Services · Virtual & fractional leadership
A senior risk leader in the seat, for the hours you actually need.
Third Party Threat Hunting™ (TPTH™) provides a vCRO, fractional head of third-party risk or AI-governance lead. Retained by the month, accountable to your board, and set up to hand over to a full-time hire when you are ready for one.
The roles
Three seats, one specialty
Most virtual executives sold by MSPs are vCISOs with vendor risk as one line on the list. Here it is the job.
01
Virtual Chief Risk Officer (vCRO)
Owns the risk that arrives through vendors, suppliers and AI: the third-party and AI lines of your risk register, risk appetite for outsourcing, and the committee and board reporting that goes with them. Fractional CROs usually come from finance or AML. This seat is built for third-party and AI risk.
02
Fractional head of third-party risk
The program lead your org chart is missing. Sets policy and tiering, chairs vendor risk decisions, signs off exceptions, and owns the conversation with examiners and internal audit. $5,500 a month. Pairs with a managed tier when you also need the work done.
03
Fractional AI-governance lead
For firms adopting AI faster than they can govern it. AI use and AI-vendor inventory, policy, NIST AI RMF and ISO/IEC 42001 alignment, and BEACON™ reviews of AI vendors before they are approved.
The seat
What every seat includes
Every seat
- A named leader who sits on your risk or security committee
- A risk register and 12-month roadmap, owned and kept current
- A committee and board report in plain language, on your reporting cycle
- A policy set drafted, approved and reviewed on a schedule
- Liaison with examiners, auditors and customers running due diligence on you
- Risk acceptances and exceptions decided and written down, with the reasoning
- A hand-over pack, so a permanent hire inherits a running function
When it is the right answer
- Your risk or security lead has left and the search will take months
- An exam or audit finding names governance or oversight of third parties
- The board or investors are asking who owns vendor and AI risk
- You are adopting AI faster than anyone is governing it
- You are regulated like a large firm but too small for a full-time executive
- A PE portfolio needs the same risk function in several companies
Engagement models
Advisory seat, embedded, or interim
Scope, days and term are set out in a written charter and confirmed in the proposal. Days below are indicative.
Advisory seat
A few days a month
- Committee attendance and board reporting
- Risk register and roadmap owned
- Reachable for decisions between meetings
- Quarterly review with your leadership team
Embedded
One to two days a week
- Everything in the advisory seat
- Runs the function week to week with your team
- Policy, vendor and exception decisions
- Examiner and audit liaison
- Coaching an internal successor
Interim
Near full-time, for a set term
- Covers a vacant executive seat
- Stabilizes and documents the function
- Helps you recruit and interview the permanent hire
- Structured hand-over before the term ends
Why TPTH
Someone who has held the seat
Six years running third-party cyber risk at a top-ten US bank, leading a team of more than twenty. Four published books on third-party risk, AI risk, Zero Trust and privileged access. The BEACON™ framework for vendor AI risk.
TPTH sells no software and takes no referral fees, so the leader in your seat has no product to steer you toward.
Not the same as managed vendor risk
A managed tier is the work: practitioners on your critical vendors, monitoring on the rest, the monthly evidence pack. A fractional leader is the accountability: the person who sets policy, makes the risk decisions and answers to the board. Some clients take both. Some already have the team and only need the leader.
Managed tiers →Proof
Zero to running assessments in 90 days
At BB&T, Gregory Rasner built a third-party risk assessment program from zero to running assessments in 90 days. The bank asked for 20 assessments in the first year; the program completed 30. That program became the first book, Cybersecurity and Third-Party Risk (Wiley, 2021).
Questions