. A review step never happens. Nobody notices until there’s a problem.This is one reason annual questionnaires often miss the mark.If you only ask for evidence once a year, you’re getting a snapshot of a moving target. Your environment is changing all the time - new tools, new vendors, new permissions, new workflows. A static questionnaire can’t keep up with that reality. It may satisfy a requirement, but it does not give you operational confidence.Rachel’s point is simple and practical: use automation to understand what is actually happening in your environment, then prioritize from there.That means focusing less on whether a vendor can produce a polished report and more on the fundamentals:
- What access do they have?
- What data do they touch?
- What dependencies do they create?
- What happens if they go down?
If you can answer those questions, you already have a much better view of risk than a stack of checkbox answers will give you. Check out the podcast and subscribe: https://thirdpartythreathunters.buzzsprout.com
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →