Cybersecurity Awesomeness Podcast - Episode 179
In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen is joined by Justin Beals, CEO and founder of StrikeGraph, for an in-depth conversation on the evolving landscape of Third-Party Risk Management (TPRM) and CISO liability.
Drawing on his background as a CTO and software engineer, Beals highlights three key trends shaping vendor risk: persistent breach rates tied to third-party vectors, heightened regulatory scrutiny (such as CMMC Rev 3 requirements), and the increasing adoption of AI to automate complex compliance workflows. A major focus of the discussion centers on the shift from self-attested security questionnaires toward mandatory, verifiable vendor testing—particularly driven by Department of Justice enforcement under the False Claims Act. Steffen and Beals explore the legal and criminal implications for "affirming officials" who sign off on compliance data, emphasizing that CISOs must go beyond surface-level questionnaires to systematically collect "receipts" and proof of vendor controls.
Drawing on his background as a CTO and software engineer, Beals highlights three key trends shaping vendor risk: persistent breach rates tied to third-party vectors, heightened regulatory scrutiny (such as CMMC Rev 3 requirements), and the increasing adoption of AI to automate complex compliance workflows. A major focus of the discussion centers on the shift from self-attested security questionnaires toward mandatory, verifiable vendor testing—particularly driven by Department of Justice enforcement under the False Claims Act. Steffen and Beals explore the legal and criminal implications for "affirming officials" who sign off on compliance data, emphasizing that CISOs must go beyond surface-level questionnaires to systematically collect "receipts" and proof of vendor controls.
