Knowledge Network · Sep 21, 2026
Podcast Outtakes: Vendor Trust with Bill Haber
Most security teams are asking vendors the wrong question. Not "are you compliant?" Ask: "can I actually trust how you operate? “I asked Bill Haber about third-party risk, MSPs, and AI. His answer was blunt: A lot of s...
- what they touch
- how broad their access is
- what tools they use
- where your data lives
- how they handle financial risk
And here's the part most teams miss: The small vendors matter too. Bad actors don't always go through the front door. Sometimes they come in through the bread truck. If you only monitor the biggest providers, you're leaving a gap wide open.AI makes this harder. Bill called it an explosion of risk in a million directions. Shadow AI is already showing up inside companies that think they only use 2 tools. In reality? They may have 19 apps touching sensitive data. Sales and marketing teams are especially exposed. They're feeding competitive info into AI tools without realizing what gets shared downstream. Then there's fourth-party risk. If your vendor relies on another vendor's LLM or cloud stack, you need to know that too. You don't need a giant enterprise program to start. You need to know:
- who you rely on
- who your vendors rely on
- which shared dependencies matter
- whether you can answer that cleanly when a customer asks
Still thinking about the last point Bill made: Continuous monitoring is not a yearly scan. It’s ongoing visibility into EDR, logs, vulnerabilities, and real changes in posture. Anything less is just a point-in-time check with a nicer name. Full conversation: https://www.buzzsprout.com/2120821/episodes/19660400
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →