National CISO Virtual Roundtable

Third-party risk no longer moves at the speed of a renewal cycle. Nearly half of breaches involve a third party, critical edge-device flaws are mass-exploited the day they are disclosed, and one vendor’s AI chatbot integration became the path into more than 700 companies. This roundtable brings together security and risk leaders to debate what a credible third-party risk program looks like when attackers and vendors both operate at machine speed. Expect disagreement. Bring your own.

• Third-party involvement in breaches has climbed to roughly 48%, while the median time from disclosure to mass exploitation of critical edge vulnerabilities has fallen to zero days. The threat cadence and the control cadence are now a year apart.
• The annual vendor questionnaire documents a vendor’s posture once a year. The Salesloft Drift compromise showed one vendor’s AI integration changing hundreds of customers’ exposure in ten days.
• AI agents, OAuth grants and other non-human identities run by vendors are a fourth-party attack surface that most contracts, inventories and assessments do not yet cover.
• Agentic AI can already do a meaningful share of TPRM work (intake, questionnaire review, evidence collection, vendor follow-up). The open question is which decisions stay human, and how analysts keep their judgment sharp.
• Ownership of third-party risk is fragmenting across GRC, procurement, security operations and threat intelligence. Programs that work converge on a shared operational workflow, not a shared report.