Knowledge Network · Sep 24, 2026
Podcast Outtake: Zero Trust for Vendors
Third-party risk management (TPRM) often looks mature on paper while staying fragile in practice. Security teams grill employees with identity and access management controls, but treat vendors with production access like...
A major theme is why a clean SOC 2 report is not the same as low inherent risk. If a vendor processes PII, PHI, or has privileged access, your exposure stays high even if the audit looks great. SOC 2 can also lag emerging threats, especially AI risk, because audit scopes and control language do not automatically evolve with new vendor behaviors. The episode pushes a practical shift in mindset: stop asking “is the vendor secure today” and start asking “are my use cases secure.” The same marketing analytics tool can be low risk when fed anonymized data and high risk when it receives personal data or becomes operationally critical. Context, not badges, drives the real risk decision.
Check out the full podcast: https://www.buzzsprout.com/2120821/episodes/19707043
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Ready for the exam?
The free exam and audit readiness scorecard: eight questions to ask yourself before an examiner or auditor does.
Get the scorecard →Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →