Swatting Flies With Sledgehammers

The talk opens with a story about a large financial institution's vendor risk review that cost a small company roughly 500 hours over fifteen months, while the data collected was thin. The speaker uses this to ask why third-party risk work consumes so much time and whether the effort matches the value. He frames the goal as reasonable assurance rather than perfection, and argues that time spent on low-value vendor paperwork is time taken from other security work.

He then traces the practice from procurement checklists in the 1990s through shared assessment questionnaires and successive revisions of control frameworks that keep adding requirements. He reviews four common approaches: independent audits such as SOC 2, security ratings services, standard industry questionnaires, and custom questionnaires. For each he lists strengths and weaknesses. Audits can be superficial or come from weak firms, ratings can produce false positives and opaque scores, and custom questions often duplicate standard ones. He recommends accepting industry standards, asking which questions are essential, and accepting existing artifacts such as penetration test reports. He also suggests lightweight open-source checks of a vendor's public footprint and asking peers who use the same vendors.

He closes by arguing that the business owner owns the risk while security advises on it, and that buyers should document their reasoning and revisit decisions over time. The practical takeaway is a smaller, standards-based process that trades some thoroughness for time to spend on higher-value security work.