Whose Breach Is It Anyway?
Third Party Podcast: Redefining Accountability in Third-Party Risk
Introduction
The aftermath of a third-party breach usually follows a predictable, exhausting script: the vendor downplays the blast radius, the affected company points to the contract, and the legal teams sharpen their pencils. It’s a game of "Whose Breach Is It Anyway?" where the points don't matter, but the reputational and financial damage certainly do.
In this episode of Third Party, hosts Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik discuss the uncomfortable reality of shared responsibility in an interconnected world and how third-party risk management (TPRM) teams can better manage it.
Why the "CYA" Mentality Fails in Modern Incident Response
When a vendor gets hit, the first question in the boardroom isn't "How do we help?" It’s "Does anyone else know, and do we have to tell them?"
Transparency is currently treated as a liability rather than a tool. The "CYA" (Cover Your Assets) mentality is a short-term play that inevitably fails. In the cyber world, nothing stays hidden. If a company doesn't tell its customers they’ve been exposed, the dark web, or the threat actor themselves, eventually will.
Understanding the Shared Responsibility Model in Vendor Breaches
Liability cannot be outsourced. The industry often acts as though signing a Standardized Information Gathering (SIG) questionnaire or tucking a liability clause into a contract allows for a sound night's sleep. Then Snowflake happens. Or CrowdStrike. Or a fifth-party data transfer agent three rungs down the chain collapses.
The reality of modern risk:
- The Shared Fate: Whether B2B or B2C, the customer at the bottom of the food chain is the one who ultimately suffers.
- The Legal Loophole: Suing a vendor is a common reflex, but you can't sue a ghost. When the forensics are messy and the supply chain is five layers deep, the "Deepest Pocket" becomes the primary target for class action lawsuits.
Why Complexity is the #1 Barrier to Supply Chain Security
The World Economic Forum’s Global Cybersecurity Outlook 2025 highlights a staggering reality: 54% of large organizations say the supply chain is their #1 barrier to cyber resilience.
Complexity is being weaponized. Threat actors aren't knocking on the front doors of hardened enterprises. They are finding the small OCR company or the logistics provider that doesn't have MFA enabled. Resilience isn't just about a single company's stack. It’s about the minimum viable level of business that can be maintained when a partner fails. Black Kite illuminates these hidden dependencies, mapping the Nth-party relationships that traditional assessments miss.
From Static Assessments to Active Vendor Risk Monitoring
To stop being victims of "cascading impact," the TPRM industry requires a radical shift in perspective:
- Move from Static to Active: Stop relying on a questionnaire from eighteen months ago. Organizations need visibility into technical gaps and ransomware susceptibility across their ecosystem right now.
- Collaborative De-risking: Instead of just "shaming" a vendor, use leverage. If a critical supplier has a poor posture, negotiate. Help them improve or find an alternative before the breach occurs.
- Demand Daylight: Cybersecurity doesn’t thrive in the shadows. Shared data requires shared accountability. Financial risk quantification helps translate these technical findings into the language of dollars and cents that the board understands.
If we spend our time finger-pointing, we don’t have the time to learn the lessons. And it’s the lessons learned that make it better for the next fight.
DON'T MISS AN EPISODE!
Subscribe to Third Party on YouTube, the podcast for the people who don’t need to ask ChatGPT what TPRM means. New episodes every other week.
Next Time on Third Party
Next Time on Third Party: We’re closing the loop with a deceptively simple question: what actually puts the C in TPCRM? Because if it’s not cyber, then what are we even measuring?
Subscribe below.
