THIRD PARTY
THREAT HUNTING

On-demand course · about 17 minutes of video

SaaS Vendor Risk Playbook

A short video course from Third Party Threat Hunting (TPTH) on assessing, testing and exiting your SaaS vendors: tier the vendor, collect the right evidence, ask better questions, prove the controls work and leave cleanly. A toolkit of workbooks and worksheets is included.

Watch the free previewBuy the course, $79
~17 minOf videoTen short chapters; watch in one sitting or jump to one
9Toolkit filesWorkbooks, worksheets, a student guide and a knowledge check
30 daysTo a working programLeave with a plan, not just notes
$79One price12 months of access, toolkit included

What you’ll learn

A method for your SaaS vendors you can use on Monday.

  • Why a checklist fails on SaaS, and what to do instead.
  • How to tier a vendor by potential harm, from critical down through high, moderate and low harm, and let the tier decide how deep to go.
  • Who owns what in the cloud, which evidence to ask for at each tier, and how to treat a refusal as a finding.
  • Questions that work, and how to find the integrations and shadow SaaS nobody told you about.
  • How to cover the AI inside your SaaS vendors, test the controls, and leave a vendor with nothing left behind.

About 17 minutes of video, plus a toolkit of workbooks and worksheets you use on your own vendors.

Who it’s for

For the people who assess and oversee SaaS vendors.

Third-party and vendor risk managers, security, compliance, procurement and audit leads who review SaaS vendors and want a clear, repeatable method and working files to start with.

Chapters

Ten short chapters

  1. 1:311. Why SaaS is hardFour reasons SaaS defeats a checklist: time, complexity, fourth parties and opacity.
  2. 3:102. Tier the vendor firstThe intake is a trigger, not due diligence. It decides how deep to go. This is the free preview.
  3. 5:493. Who owns whatCloud is anything outside your network. The vendor’s provider is your fourth party.
  4. 7:194. Read the evidenceEvidence beats assertion. A refusal is a finding: record it and rate it.
  5. 9:315. Questionnaires that workAsk about risk, not controls. About 25 questions tied to the tier.
  6. 10:446. Integrations and shadow SaaSAsk every vendor five things, and find the vendors nobody told you about.
  7. 12:307. AI inside SaaSThree questions cover most of the risk.
  8. 13:238. Test it, prove itMatch testing to the tier: four tests and a 48-hour tabletop.
  9. 15:169. Exit cleanlyOffboarding is where data gets left behind.
  10. 16:0110. Your 30-day planFour weeks to a working program.

Free preview

Watch Chapter 2 first: Tier the vendor first

Enter your work email and the preview opens on this page straight away.

What happens next

The preview opens on this page. Your email address also signs you up for Fourth Party, our weekly letter on third-party and AI risk. We email a link to confirm that subscription: you are not on the list until you click it, and every issue has a one-click unsubscribe.

We keep your email address to send Fourth Party and to follow up about training. No tracking of opens or clicks. How we handle your address →

Get the full course

One price, $79

You pay securely through Square. Your access link arrives by email within a few minutes of purchase.

SaaS Vendor Risk Playbook (toolkit included)

About 17 minutes of video, plus a toolkit of workbooks and worksheets you use on your own vendors. 12 months of access from the day you buy. Watch on any device with a browser.

7-day refund policy: if the course is not what you expected, email greg@thirdpartythreathunting.com within 7 days of purchase, even if you have watched it. A refund ends your access.

Buy the course, $79

Already bought?

Open the link in your access email. Lost it? Get a new link →.

Also: All four courses for $299 → · Back to all training →

For your team

Team packs: a personal link for every seat

Training your whole vendor risk team? Buy seats once and give each person their own link.

5 seats

$336

$67.20 a seat · one payment · 12 months of access

One email with 5 personal links, one for each person.

Buy 5 seats, $336

10 seats

$593

$59.30 a seat · one payment · 12 months of access

One email with 10 personal links, one for each person.

Buy 10 seats, $593

25 seats

$1,284

$51.36 a seat · one payment · 12 months of access

One email with 25 personal links, one for each person.

Buy 25 seats, $1,284

After you pay you get one email with a personal access link for each seat. Forward one link to each person: each link is for one person, so please do not share one link between several people. Each seat has its own 12 months of access, its own viewing sessions and its own knowledge check. 7-day refund policy: if the course is not what you expected, email greg@thirdpartythreathunting.com within 7 days of purchase, even if you have watched it. A refund ends your access. A full refund ends access for every seat in the pack.

FAQ

Questions about the course

How long does it take?
The video runs about 17 minutes in ten short chapters. Plan on more if you pause to work through the toolkit files on your own vendors.
How do I get access after I buy?
We email you a personal link within a few minutes. Open it on any device. If it does not arrive, check your spam folder, then use “Get a new link” on this page.
How long do I have access?
12 months from the day you buy.
Do I get a certificate?
Yes, a certificate of completion. Score at least 8 of 10 on the knowledge check, email your answers to us, and we grade them and send the certificate. Third Party Threat Hunting (TPTH) is not a NASBA Registered Sponsor; this course does not award CPE.
What if it is not right for me?
Email us within 7 days of buying and we will refund you, even if you have watched it. A refund ends your access.
Can I share it with my team?
Your link is for you. For a team, buy a team pack: each person gets a personal link, and each viewing session is set to expire after two hours.

Want help applying this to your own SaaS vendors?

Book a 30-min call