Vendors
Third-party risk management, vendor incident response, concentration analysis, and AI vendor evaluation. The standing vendor discipline and the incident-time discipline that are easy to confuse and shouldn't be.
Third-Party Risk During a Portfolio Restructure
Every vendor risk playbook assumes steady state. Then the fund closes a carve-out, or bolts on a competitor. What actually happens to the vendor register at close, which change-of-control triggers fire in week one, and the ninety-day playbook that separates the portcos the fund puts on the next platform strategy from the ones it quietly downgrades.
TPRM Software: 2026 Buyer's Guide
Compare Third-Party Risk Management software for 2026 — six platforms across the platform-augmented, outside-in continuous rating, and enterprise TPRM tiers. Vendor tiering, questionnaire automation (SIG, CAIQ), continuous monitoring (SecurityScorecard, BitSight), and where each platform actually fits.
Mitigation Debt: The Silent Risk That Accumulates Between Vendor Incidents
Eighteen months ago you committed to controls after a vendor incident. Today the same vendor has another one. The mitigations were partly delivered, partly not. The math + memory system that surfaces what TPRM misses.
Stay, Exit, or Mitigate: The Vendor Incident Decision Framework
Exposure analysis says 18%. The CISO asks what to do. Four options, one decision criterion, five anti-patterns to avoid. The framework that converts judgment into defensible recommendation.
Are We Affected? The Sixty-Minute Triage for Vendor Incidents
The Slack alert lands at 3:47pm. By 4:00 the CISO needs a recommendation. Three questions, five artifacts, sized for a small security team. The framework that makes the next vendor incident go differently.
Someone Else's Breach: Why Vendor Incident Response Is Its Own Discipline
Traditional risk assessment asks what might happen. Vendor incident response asks what already happened — and did it happen to us. The discipline, the four failure modes, and the framework that closes the gap.
Vendor Concentration Risk: The Dimension Per-Vendor TPRM Misses
37 of your 142 vendors run on us-east-1. Per-vendor TPRM never sees it. The four layers of concentration risk and the matrix that maps cascading-failure exposure.
Third-Party Risk Management for Growing Companies
Your vendors are your risk. Here's how to assess, tier, and manage third-party security without drowning in questionnaires.
How to Evaluate AI in a Vendor's Product: What to Ask Before You Buy
Your vendor added AI. The questions to ask about data handling, model behavior, and vendor claims. Plus which answers should stop the purchase.
The 5 Vendors You Should Actually Worry About (And the 50 You Shouldn't)
The four-tier framework for identifying critical vendors, plus the portfolio-concentration angle per-vendor tiering misses — grounded in Verizon 2025 DBIR, IBM 2024, and the July 2024 BCBS third-party principles.