Let's Go Shopping: Third-Party Vendors and CyberRisk

The speaker presents third-party risk management as a balance between the value a purchase offers and the impact and likelihood of harm it could cause. Rather than opening with security jargon, the talk asks listeners to reason the way they already do in a grocery store, weighing what they truly need against what they merely want and what they already have on hand.

Walking through a supermarket, the session places deli food, cleaning supplies, raw meat, produce and flowers on an impact-versus-probability grid. Controls such as expiration dates, government rules, store policies and food handling courses then lower the residual risk that remains. The talk also shows that risk moves over time: a Valentine's Day shortage or the 2020 supply disruption changed how the same items felt. Business cases follow, including a 2014 retail breach that entered through an HVAC vendor, and a 2024 incident at a well-known security vendor that showed how widely trusted software was embedded.

For practitioners, the closing advice is to have colleagues ask whether a tool is needed, what data or systems it touches, how much the organization would lose if it failed, and whether the business owner would accept that outcome. Certifications are described as a useful starting point for due diligence rather than a final answer, and build-versus-buy decisions depend on available resources. The speaker noted that the operational side of vendor evaluation is a separate conversation for analysts.