One of the strongest themes in the conversation is that third-party risk has historically leaned too heavily toward compliance. Questionnaires, attestations, and document reviews all have value - but they’re not the same as finding what an attacker would find.Clarence explains that in fraud and financial crime, you never assume good intent. You don’t ask whether someone withdrawing money is doing it for legitimate reasons and then stop there. You look for evidence, patterns, anomalies, and incentives to game the system. Third-party risk should work the same way.That shift in mindset matters because vendors, suppliers, and SaaS providers are part of many attack chains now. Breaches often involve third parties somewhere along the line. So the question isn’t whether your questionnaire looked good in January. The question is whether something changed in March that made the environment materially riskier.This is where a threat-hunting approach becomes useful. Instead of treating third-party security like a static checklist, you start treating it like an evolving investigation.What would that look like in practice?
- Looking for exposed or newly added access paths
- Monitoring for configuration drift
- Reviewing changes in roles, plugins, and permissions
- Identifying where controls no longer match reality
- Prioritizing the vendors and applications most likely to fail
That last point is especially important for teams that are already under-resourced. Clarence and Greg both note that third-party risk teams are often small. If you’re forced to spend most of your time reading reports, there’s not much time left for actual risk analysis.That’s why automation should not be seen as a replacement for the team. It should be seen as a way to focus the team on the highest-value work.
For more information, look to my podcast and subscribe: https://thirdpartythreathunters.buzzsprout.com