Continuous Third-Party Risk Monitoring with Girish Redekar

WEBVTT
00:00:00.479 --> 00:00:03.759
Hello and welcome to another edition of Third Party Threat Nerds Podcast.
00:00:04.000 --> 00:00:06.959
I have with me a guest today, Giddish Redekar.
00:00:07.040 --> 00:00:08.320
He's the co-founder of Sprinto.
00:00:08.640 --> 00:00:14.000
And I will let, as I usually do, let the guests introduce themselves a little bit more and tell a little more about themselves.
00:00:14.640 --> 00:00:15.279
Thanks, Greg.
00:00:15.439 --> 00:00:16.960
I'm really excited to be here.
00:00:17.039 --> 00:00:18.000
Thanks for having me.
00:00:18.480 --> 00:00:21.600
To introduce myself, I'm a programmer and a 2X founder.
00:00:21.920 --> 00:00:30.079
Before Sprinto, I did another startup that scaled to more than 2,000 customers as an engineer founder, and I had to set up and run our own compliance program.
00:00:30.320 --> 00:00:32.560
That taught me something simple.
00:00:32.640 --> 00:00:35.439
That is, the hard part isn't reading a framework.
00:00:35.600 --> 00:00:39.600
It's about the hard part is actually about keeping hundreds of small promises.
00:00:40.159 --> 00:00:44.320
And you have to keep these promises true while your people, systems, and vendors keep on changing.
00:00:44.560 --> 00:01:01.840
So we built Sprinto to turn that recurring work into software and continuous evidence, clear ownership, and fast reaction so that no security or privacy or risk team spend uh have to spend time chasing screenshots and actually do work in terms of reducing risk.
00:01:03.280 --> 00:01:06.000
That's what everybody's role in this as risk managers.
00:01:06.079 --> 00:01:10.959
That's our role is it's not to move paper around, it's actually to find risk and then reduce it, right?
00:01:11.439 --> 00:01:13.920
And sometimes we feel like we're just moving papers around on a deck.
00:01:14.000 --> 00:01:14.799
So that's great.
00:01:14.879 --> 00:01:15.439
Thanks for that.
00:01:15.680 --> 00:01:18.719
All right, we're gonna get into our five quick questions to get to know the guests better.
00:01:19.040 --> 00:01:21.680
Um what is one compliant question number one?
00:01:21.840 --> 00:01:27.040
What is one compliance framework myth that tech founders still fall for in 2026?
00:01:27.920 --> 00:01:31.680
I'm I'm surprised this question is actually focused specifically on tech founders.
00:01:31.760 --> 00:01:33.120
I'm I'm squarely in that.
00:01:33.359 --> 00:01:39.519
But I feel like uh the the there's still this myth that the certification is a finish line.
00:01:39.680 --> 00:01:45.680
Um and since we are talking with tech founders, I'd like to think about this as the framework is like a test suite.
00:01:45.840 --> 00:01:47.200
It's not your product itself.
00:01:47.280 --> 00:01:54.560
Um it gives you a useful common baseline, uh, but it cannot model every way that your specific business can fail.
00:01:54.719 --> 00:02:05.040
Um so use that as a floor uh and design your uh you know design your system beyond your uh around your actual data uh and actual flows and access paths and dependence.
00:02:05.280 --> 00:02:13.520
And there's a 2026 version of this, which is sorry, which is uh AI didn't make compliance cheap.
00:02:13.599 --> 00:02:17.599
I feel that AI just made the paperwork cheap uh since you talked about paperwork.
00:02:17.680 --> 00:02:18.879
And those are not the same things.
00:02:19.120 --> 00:02:19.599
Yeah, yeah, yeah.
00:02:20.159 --> 00:02:21.280
I think I under that one.
00:02:21.439 --> 00:02:23.039
I'll just feel in at some point.
00:02:23.360 --> 00:02:27.680
Um security questionnaires versus continuous automated evidence.
00:02:27.919 --> 00:02:30.240
Which one gives a truer picture of under risk?
00:02:30.319 --> 00:02:35.680
And I know this is probably an easy one for both of us, Kirish, but I think it's still important to ask the question.
00:02:36.240 --> 00:02:36.400
Right.
00:02:36.560 --> 00:02:39.840
Yeah, uh, you know, the obvious answer is uh continuous evidence.
00:02:39.919 --> 00:02:47.599
Uh it does give a truer picture, but uh you know, I I I don't think uh questionnaires are completely uh useless either.
00:02:47.759 --> 00:02:54.719
Uh you know, it it's sort of like the uh the testimony, it's the context which tells you why the evidence means what it means.
00:02:54.960 --> 00:03:02.960
Um so the evidence can also have blind spots and the and the questionnaires can give you the context, the the whatever is required to thread it together.
00:03:03.280 --> 00:03:05.360
So very good.
00:03:05.520 --> 00:03:09.360
I I uh uh just reminds me uh in my in the in the AI and third-party risk book.
00:03:09.439 --> 00:03:11.759
I'm gonna run so I'll show it to everybody.
00:03:11.919 --> 00:03:16.960
Um I actually have a uh a section that says point-in time assessments will be the death of of uh point.
00:03:17.360 --> 00:03:19.680
Oh, sorry, AI will be the death of point-in time assessments.
00:03:19.759 --> 00:03:20.560
I guess backwards.
00:03:20.719 --> 00:03:26.639
Um and the idea there is somewhat somewhat similar to you, is that it it it doesn't mean that uh questionnaires will ever go away.
00:03:26.719 --> 00:03:31.759
It just means that you don't necessarily have to rely on them anymore for all your evidence gathering and all your your information.
00:03:31.919 --> 00:03:32.560
That's that's good.
00:03:32.719 --> 00:03:32.960
I agree.
00:03:33.360 --> 00:03:34.000
I totally agree.
00:03:34.319 --> 00:03:40.879
What is the biggest mistake companies do when scaling their third-party risk program for 10 vendors to thousands?
00:03:41.439 --> 00:03:41.919
What do you think?
00:03:42.560 --> 00:03:42.800
Wrong.
00:03:43.520 --> 00:03:48.240
I think the biggest mistake is to scale the paperwork instead of scaling the decisioning model.
00:03:48.400 --> 00:03:54.319
Um at 10 vendors, uh smart people can brute force the work.
00:03:54.400 --> 00:03:56.400
Uh, you know, thousands of vendors.
00:03:56.479 --> 00:04:05.120
Uh you need some triage-based systems, which is somehow connected to the business criticality, the data sensitivity, the amount of privilege that the vendor might have.
00:04:05.520 --> 00:04:06.879
A risk-based format, right?
00:04:07.199 --> 00:04:07.439
Yes.
00:04:07.599 --> 00:04:11.120
So you can't basically just take the same model and just scale it to thousand.
00:04:11.360 --> 00:04:18.480
Uh so I I really say that, you know, instead of scaling the paperwork, you should scale the prioritization network, uh, this prioritization system.
00:04:18.639 --> 00:04:20.639
And and that's the that's the bigger thing to do.
00:04:21.040 --> 00:04:21.920
That's a great thing.
00:04:23.040 --> 00:04:37.040
Scale your risk, your risk management uh uh process, not not the just how you're you you said you're Penn, you you and I, I could do I could do 10 vendors and my asleep with my inside to some extent, because I've done thousands of vendors, so you're totally right.
00:04:37.360 --> 00:04:40.720
You look at a brown and paperwork if you're trying to scale it that way.
00:04:41.120 --> 00:04:45.600
Um in one sentence, how do you define continuous compliance?
00:04:48.319 --> 00:04:59.680
I think it's uh it's a state where uh an audit or a questionnaire or a customer due diligence stops being an event uh because there's nothing left to prepare.
00:05:00.079 --> 00:05:00.240
Yeah.
00:05:00.480 --> 00:05:00.959
That's great.
00:05:01.120 --> 00:05:04.560
I I I hadn't thought of that as a definition, but I think that's a great one, actually.
00:05:04.879 --> 00:05:12.879
And then a last uh the more fun question I try to ask at the end of everybody what's your favorite way to recharge when you aren't automating complex TRC workflows?
00:05:13.360 --> 00:05:15.439
Not that exact question, but what do they have fun?
00:05:17.040 --> 00:05:22.399
You know, uh it's going to sound bizarre and uh but oddly, I actually recharge by coding.
00:05:22.480 --> 00:05:27.120
It's it's it's sort of like uh, you know, yeah, that does sound actually I I think it back then does sound not actually good.
00:05:27.600 --> 00:05:35.120
But hey, you know, if that's what if that's your way to kind of disconnect from your your what you do day to day, then that that's that's that's what works for you.
00:05:35.519 --> 00:05:36.079
That's great.
00:05:36.240 --> 00:05:38.160
Um that wasn't gonna be my expectation.
00:05:38.240 --> 00:05:41.519
I was thinking like you were gonna go hiking or like something like that.
00:05:41.680 --> 00:05:43.759
Do you do you go outdoors and that kind of stuff?
00:05:43.839 --> 00:05:44.639
Do you travel a bunch?
00:05:44.959 --> 00:05:49.279
Yeah, my my wife's uh an outdoor sea person, so I do go on a bunch of hikes.
00:05:49.439 --> 00:05:53.040
But yeah, like if I want to just de-stress, uh coding helps as well.
00:05:53.519 --> 00:05:56.319
And so what uh let's uh let's stretch that out a little bit further.
00:05:56.480 --> 00:05:58.240
What do you what like what do you code?
00:05:58.560 --> 00:05:59.839
What do you do typically?
00:06:00.240 --> 00:06:04.639
You know, I I actually uh uh this pick like a small project.
00:06:04.720 --> 00:06:07.199
There's no roadmap, no customer, no deadline.
00:06:07.279 --> 00:06:12.240
Uh and it sort of just gives me back the joy of why I became an engineer in the first place, just to build something.
00:06:12.959 --> 00:06:13.360
That's great.
00:06:13.519 --> 00:06:15.519
Yeah, hey, no, that's I totally get that.
00:06:15.600 --> 00:06:26.720
I I sometimes play it's not it's totally not as at your level, but I'll play video games once a while on my on my desktop because it's how I kind of originally got into computers was playing playing uh video games, that kind of stuff.
00:06:26.800 --> 00:06:28.399
So I totally totally get it.
00:06:28.720 --> 00:06:32.240
Okay, let's get into the the the meat of the subject, and we'll do the hook start.
00:06:32.480 --> 00:06:37.279
The hook start today is um the point in time and the point-in-time compliance illusion.
00:06:37.519 --> 00:06:42.240
A vendor passes a SOC to on it or answers a security questionnaire perfectly on day one.
00:06:42.720 --> 00:06:43.519
Surprise.
00:06:44.000 --> 00:06:50.959
Six months later, a misconfigured API, there's unpad zero day, unauthorized AI tool creates a massive breach of vectors.
00:06:51.279 --> 00:06:57.360
How do security leaders shift from static annual compliance checkboxes to active continuous third-party throughout it?
00:06:57.839 --> 00:07:06.560
What's some of the things that you think they could do to kind of figure out that that SOC2 isn't gonna give them that peace of mind in perpetuity?
00:07:07.600 --> 00:07:08.000
Yeah.
00:07:08.800 --> 00:07:23.759
You know, uh one of the things to understand about point-in-time compliance and and the thing that I uh you know often pointed out to uh CISOs and and other people is that the reason that point-in-time compliance fails isn't that people are lazy or dishonest.
00:07:23.839 --> 00:07:25.279
Uh, you know, most of them are neither.
00:07:25.920 --> 00:07:28.399
It it actually fails for a structural reason.
00:07:28.560 --> 00:07:33.040
Uh and it's the fact that we build this entire system around a scheduled event.
00:07:33.199 --> 00:07:37.920
Um and you know, anything that you schedule, uh, you prepare for, right?
00:07:38.079 --> 00:07:40.079
So the preparation is the contamination.
00:07:40.160 --> 00:07:47.279
The the vendor knows uh when the audit window is going to open, or you know, the internal audit team knows when they're going to do this.
00:07:47.439 --> 00:07:59.120
Um they know uh uh so so what you end up measuring isn't security, or you don't end up measuring the control, you end up measuring their ability to get ready.
00:07:59.279 --> 00:08:07.040
Um, you know, and uh you know, like the the funny anecdote I have about this is like health inspectors figured this out decades ago, right?
00:08:07.279 --> 00:08:09.120
That's the reason why they show up unannounced.
00:08:09.199 --> 00:08:10.480
Uh you know, so that's right.
00:08:10.800 --> 00:08:21.360
But but the way we sort of do this uh this compliance, uh, and the reason it's called illusion and it looks a little performative is because uh you know, is uh you you basically announce this whole thing.
00:08:21.600 --> 00:08:27.279
And um so so then then it's it's just about how ready can you get and how quickly you can get ready.
00:08:27.519 --> 00:08:36.240
So I feel like the the important thing to understand here is that the shift isn't going from annual to quarterly or from quarterly to monthly.
00:08:36.320 --> 00:08:41.360
Uh that's just uh you know, you're just taking the same thing and trying to do it faster.
00:08:41.519 --> 00:08:48.720
Uh the shift is to uh you know uh to signals that nobody really prepares for, but they just automatically come in.
00:08:48.960 --> 00:08:53.200
And uh, you know, they are uh there's things that you can just measure.
00:08:53.360 --> 00:09:02.720
So when I say that uh you know audits or checking things should not be an event, it should just be something like it's uh it's an exhaust of what you already do.
00:09:02.879 --> 00:09:05.600
Um it's a side effect of what you already do.
00:09:05.759 --> 00:09:07.679
That's that's a real system to build.
00:09:08.080 --> 00:09:08.559
That's great.
00:09:08.720 --> 00:09:09.279
Yeah, yeah.
00:09:09.440 --> 00:09:11.360
I I I uh I totally concur.
00:09:11.519 --> 00:09:16.720
I I think some of the issues I have with well, I think what you're trying to differentiate, let me let me take a different tack.
00:09:16.879 --> 00:09:25.120
What you're trying to differentiate is um if you if you do a compliance and you do a soccer once a year, doing it every quarter, every month isn't gonna alleviate.
00:09:25.200 --> 00:09:27.039
That's not continuous monitoring.
00:09:27.120 --> 00:09:32.480
That's just continuous compliance, which is still an event that you prepare for every month.
00:09:32.559 --> 00:09:38.320
So if you do it every month, then you know what's gonna happen is on the 20th of every month, everybody's gonna be scrambling to try to get ready for the 30th.
00:09:38.559 --> 00:09:46.720
And then they'll they'll they'll pause for another 20 days at the beginning of the next month and then start rushing to get everything ready for the audit to get on the compliance check at the end of the month.
00:09:46.879 --> 00:09:55.440
Um the there are the comp the compliance stuff and the and the continuous threat uh management is are two separate activities, is I think is what you're gonna accurate.
00:09:55.679 --> 00:09:56.080
Yeah, right.
00:09:56.559 --> 00:09:57.120
That's great.
00:09:57.200 --> 00:09:57.919
I agree.
00:09:58.159 --> 00:10:08.960
Um question number one moving beyond point in time TPRM to continuous monitoring again, continue to start from the chronological statement, but continue to build on that on that issue.
00:10:09.120 --> 00:10:16.399
Um, as companies rely heavily on SaaS platforms cloud infrastructure, uh almost all EIAs being delivered through the cloud and through SaaS, right?
00:10:16.639 --> 00:10:19.360
Where do traditional manual security questionnaires break down?
00:10:19.519 --> 00:10:22.559
And how do we try and um change that?
00:10:22.720 --> 00:10:25.840
What do what do we do to once they break down, what do we do in difference?
00:10:27.360 --> 00:10:28.559
That's a good question.
00:10:28.799 --> 00:10:34.480
Uh I think um they they fundamentally break down and on on three axes.
00:10:34.639 --> 00:10:39.120
Um so first, uh, you know, manual security questionnaires are slow.
00:10:39.200 --> 00:10:40.720
Uh they could take a ton of time.
00:10:40.799 --> 00:10:46.799
Uh they they you know you send them over, uh somebody looks at them, they take a bunch of time to respond to it, you get it back.
00:10:46.960 --> 00:10:49.600
Um this can this process can easily go over weeks.
00:10:49.759 --> 00:10:54.879
Um the second problem that I see with this is um it's self-reported.
00:10:54.960 --> 00:10:59.840
Uh, you know, it's uh there's no real way of actually knowing what's been said is actually true on the ground or not.
00:11:00.320 --> 00:11:00.799
That's what I heard.
00:11:00.879 --> 00:11:02.559
It's a it's a phone it in answer.
00:11:02.879 --> 00:11:03.519
Yes.
00:11:03.919 --> 00:11:14.960
And uh so uh and uh I'll expand on each of these a bit, but uh you know the third the third bit is basically about like how it's not contextual, it's it's extremely generic.
00:11:15.039 --> 00:11:26.240
Like it doesn't matter whether you ask that question or somebody else asked that question, it doesn't matter how how you're using that particular vendor, uh, you know, the level of privilege it has in your environment, just the same set of answers.
00:11:26.559 --> 00:11:35.600
And I feel like uh you know the combination of these three things is is what makes uh manual security questionnaires as the exclusive tool to break down.
00:11:35.919 --> 00:11:48.480
So um, you know, like speaking of slow, and and I I feel like it's important to understand all three of these together and address all three of these because you could take one of these axes and try and address that, and it doesn't give you the right answer.
00:11:48.639 --> 00:12:08.720
So I'll uh you know, one of the things I I find very funny, uh uh, especially in the world that we are in today, where we are heading towards using every with everything uh or solving everything with AI, uh I find this slightly absurd world where you know uh where there's AI which is filling out a questionnaire, uh, and AI that is actually grading that questionnaire.
00:12:08.960 --> 00:12:12.879
And uh, you know, like when I look at this, this is just automation of paperwork.
00:12:13.120 --> 00:12:15.840
Uh think about it that way, but it is not right.
00:12:16.879 --> 00:12:17.200
Right.
00:12:17.279 --> 00:12:20.480
So exactly.
00:12:20.639 --> 00:12:24.240
So you know, if if if you just address the slow part of it, this is what you get.
00:12:24.399 --> 00:12:26.399
Basically, you're just automating paperwork.
00:12:26.480 --> 00:12:30.960
You're not actually automating uh or you're not actually creating more assurance, right?
00:12:31.120 --> 00:12:33.840
So uh I I think uh so that's one part.
00:12:34.000 --> 00:12:56.720
Like you need to make it faster, uh, but you have to also take make sure the other two things are also taken care of, which is um you know, the fact that it is self-reported, which means that uh questionnaires are still useful for things that you cannot observe directly, like uh, you know, the intended data use or the incident history or resilience or you know how an AI model is being used or governance and so on and so forth.
00:12:56.879 --> 00:13:04.559
Uh, they can definitely become a lot shorter and more targeted or you know, triggered by some material change or risk or so and so things.
00:13:04.720 --> 00:13:17.840
But um, you know, uh the evidence should carry the burden uh so that it's it's not just about what you uh you know what whether you just give like a um a self-reported answer to something, but what evidence do you have to prove to that?
00:13:17.919 --> 00:13:20.720
So that's that's an important bit of what needs to happen.
00:13:20.960 --> 00:13:23.039
And most questionnaires don't necessarily support that.
00:13:23.200 --> 00:13:25.279
So I think that's the point that needs to happen.
00:13:25.519 --> 00:13:43.679
And the third and the most important thing that I um that I say is uh especially as we move to more and more um cloud-based systems, uh we we tend to forget that uh you know, we we treat every vendor the press the same way, regardless of how they're being used inside of your environment.
00:13:43.840 --> 00:13:48.480
So we need to have a better map of what privileges this vendor has, what accesses does this vendor have.
00:13:48.559 --> 00:13:53.360
Like Sprinto in general has a large number of integrations as a software that we ourselves build.
00:13:53.519 --> 00:13:56.159
But we know for a fact that different companies use us differently.
00:13:56.320 --> 00:14:00.799
And there are places where we have a lot more access to their systems as compared to the others.
00:14:00.960 --> 00:14:14.720
But if their TPRM process does not reflect the same thing, um, then they would be asking us generic questions and getting generic answers other than something, uh, you know, our risk exposure to some of these uh customers could be higher as compared to somebody else.
00:14:14.799 --> 00:14:26.960
So speaking as a vendor, uh I can clearly see that uh, you know, we we ought to be um scrutinized differently depending on who's looking at us and at what point of time, because this itself changes as well.
00:14:27.120 --> 00:14:29.200
So I think these are the three most important things to be solved.
00:14:29.279 --> 00:14:41.120
Like, and regardless of whether you solve them by AI or or whatever whatever you do, uh it's important to look at the speed, it's important to look at the context, and it's important to make sure that you're looking at real evidence rather than just self-proclaimed answers.
00:14:41.600 --> 00:14:42.159
Totally agree.
00:14:42.320 --> 00:14:57.039
I the only thing I would add would be on the context, just to just to highlight it and not not uh to to add some uh color to it for folks, is for example, you'll get a you'll get a questionnaire back and it says they they do AS256 or AS 128, let's say.
00:14:57.360 --> 00:15:00.159
But that's for the whole, that's the corporate standard.
00:15:00.240 --> 00:15:02.720
But for the product of delivering is AS256.
00:15:03.039 --> 00:15:06.000
So again, it's contextual, and I've seen this happen a number of times.
00:15:06.080 --> 00:15:09.440
So so just I think that's uh you're gonna share some great points.
00:15:10.000 --> 00:15:11.919
Um let me ask you a follow-up question on that one.
00:15:12.080 --> 00:15:16.799
What are the key indicators that a vendor security posture is degrading uh between formal audit cycles?
00:15:16.960 --> 00:15:23.679
What are some key indicators you think that uh this back on the compliance side necessarily maybe, although it can be in continuous monitoring space too?
00:15:23.840 --> 00:15:30.080
What are some of the things that you look for that says, hey, I think this vendor might be having some issues or I need to I need to lean into them a little bit more?
00:15:31.200 --> 00:15:31.759
Right.
00:15:32.159 --> 00:15:36.639
Um I think I'd look look out for two or three categories of drift.
00:15:36.879 --> 00:15:42.559
Uh first is uh you know, some sort of uh control drift.
00:15:42.639 --> 00:16:04.240
Uh for example, if if there's a way to know that uh you know some MFA coverage has f has failed, or uh or you know, it's it's fallen beyond beneath a certain level, or the number of privileged accounts have grown, or you know, some endpoint or backup coverage is breaking somewhere, or evidence starts failing, or some some serious finding that remains unresolved, or something like that.
00:16:04.320 --> 00:16:09.440
So that's that's fundamentally like one category or one bucket of things, which is some drift in controls.
00:16:09.679 --> 00:16:15.600
Um the second thing that I'd look for is uh you know, it in any manner if there's exposure drift.
00:16:15.679 --> 00:16:17.600
Uh there's a lot of threat intelligence out there.
00:16:17.679 --> 00:16:31.440
So it could be in the form of leaked credentials, uh, you know, new internet-facing assets, uh, any active exploitation or any material vulnerabilities that are not yet solved, or reported security incident.
00:16:31.840 --> 00:16:32.399
I didn't mean to interrupt.
00:16:32.559 --> 00:16:36.480
I was gonna you're you're I was trying to help some contextually for some of the folks listening.
00:16:36.639 --> 00:16:42.559
So you're gonna get the the first, so the second one, you'll get that mostly from your threat intelligence and and other folks, right?
00:16:43.120 --> 00:16:50.080
The first one you can get through some of the questionnaires and also from some of the tool sets and stuff like that, too.
00:16:50.159 --> 00:16:52.720
You can see control drift, uh, you can see things like that.
00:16:52.879 --> 00:16:55.120
Um sorry, uh the third one you can do.
00:16:55.200 --> 00:16:56.399
No, that's that's great.
00:16:56.480 --> 00:16:57.519
Actually, that's useful to know.
00:16:57.600 --> 00:16:57.840
Yeah.
00:16:57.919 --> 00:17:01.600
Like the first one is is how how how you basically build into your due diligence process.
00:17:01.679 --> 00:17:07.359
The second one is basically you you sort of do out-of-band uh threat intelligence and and sort of get that information.
00:17:07.599 --> 00:17:24.559
And the third one is uh, and I feel like not enough, uh like I don't see enough of uh enough of my customers to do this as I'd like more and more of them to do this, which is uh you know, just drift in relationship in the sense that you have to understand that the way you're using the vendor, it could be changing.
00:17:24.799 --> 00:17:28.960
And this is something that you can do at very little cost.
00:17:29.039 --> 00:17:31.039
Uh you know, this this is in completely in your control.
00:17:31.119 --> 00:17:32.480
You're not dependent on the vendor.
00:17:32.640 --> 00:17:36.799
You you you can look at uh you know what's really happening with with the way you're using the vendor.
00:17:36.880 --> 00:17:38.799
Are you are you giving them more privileges?
00:17:38.880 --> 00:17:42.319
Uh are they using more agents than you than you did they did before?
00:17:42.400 --> 00:17:46.640
Are are they actually having more uh you know more access to your systems and stuff like that?
00:17:46.799 --> 00:17:51.200
Are you using them for more use cases than you did when you when you signed the contract with them and so on and so forth?
00:17:51.279 --> 00:17:58.160
So these are the sort of the three buckets of things that I would actually look at in order to know if my exposure to this vendor is improved uh is is enlarging.
00:17:58.559 --> 00:17:59.119
I would agree.
00:17:59.279 --> 00:18:05.759
I I uh I'll add uh just a slight thing to that on the audit side or sort of actually sort of the relationship growing.
00:18:07.279 --> 00:18:18.079
What I meant was what I would uh I was jumping in was oftentimes when I was disengaging with a vendor, I would I would force my team to audit how the how they were being used internally.
00:18:18.319 --> 00:18:26.880
Because usually you keep vendors for a long time, or the relationship grows organically, and surprise surprise, they don't update the system of record with those changes.
00:18:27.119 --> 00:18:35.519
And so oftentimes if you go to disengage and you don't really have a good system of record, again to your point earlier, Gears, you're gonna disengage incorrectly.
00:18:35.680 --> 00:18:39.359
You're gonna miss some data that you should have had a certificate of instruction for, all that kind of stuff.
00:18:39.519 --> 00:18:51.279
So so to build on what Gears says, if you're gonna disengage, do the third one for sure, because that one I've seen hit people a couple of times where they've missed something because they didn't understand that, oh, we bought it originally for marketing, but guess what?
00:18:51.359 --> 00:18:53.440
The engineers are now using that tool too.
00:18:53.759 --> 00:18:54.079
Right.
00:18:54.240 --> 00:18:56.799
So, anyways, uh I wanted to build off of that.
00:18:57.119 --> 00:19:05.279
Um big question number two is kind of a fun one, a little bit more the future of third-party risk management, AI integration, and nth-party visibility.
00:19:05.359 --> 00:19:09.200
I know it's a bit of a bit of a lot there to cover, but so we'll cover in a couple of questions.
00:19:09.359 --> 00:19:20.240
One is the first one is as vendors rapidly integrate AI agents and automated tools into their stacks, how can compliance risk platforms help track and govern these emerging third-party risk factors?
00:19:21.599 --> 00:19:24.240
Um You know, uh, this is so interesting.
00:19:24.400 --> 00:19:31.920
Uh I think one of the things that we all uh ought to recognize is that you're not gonna get a chance to assess your vendor's AI.
00:19:32.079 --> 00:19:37.759
It will just arrive in a product update on a Tuesday morning inside a vendor that you approved two years ago.
00:19:37.920 --> 00:19:42.079
There was no new contract, there was no new assessment, procurement never saw it.
00:19:42.240 --> 00:19:44.640
Um that's the whole problem in one sentence.
00:19:44.799 --> 00:19:45.440
Yes.
00:19:47.519 --> 00:19:47.920
Exactly.
00:19:48.319 --> 00:19:48.559
Right?
00:19:49.039 --> 00:20:04.319
So I I think uh the the thing to realize over here is that uh you know, we've we've built like this, uh we spent a couple of decades building like this system uh around uh you know identity governance for humans, uh for humans, basically.
00:20:04.480 --> 00:20:10.400
We we we understand uh you know the life cycle of joining and moving and leaving, uh, and it works.
00:20:10.480 --> 00:20:14.559
Uh but we didn't ever build this same kind of a process for an agent.
00:20:14.720 --> 00:20:21.200
Um, you know, uh so there's no lever process for an agent, there's no onboarding or uh uh you know process for an agent.
00:20:21.359 --> 00:20:28.960
So an agent uh is kind of like a vendor employee that never sleeps, that never forgets a credential, that never gets offboarded.
00:20:29.039 --> 00:20:30.880
Uh that should give us goosebumps.
00:20:31.039 --> 00:20:34.960
And you know, uh nobody more than more than goosebumps, by the way, get us for me.
00:20:35.200 --> 00:20:41.359
Because having read the privilege access management book and and understanding that we're making thousands of agents.
00:20:42.000 --> 00:20:44.720
How are we how are we managing those credentials?
00:20:44.880 --> 00:20:47.039
And those are mostly privileged credentials, by the way.
00:20:47.119 --> 00:20:49.200
They're not generally normal user credentials.
00:20:49.359 --> 00:20:51.279
That that just scares the Jeeves out of me.
00:20:51.519 --> 00:20:54.400
That's where that's where the tax factors are going to come from, I think.
00:20:54.960 --> 00:20:55.200
Right.
00:20:55.279 --> 00:21:01.759
And and I feel like uh that that should wake us up to the fact that um you know AI changes the unit of governance.
00:21:01.839 --> 00:21:11.440
Like we're not no longer assessing just a vendor, uh, but you're assessing uh like a capability that can see data, make decisions, and sometimes even take actions.
00:21:11.680 --> 00:21:21.839
And I think of uh, you know, uh like I think my my mental model of thinking of an AI AI agent is like a software with a badge and a set of keys.
00:21:22.079 --> 00:21:28.079
So for every material agent, you should basically be asking four questions, like which is what can it see?
00:21:28.160 --> 00:21:33.039
Uh what can it do, who can stop it, and can we reconstruct what it actually did?
00:21:33.200 --> 00:21:35.519
Uh you know, audit audit logs of those things.
00:21:35.599 --> 00:21:44.079
And and you know that translates downstream to an inventory of use cases, the model, the subprocessor lineage, and you could do a bunch of things downstream from there.
00:21:44.160 --> 00:21:46.319
Um, and you could even have a kill switch.
00:21:46.559 --> 00:21:59.759
But uh the job of a risk platform is to keep that con that inventory current uh to make sure that you collect the supporting evidence and you map it to the right controls and you you know you have a way of knowing material changes and you can route those.
00:22:00.240 --> 00:22:02.160
material changes to a countable vendor.
00:22:02.400 --> 00:22:10.960
So you know if uh since you've you've had some access and privileged access background, um you know more important than asking.
00:22:11.200 --> 00:22:11.680
Sorry, go on.
00:22:12.000 --> 00:22:14.000
No, no, please, I won't you finish your part.
00:22:14.880 --> 00:22:24.880
And you know, uh I I think the the privileged access, the PAM uh lens tells us that more important than asking which model it is is uh is to ask what keys did we hand it.
00:22:25.440 --> 00:22:32.240
You know the model can change downstream but like if if you decide what keys did you hand it then you you at least know the the blast radius of what it's going to do.
00:22:32.559 --> 00:22:32.799
That's right.
00:22:32.960 --> 00:22:38.880
Yeah and and it's and it's a and and I but the word that keeps the the the phrase that keeps popping mind is least privilege in my mind.
00:22:39.039 --> 00:22:46.000
That that that screams that that issue because um and I heard somebody in their name say well we're just treating like service accounts.
00:22:46.240 --> 00:22:53.599
No yes there's some similarity it's a machine account but agents do a lot more than a service account.
00:22:53.759 --> 00:22:56.559
A service account is a completely different animal.
00:22:56.720 --> 00:23:09.680
And by the way there's not thousands and thousands of a a normal user can create an agent a normal user cannot create a service account that that's generally assigned for service administrators for for a reason.
00:23:10.319 --> 00:23:31.200
And so you you yeah I think we're just both trying to highlight this point that it is an issue that is I see a lot of posts on LinkedIn a lot of folks like my and in the space like Jerry Chapman and John Kinderbog and all those folks have talked about this in the zero trust space because um the permisse access management in the AI space is just not is it's not exist at the level that we should we should have it.
00:23:31.359 --> 00:23:40.880
So for everybody else that isn't scared enough please be scared now let's do the let's do the nth party question.
00:23:41.599 --> 00:24:08.960
How can security leaders maintain visibility into nth party fourth party supply chain dependencies without creating massive operational friction in particular because most of the folks that are uh you're buying a SaaS software from that has now AI capabilities in it, most of them are not building their own LLM models they are purchasing tokens from one of the big four or five or six and and so it is so the AI stuff that you're getting is in the party to some extent.
00:24:09.119 --> 00:24:11.200
So that's that's even becomes even more complex.
00:24:11.279 --> 00:24:14.559
So with that setup Kitish let me let you answer the question.
00:24:16.960 --> 00:24:51.759
You know um this is something that I've tried to solve uh within my company as well and I feel like um uh the both extremes are wrong in the sense uh you know uh one extreme is obviously wrong which says that don't don't don't worry about it but I feel that the other extreme is also equally wrong where you know we might actually make uh um you know perfect uh the enemy of good what I mean by that is um the honest answer is that full nth party mark mapping is probably a fantasy and chasing it uh is how good programs die.
00:24:51.839 --> 00:24:55.920
Uh you know you'll you'll spend years building a family tree that's wrong the day you finish it.
00:24:56.640 --> 00:25:00.160
Yeah totally keep going I want to hear more on what you're gonna say.
00:25:00.559 --> 00:25:06.720
So uh you know like I I again think of it uh as less of a mapping problem than more of a concentration problem.
00:25:06.880 --> 00:25:34.319
So you know uh so instead of trying to draw like the orc chart of your supply chain uh just try to find the load bearing walls uh you know so uh you're for for systematic uh so if if if you basically systematically go about it and find critical vendors and trace three things right yes just three things one level deep uh where sensitive data goes and where privileged access flows and you know what downstream failure can stop a critical business service or something like that.
00:25:34.960 --> 00:25:37.759
Then look for a concentration and single points of failure.
00:25:38.319 --> 00:25:44.960
So you can support that with some material subprocessor change notifications or contractual flows downstream, et cetera.
00:25:45.119 --> 00:26:07.200
But I feel like the the the the mental image I have the metaphor that I have is you know instead of trying to map every road in the country just map the bridges uh that your business can't afford to lose so if if you're if you're like a military general like these are the important choke points that you you you really need to be worried about rather than getting just lost in the woods uh about this whole thing.
00:26:07.599 --> 00:26:23.200
Yeah I I I totally the the the exponent the 10th party becomes an exponential issue right if you have 12 party 12 third let's say you only have 12 third parties and they each have 12 important third parties of their own you're already at 144 vendors and you only started with 12.
00:26:23.440 --> 00:26:25.359
And most people have more than 12 vendors.
00:26:25.519 --> 00:26:27.759
So immediately you can see the exponential issue.
00:26:28.400 --> 00:26:51.839
The recommendation I like came from uh for a while from the the three letter agencies the FRB OCC and well four letter FTIC um uh for a while they made us required when I was working on space you had to go out chase the nth parties now they say and I this this has always been my suggestion is and I think you're building off it is get to see if your third party has a good third party responsibility program.
00:26:52.559 --> 00:27:03.680
If they manage their third parties correctly then your fourth parties are they're they're they're good as both right that's your uncle as they say right with your pito as they say so you're good.
00:27:03.839 --> 00:27:37.599
So I I totally agree it if you don't worry about it at all you're you're with on three graveyard if you try and chase everything you you're never gonna you're right the the you're gonna your program's gonna die because you're gonna be chasing uh stuff that just isn't a value to some extent too um assess your vendor's third party risk program and and and listen to what Chris said I think that was great that's a good one yeah um let me ask the the last one um on this in this big question too which is how do you advise risk leaders to present automated compliance and vendor risk metrics to executive boards to demonstrate real ROI?
00:27:37.680 --> 00:27:40.000
Because I think that's something that we sometimes miss with this space.
00:27:40.160 --> 00:27:41.759
We forget to show our work.
00:27:42.240 --> 00:27:51.440
Yeah because we're we're we're we're almost like insurance we don't we we're only used if something bad goes we're only notice that something bad goes wrong right to some extent.
00:27:51.839 --> 00:28:48.319
How do we demonstrate that we're providing value as practitioners in this space um yeah I think the uh so so I I've funnily being on the both on the uh creating and the receiving end of this whole uh this whole equation so I I've seen uh our own reports and I have to sort of uh look at it from a board's perspective and I feel like the standard board that's right yeah you're in you're in the you're in both positions now aren't you yeah and and you know like uh what I've seen is like the the standard board slide uh reports activity right uh it talks about assessments that are completed questionnaires that were returned the percentage of vendors that we reviewed um and it it sometimes sounds like a fired department sort of reporting on how many hydrants it expect in it inspected uh you know what the what the board really wants to know is uh how fast can you put out a fire uh you know and and how many buildings did actually burn and if if if if that happened, right?
00:28:48.480 --> 00:29:54.880
So I think um uh the the uh the the one question on uh you know what should be the North Star that the team sort of works on is uh I I I would basically ask the team to to to give two numbers and defend them all here uh before I get to the ROI bit and the two numbers I'd say is basically the time to know um you know like uh from a vendor incident that actually started for us to being aware of it how long does it typically take and and you know that that should be a the yes to for us to basically be able to uh to to track and and the other one is basically just time to revoke or time to respond like uh you know from a decision to uh where you think that you need to do something with the vendor maybe you want to pull a skill switch on them or you don't need to cut a vendor um and you'd make that decision from that decision point to uh to what it how long it takes to uh you know the vendor's access actually being dead um and both of these are relatively measurable and they both can be drilled but but that actually uh you know sort of tells you how good your program really is.
00:29:55.440 --> 00:30:05.920
It does but and and and you know just to sort of distill it down to uh to your ROI um you know that there are just two uh sort of things that I typically look at and two currencies.
00:30:06.079 --> 00:30:08.079
One is the amount of risk that is reduced.
00:30:08.240 --> 00:30:12.880
And I I know there are two schools of thoughts on whether you want to report that in dollars or in some other metric.
00:30:13.200 --> 00:30:15.200
I personally have no opinion on that.
00:30:15.599 --> 00:30:32.880
But the second metric that I would also look at in terms of ROI is uh you know how much time did you return um back from your TPRN program, which would otherwise be like an extremely onerous activity and and how how uh you know the just the amount of time it takes to actually do those things for regulatory reason or otherwise.
00:30:33.039 --> 00:30:42.559
So basically if if you could um you know if if you could basically put these two metrics uh then the ROI should be relatively simpler to understand for anybody who looked at it.
00:30:42.960 --> 00:30:43.599
Yeah I agree.
00:30:44.480 --> 00:31:09.279
Thanks for that Garish I I hadn't put it as a perspective I I I do agree that a lot of folks tend to just present here's how many fires we put out or here's here's the number of fire items we we we counted as you you I think that's a great analogy as opposed to saying how fit we are as a fire department and here's the fires we actually here's how long it took us to get to the fire and here's how long it took us to put the fire out um and then to get back to the station and put all the equipment back together.
00:31:09.599 --> 00:31:09.839
Right.
00:31:10.640 --> 00:31:20.079
We all as as practitioners can understand where that where that analogy leads leads for us in terms of a breach or an incident or or an outage whatever it is that you want to do.
00:31:20.240 --> 00:31:23.440
I think um those are great um methods to present to a board.
00:31:25.839 --> 00:31:35.680
One of the reasons why I push this issue I think is because most people organizations are not well funded or well staffed generally you know they're usually teams of one or two.
00:31:35.839 --> 00:31:40.240
You see bigger teams in some organizations and so they also have to fight for resources.
00:31:40.319 --> 00:31:49.200
And so I I really want to advocate the listeners and folks in the space to listen to what are said and and and others in the space to make sure that you're you're advertising your work.
00:31:49.359 --> 00:31:55.680
Because if you think that the senior leaders know what you're doing they they just don't they have it's not that they don't care it's just that they're busy.
00:31:55.839 --> 00:31:56.000
Right?
00:31:56.079 --> 00:32:01.359
And they have thousands of other employees potentially or hundreds of so you do have to show your work.
00:32:01.920 --> 00:32:04.400
And they they won't they won't roll their eyes, I promise you.
00:32:04.559 --> 00:32:06.079
They they want to see what you're doing.
00:32:06.799 --> 00:32:07.119
Okay.
00:32:07.440 --> 00:32:08.880
We'll wrap up that last question.
00:32:09.279 --> 00:32:23.359
The after-action report we always try and leave listeners who braved the whole session um with one immediate tactical step a TPRM or security leader can take this week to automate vendor risk monitoring and reduce manual overhead finish is your your question.
00:32:24.720 --> 00:32:29.680
Wow um I think I'll I'll I'll go back to something I I passingly mentioned before.
00:32:30.319 --> 00:33:02.240
If I had to do something in in a week uh no budget no procurement uh nothing else involved uh what I'd do is I just pick my three most important SaaS vendors uh three most important SaaS platforms maybe your uh you know your CRM your your code host uh or uh your identity provider or whatever is like the three most important systems and I just look at every single third party uh that has uh an API token or credential or an OAuth uh you know connected to that.
00:33:02.799 --> 00:33:02.960
Right.
00:33:03.119 --> 00:33:08.799
So I I'd and for each of those third parties uh what I'd simply do is write down three things.
00:33:09.279 --> 00:33:12.079
One, uh you know, what scope does it have?
00:33:12.799 --> 00:33:23.039
You know who owns it and uh when was the if if it's like an API based thing though so when was the token last rotated when was the credential last rotated and so on and so forth.
00:33:23.119 --> 00:33:23.920
So it's it's a surprise.
00:33:27.599 --> 00:33:30.319
Yeah be careful what you ask for.
00:33:31.200 --> 00:33:40.079
Two years exactly you know the the funny thing is like this is something that you could do in a in in an afternoon to be honest.
00:33:40.160 --> 00:33:43.920
And and you know the but with the fact is that most teams cannot fill that table.
00:33:44.000 --> 00:33:52.799
And and and and the the reason I ask for the owner is that you know it's it's very easy to sort of come up with a process to say that hey I'm gonna revoke everything that has no owner.
00:33:53.599 --> 00:34:04.720
You either have to basically say that hey I own this particular connection and you'll you'll randomly find integrations from vendors that you stopped using or paying two years ago.
00:34:05.920 --> 00:34:08.559
That's actually lying somewhere in there.
00:34:09.119 --> 00:34:14.480
You know and and you start seeing like a long tail of things which are just incidents waiting to happen.
00:34:14.800 --> 00:34:16.320
But that that's the simplest thing I could do.
00:34:16.400 --> 00:34:19.519
Like it it doesn't take you know it's it's all within my control.
00:34:19.920 --> 00:34:27.360
Yeah exactly and and and for the listeners and for you going to um I always ask this one question at the end and I always get a different answer.
00:34:27.519 --> 00:34:29.679
And I don't think that's all the answers are great.
00:34:29.760 --> 00:34:31.440
I mean there's none of the answers are wrong.
00:34:31.599 --> 00:34:32.159
They're they're right.
00:34:32.320 --> 00:34:41.760
What I want to emphasize for the listener is if you tune in every week you're gonna get something practical to do this every week to say oh I've been oh this week I'm gonna go and look at my three top SaaS founders.
00:34:41.920 --> 00:34:50.239
I forget what the last guest said but he or she has something different and on that Tuesday you could pick on Wednesday or Tuesday you could pick that up and do that.
00:34:50.320 --> 00:34:56.880
I think it's a great way for folks I like the idea of picking up the top three SAS vendors because most of our stuff is SaaS anyways.
00:34:57.039 --> 00:35:01.840
So you're probably going to find some important stuff you need to pay attention to that's probably gotten missed.
00:35:02.000 --> 00:35:22.480
So I all love that and I'm glad you asked that question though uh sorry I was just saying that I'm glad that you asked that question because we can all sit here and and talk about massive programs that take such a large amount of time to build and and they take consensus and and you know coordination across multiple people but having something actionable that I can do uh in a short period of time is is really valuable as well.
00:35:22.960 --> 00:35:31.360
I think so too and I'd like I'd like to give readers some listeners something to walk away with if they could say okay I'm gonna try that see how that works for me.
00:35:31.679 --> 00:35:52.320
All right we're uh we're at the end of the end of the end of this podcast into this session I want to thank everybody for tuning in and really uh thank this has been a great conversation we went longer than I expected but that's been that's been because we I think we've been had such a great uh conversation about things tune in for the next uh podcast uh please do subscribe and uh check out uh goddish's uh uh website uh sprito.
00:35:52.639 --> 00:36:02.960
Is it spritto.co.com sorry sprito.com and we will uh uh see you soon thanks a lot for being a guest Giddish thanks for having me Greg