Third Party

Concentration risk and cascading risk are the third-party exposures most vendor programs still cannot see. When a company you never chose, sitting three layers deep in someone else's supply chain, goes down, your operations go with it.

This conversation breaks down the difference between the two, why third-party ecosystems behave like a mesh rather than an org chart, and why the blast radius of a single breach now reaches several organizations instead of one. It covers what regulators are already doing about shared critical vendors, why resilience plans that ignore upstream providers do not hold up, and how to raise any of this with a board or a CEO without burying them in complexity. It ends with a simple exercise you can run this week: ask your vendors to name the few suppliers they could not deliver your product or service without.

In this episode:

• Cascading risk and concentration risk, defined and separated

• Why fourth and fifth party maps are a mesh, not a tree

• Blast radius findings from the latest third-party breach research

• Shared upstream providers and what resilience theater looks like

• Communicating vendor dependency risk to executives and boards

• Why the biggest vendors are now the concentration risk

Black Kite makes cascading and concentration risk visible across your entire ecosystem, not just your direct vendors. See where your real exposure lives at blackkite.com

New episodes every other week. Subscribe so you never miss one.

Some of the people building AI are warning it could end humanity. Others say it's all hype. Meanwhile, AI agents have already escaped a testing sandbox and attacked another company's infrastructure. So is AI the end of the world, or just the next Y2K?

In this unscripted, off-cycle episode, Jeffrey Wheatman and Bob Maley sit down with Black Kite co-founder and CTO Candan Bolukbas and Rock Lambros, Director of AI Standards and Governance at Zenity and a core team member of the OWASP GenAI Security Project, to cut through the headlines. They debate whether the latest warnings signal real danger or another cycle of panic. They also get into why the bigger threat may be the people using AI rather than the technology itself, and what defenders need to do now that attackers have already adapted. Then they bring it back to the question security leaders are facing: how do you manage AI risk across an ecosystem of partners and suppliers you can't fully control?

In this episode, you will learn:

• Why today's AI doom headlines echo past panics like Three Mile Island and Y2K, and why banning AI could backfire

• Why the bigger AI risk may be the humans using it rather than the technology itself

• How AI has cut the time attackers need to turn a new patch into a working exploit from days to hours

• What the AI sandbox breakout that hit Hugging Face teaches defenders about using AI to fight AI

• Why free AI tools and API tokens can quietly expose your passwords, secrets, and source code

• How to treat AI as a third-party and supply chain risk, starting with where your data goes

If you're trying to separate AI hype from real risk in your security program, this conversation is for you.

Your vendor says they have MFA everywhere. They say their data is encrypted. They say the right things on every questionnaire you send. So why is there almost always a gap between what a vendor tells you and what is actually happening inside their environment?

In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik dig into the uncomfortable space between attestation and reality. Jeffrey wants to call it lying. Bob and Ferhat push back hard, arguing most of it is bad data, missing inventory, and answers that are aspirational rather than dishonest. From there they get into the harder problem: how do you verify anything when you cannot send an auditor into Google or Amazon, and what happens to verification itself when the answers you receive were generated by AI in the first place?

In this episode, you will learn:

• Why yes or no questionnaire answers measure compliance, not the efficiency of a control

• The three types of verification, from signals to behavior analysis to vendor testimony

• Why every signal needs a confidence level before you decide which battles to fight

• How to get real value from SOC 2 reports and where third-party audits fall short

• Why most programs are built to discover and ask questions, but never to follow up

• What happens to trust but verify when AI is producing the answers on both sides

If your program collects a lot of vendor answers and verifies almost none of them, this conversation is worth your time.

AI-powered vulnerability scanners can now find tens of thousands of flaws in a matter of weeks. That sounds like a breakthrough until you look at the other number: the patch rate is under one percent. So are these frontier models a genuine game changer, or just the latest round of marketing built on fear, uncertainty, and doubt?

In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik pressure-test the hype around tools like Project Glasswing and the new class of AI scanners. They dig into why discovery has raced ahead of remediation, why throwing AI at the end of the process may be solving the wrong problem, and where these tools actually earn their keep today versus where the marketing gets ahead of reality. Along the way they get into prioritization, explainability, and the uncomfortable question of what happens when you can find far more than you could ever fix.

In this episode, you will learn:

• Why the real story is the gap between vulnerabilities discovered and vulnerabilities patched
• Where AI genuinely helps today, from discovery and attack chaining to triage
• Why shifting these tools earlier in the development cycle may matter more than faster remediation
• How to cut through vendor AI claims using explainability as your filter
• Why prioritization, not patching everything, is the only way out of the deluge
• What security leaders should expect from these tools over the next year

If you have ever wondered whether the AI vulnerability hype is signal or noise, this conversation gives you a framework to tell the difference.

Your third-party risk program is probably built on questionnaires, and you already know they don't really work. So the real question is not how to make them better. It's whether you should tear the whole thing down and start over.In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik get honest about what it takes to rebuild a TPRM program from the ground up. They dig into why the hardest part isn't the tooling, it's breaking the mental model you've been committed to for years. Drawing on the idea of creation and destruction, they walk through what they would keep, what they would throw out, and why using AI to speed up a broken process just gets you to the wrong answer faster.

In this episode, you will learn:

• Why incremental improvement is the trap, and when a program needs a full rebuild instead of a refresh
• What the questionnaire industry is really protecting, and what could actually disrupt it
• The three things Bob and Ferhat would build first if they started from scratch
• Whether you can outsource a TPRM program, and where that logic breaks down
• Why AI model cards may replace stacks of AI questionnaires
• How to shift from assess-everybody to monitor-everybody and assess by exception

If you have ever inherited a program you did not build and wondered whether to fix it or start over, this conversation is for you.

You can't actually say no to a vendor. Ask any room of CISOs how many of them have the power to walk away from a vendor relationship over cyber risk, and the honest answer is almost none. So if leverage is mostly an illusion, what actually moves a vendor to fix their exposure?

In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik dismantle the idea that third-party risk is about power and rebuild it around something more useful: collaboration. They dig into why the questionnaire-led, finger-wagging approach fails, how to communicate risk in dollars and cents that the business will actually act on, and why the relationship you build before an incident matters far more than any contract clause after one.

In this episode, you will learn:

• Why "saying no" was never the CISO's job, and what the real role is

• How to turn a contract into a collaboration tool instead of a weapon

• Why intelligence-led outreach beats questionnaire fatigue every time

• How to communicate vendor risk so business stakeholders actually respond

• What to do when a hard-to-replace vendor won't budge

• Why the first interactions with a vendor set the tone for the entire relationship

If you have ever felt ignored by a vendor who has bigger customers than you, this conversation will change how you show up to the table.

Manufacturing cybersecurity risk is rising faster than most organizations realize—and many teams are still missing the basics. In this episode, we break down manufacturing cybersecurity risk and why this industry has become one of the most targeted sectors for cyber attacks. If your business depends on uptime, supply chains, or physical operations, this conversation will show you where the real risks are hiding.

Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik explore why manufacturing environments are especially vulnerable, from legacy systems and operational technology (OT) to the real-world consequences of downtime. They unpack new research showing how far behind many organizations are, why cyber attacks in manufacturing are shifting from data theft to operational disruption, and what leaders need to understand to protect production lines and critical infrastructure.

• Understand why manufacturing is a top target for cyber attacks

• Learn how downtime risk outweighs traditional data breach concerns

• Discover the gap between IT security and operational technology (OT)

• Explore why many organizations still struggle with basic cyber hygiene

• Get insights into how cyber threats are evolving across global supply chains

Don’t risk production downtime or supply chain disruption. Learn how to identify and prioritize the cyber risks that matter most.

Cyber risk communication with boards is broken—and most organizations don’t realize how much it’s costing them. In this episode, we unpack cyber risk communication with boards and reveal why even well-prepared security leaders fail to get buy-in where it matters most. If you’ve ever struggled to explain risk in a way executives actually understand, this conversation will show you how to fix it.

Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik break down what boards actually care about, why traditional reporting (like risk heat maps and technical metrics) often falls flat, and how to reframe third-party cyber risk in a way that drives action. Drawing from real-world experience and industry research, they explore the gap between cybersecurity teams and board-level decision-makers—and how to close it with clearer storytelling, smarter prioritization, and business-aligned messaging.

• Learn how to translate complex cyber risk into language boards care about

• Discover why common tools like heat maps often fail executives

• Understand the 3 things boards prioritize—and how to align your messaging

• Get practical strategies for answering “bad” board questions effectively

• See how better communication can directly improve organizational resilience

Don’t risk your message getting lost in complexity. Learn how to communicate cyber risk in a way that drives real decisions.

Third-Party Risk Prediction is the future of cybersecurity, but can you actually predict when a vendor will fail? In this episode of Third Party, we explore third-party risk prediction and whether forecasting vendor failure is realistic or just another false promise. If you’ve ever wondered how to identify hidden risks before they explode, this conversation delivers practical insights you can act on immediately.

Hosted by Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik, this episode dives into the real signals behind vendor instability, from layoffs and geopolitical conflict to ransomware targeting patterns and operational blind spots. The team breaks down why correlation is often mistaken for causation, how attackers exploit chaos, and why most organizations still miss early warning signs. You’ll walk away with a clearer understanding of what can actually be predicted, what cannot, and how to build a smarter third-party risk strategy that goes beyond surface-level metrics.

What you’ll learn:

• How to identify early warning signals of vendor failure before a breach happens

• Why layoffs, automation, and global conflict can increase third-party risk exposure

• The difference between correlation and causation in risk modeling

• How attackers exploit chaos and weak vendor ecosystems

• Why vendor self-reporting often fails and what to rely on instead

Don’t risk missing the signals that matter. Learn how to spot risk earlier and make smarter third-party decisions before it’s too late.

A new AI model called Mythos promises to find vulnerabilities faster than any human team. But what does that actually mean for the security leaders responsible for managing third-party risk? In this special episode, Jeffrey Wheatman is joined by Bob Maley, Ferhat Dikbiyik, and Black Kite co-founder and CTO Candan Bolukbas to break down what Mythos and Project Glasswing actually change, and what they don't.

The numbers are already alarming. Forty-eight thousand CVEs published in 2025. A 43-day mean time to patch. An exploitation window that has gone negative, meaning threat actors are exploiting vulnerabilities an average of seven days before defenders even know they exist. Mythos accelerates vulnerability discovery, but as the team makes clear, discovering more vulnerabilities faster only matters if you have a program built to handle it.

In this episode, you will learn:

• What Mythos and Project Glasswing actually are and why the hype may be outpacing the reality

• Why the vulnerability deluge is already unmanageable with traditional CVSS-based prioritization

• How the 135-day embargo window affects your third-party exposure

• Why fourth-party risk, meaning what your vendors run rather than just who they are, is becoming the real blind spot

• What SBOMs have to do with the future of supply chain vulnerability management

• The three things security leaders should do right now to prepare their programs

This is not a theoretical conversation. It's the one your program needs before the window closes.