Services
Six engagements, each scoped and evidenced.
Every Third Party Threat Hunting™ (TPTH™) engagement has a written scope, runs the Evidence-First method, and ends with evidence your examiner will accept.
01
Advisory & assessments
Program gap assessments, TPRM effectiveness reviews, compliance and audit alignment, maturity-model scoring.
Advisory →02
Managed third-party threat hunting
Practitioners work your systemically critical vendors; automation watches the rest. Foundation, Resilience and Program tiers from $2,500 a month, month to month.
Managed tiers and prices →03
AI risk & agent training
AI vendor risk assessments, AI-agent training and evaluation, NIST AI RMF and ISO/IEC 42001 alignment.
AI risk →04
Privileged access reviews
What your third parties can reach once they are inside — standing privileges, shared and service accounts, session recording and joiner-mover-leaver for vendor staff. The subject of Greg's fourth book.
Privileged access →05
Vendor-neutral tool selection
Choosing a TPRM, GRC or AI-governance platform, from a firm that sells no software and takes no referral fees. Requirements from your own process, a scored shortlist, and demo questions vendors do not expect.
Tool selection →06
Virtual & fractional leadership
A vCRO, fractional head of third-party risk or AI-governance lead, retained by the month. Senior accountability for vendor and AI risk without a full-time executive hire.
Virtual leadership →Speaking
Keynotes and workshops on third-party and AI risk for conferences, boards and internal events.
“Greg addressed security blind spots in our daily lives that I hadn’t considered… I would hire Greg again for another speaking opportunity and highly recommend him.”
Custom training
CPE-eligible courses delivered privately, on your own vendor set and policies.
Training →New for banks and credit unions: Core Contract Health Check
A fixed-fee review of your core processor contract against the practices the Fed, FDIC and OCC named on Sep 11, 2026. Ten areas rated, your renewal asks and a board summary in two weeks, for $6,500.
Core Contract Health Check →Now booking: Trust Center Service
We write your Trust Center and verify every claim against your evidence, then keep it current. Priced by complexity band, from $4,500 to build and $500 a month to maintain.
Trust Center Service →Privileged access
What your third parties can reach once they are inside
Most third-party programs assess whether a vendor is trustworthy and stop there. The harder question is what that vendor's staff can actually do in your environment on a Tuesday afternoon, and who would notice.
What the review covers
- Standing privileges held by vendor staff, and which of them could be made just-in-time instead
- Shared, service and break-glass accounts used by third parties, and whether any action can be traced to a person
- Joiner-mover-leaver for vendor personnel — in practice the weakest link, because the vendor controls the leaver event and you do not
- Session recording, approval workflow and evidence an examiner will accept
- Remote access paths, including the ones that arrived with an acquisition or a support contract
Why us
Privileged access is the subject of Greg's fourth book, Privileged Access Management, and the control set he ran at Truist across a vendor estate of that scale. The review is scoped to your environment and ends the same way every TPTH engagement does — ranked findings, evidence references, and a remediation plan with dates.
Usually bought as a scoped addition to an advisory engagement →, and priced on scope.
Want to see the method first? The free Privileged Access Review class → runs quarterly and teaches the VAULTS™ review → in one hour. Or take the free on-demand VAULTS training → any time.
Tool selection
Advice from someone the vendors do not pay
Most tool advice comes from resellers, implementation partners and MSPs who are paid by the platform they recommend. That is not dishonest, but it is not neutral, and it is rarely disclosed at the point the recommendation is made.
What vendor-neutral means here, specifically
- TPTH sells no software — no product, no white-label, no license resale.
- No referral fees, commissions or revenue share — from any platform, in any engagement.
- No vendor sponsorship — of the recommendation, the research behind it, or the report it appears in. We do seek sponsorship for the podcast, and any such contract covers the show alone and buys no influence over an engagement.
- You own the output. The requirements, scoring model and shortlist are yours to reuse at the next renewal without us.
What the engagement produces
- Requirements from your actual process — drawn from how your team assesses vendors today, not from a generic feature checklist
- A scored shortlist, with the scoring model visible so you can see why something placed where it did
- Demo scripts — the questions that expose whether a feature is shipping, on the roadmap, or a services engagement in disguise
- Reference-check questions for customers at your size and in your regulatory position, not the vendor's showcase accounts
- Contract and SLA review — the terms that matter when the platform holds your assessment evidence
When it is worth doing
- A platform is being renewed and nobody has tested whether it is still the right one
- A first purchase, where the cost of choosing badly is three years of workarounds
- A platform that is not delivering, and you need to know whether that is the tool, the configuration, or the process feeding it
- AI-governance tooling, where the category is young and the claims are ahead of the products
Sometimes the answer is that you do not need a platform yet — that the process is not stable enough to automate, and buying one now would encode the problem. A firm paid by vendors cannot say that.
Direct engagements
Two ways to retain a TPTH expert
Neither is a fixed-scope deliverable. Both are an individual's time, retained directly and limited by how much of it there is. The named expert and their CV are confirmed when the engagement is scoped.
Expert witness and litigation support
Third-party breach and vendor-failure litigation, contract and SLA disputes, regulatory enforcement, and standard-of-care opinions on whether a third-party risk program met the practice of its industry at the time.
Six years running third-party cyber risk at a top-ten US bank, four published books on the subject, and the co-author of an industry assessor certification — which is to say the published record an opposing counsel will read is already on this site.
CV, prior engagement history and fee schedule on request. Conflict check before any substantive discussion.
Advisory board seat
A standing seat for companies building in third-party risk, AI governance or the security tooling around them — GRC and TPRM platforms, assessment and monitoring vendors, and the AI-governance tools now being sold into the same buyer.
Quarterly sessions, reachable between them, and candid about the thing a board usually hears late: whether the buyer actually has the problem you are solving, and whether your roadmap survives contact with an examiner.
A small number of seats, one per competitive segment. Cash, equity or a mix. Terms on enquiry.
The Evidence-First method
Four steps. The same practitioner from scope to hand-over.
Step 1
ScopeA 30-minute call, then a fixed-scope proposal. No paid discovery phase.Step 2
AssessDocument review, interviews and evidence testing against the framework you're examined under.Step 3
Close gapsRanked remediation with owners and dates, written for the board and the examiner.Step 4
Prove itRe-test, evidence pack and a hand-over your team can keep running.Founder
Who you work with
See it running
Try it before you talk to us
Both demos are live, public and need no sign-up. Every client, vendor name, rating and finding in them is an illustrative example, not a client's data.
Security Agent Mesh
Walk the four-agent architecture end to end — what each agent watches, what it hands on, and where a human signs off.
Open the architecture demo →The Lighthouse
The console we run your program from — vendors ranked worst-first, evidence weighted by how much we can prove, and findings closed with a signed record. Switch between three fictional clients, or see it as a client would.
Open the Lighthouse demo →Now booking
Trust Center Service: built on evidence, kept current
Our practitioners write your Trust Center and verify every claim against your evidence, so your customers' security teams get answers they can rely on and your team answers fewer repeat questionnaires.