The Security Strategist

When a critical PHP vulnerability emerged last week, Richard Stiennon moved quickly to check every web property he manages. The host of the Security Strategist Podcast had been fortunate as he had recently moved away from WordPress, while the one site he still manages for someone else had automatic PHP updates enabled. But the incident highlighted a much bigger challenge for organisations responsible for thousands of third-party relationships.
Now imagine having to assess that level of exposure across 10,000 suppliers. For Sean Cronin, CEO of ProcessUnity, this is the reality facing third-party risk teams. Annual questionnaires and periodic assessments cannot keep pace with vulnerabilities that emerge, supplier relationships that change and risks that extend deep into supply chains. As Cronin suggests, organisations need to start thinking about third-party risk as a live signal rather than a periodic exercise.
In this episode, Stiennon speaks with Cronin, a risk management veteran of more than 25 years, about how continuous monitoring, automation and AI are changing supplier risk assessment. They discuss how to verify actual exposure, uncover fourth- and fifth-party dependencies, cut through alert noise, and pair automated intelligence with human judgement.
Third-Party Risk Management Has Outgrown Paperwork
Cronin has spent more than 25 years in risk management, in the field since before “governance, risk and compliance” was a recognised term. He remembers when banks and other heavily regulated firms employed hundreds of assessors who travelled to suppliers, inspected premises and worked through stacks of paperwork. Spreadsheets and software followed, but the underlying problem has only grown.
“The ecosystems that our clients are powered by and working with and depend upon are growing at a rate faster than the employees that can staff up and assess them,” he says. The task has changed, in his words, “from a paperwork problem to a resilience challenge and opportunity”.
AI Cyber Threats Are Speeding Up Vulnerabilities
Part of the pressure comes from the other side. Cronin says criminals’ adoption of AI has changed how critical vulnerabilities are. Teams once reacted to the occasional major flaw by working out who was affected. Now new ones arrive daily, sometimes several times a day.
Speed is the answer. If a company can quickly establish that 10 of its 15,000 vendors are exposed, it can ask those ten whether they have mitigated the problem and set the rest aside. Cronin says the old just-in-time approach no longer works. “We have to be dealing in real time.”
Vendor Vulnerabilities Hit 58% of Ecosystems
Cronin says 58 per cent of the vendor ecosystem across ProcessUnity’s client base was affected by vulnerabilities in two weeks, and the figure rose once the PHP flaw was added. He admits he did not believe it at first. Being affected is not the same as being compromised, but the burden of proof still falls on the risk professional. “Verify to me that they’re not,” Cronin says, “and then I can put them into the good bucket.” Without automation and workflow, he warns, “we’re literally chasing ghosts”.
ProcessUnity pulls together external scans, financial, firmographic and technographic data to show what a supplier looks like to an outsider, then pairs it with a controls-based risk index that reveals how well the supplier manages risk internally. The aim, Cronin stresses, is to help suppliers improve, not merely to rank them. “It’s about making the ecosystem safer for all of us.”
Supplier Risk Questionnaires
Anyone who has completed a supplier questionnaire will recognise Cronin’s next point. He says some clients now send questionnaires of 300 questions or more, with branching logic running to 600. His advice to suppliers is blunt: “Stop filling out questionnaires.” Instead, he says, secure automation can pre-populate answers from documents a supplier has already provided. Risk teams can then check those answers against external data and ask for evidence only where something looks wrong. The aim is “fewer questions and better questions”. The test is no longer whether a vendor returned its form but whether the two sides have talked about the risks that matter.
Human Oversight in AI Risk Assessment
None of this, Cronin insists, means handing judgement to machines. “A human in the loop is a critical part of our conversation with clients.” AI can handle the routine reading and clear lower-tier suppliers quickly. That leaves risk managers to dig into critical vendors and to spot those that looked moderate-risk on paper but could cause real harm.
The exposure also extends past direct suppliers. A firm with 10,000 vendors, Cronin says, might have 40,000 fourth and fifth parties it knows nothing about. Mapping them reveals regional concentration and hidden dependencies, and it sometimes startles the suppliers themselves. “Wow, you know a lot about me before I even know it,” is a common reaction.
Third-Party Risk Is Now a Boardroom Issue
For organisations still relying on spreadsheets and periodic reviews, Cronin’s advice is to treat third-party risk as “a live signal” and to act on it according to how important each vendor is. The subject, he adds, has moved beyond the CISO and the chief procurement officer to the boardroom, because everyone now understands how interconnected they are. “You need to use data, you need to use AI, but you need to actually use the humans that are risk professionals,” he says. Listen to the full episode of the Security Strategist Podcast for the complete conversation. Or, if you would like to find out more, visit the ProcessUnity website or follow Sean Cronin on LinkedIn.
Takeaways
Why annual assessments can no longer keep pace with evolving supplier and AI-driven risks.
How continuous monitoring identifies vulnerabilities and verifies actual vendor exposure.
Combining external scanning and business data to build a clearer picture of vendor risk.
Using SBOMs as risk indicators, supported by evidence and mitigation controls.
Reducing alert fatigue by prioritising critical vendors and high-impact relationships.
Automating questionnaires and evidence collection to improve risk assessments.
Balancing automation with human oversight and informed decision-making.
Mapping fourth- and fifth-party relationships to uncover hidden dependencies.
Why third-party risk is now a board-level operational resilience concern.

Chapters
00:00 Why annual questionnaires can’t keep pace with third-party risk
02:30 From on-site audits to rapidly changing supplier ecosystems
04:32 Real-time vulnerability response across vendor networks
08:16 Combining external signals with control-level data
10:08 SBOMs are useful signals, not ground truth
12:31 How continuous data makes assessments more relevant
16:28 Automating questionnaires and asking fewer, better questions
19:44 Keeping humans involved in AI-enabled risk decisions
21:57 Seeing fourth- and fifth-party exposure
24:41 Moving from periodic assessments to live risk signals

Two analysts select an alert from one of your noisier detection rules. The activity is limited, and they don't see the technique often, so they triage it on instinct. It takes them two hours, and they close it as a false positive. Behind that alert, a Chinese APT group has been inside a customer's network for weeks, and the first people to say so are threat researchers at the security vendor.
In this episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, speaks with Georges Bossert, Chief Technology and Product Officer and Co-Founder of Sekoia. They question whether the alert-driven SOC has a future, what a CEO should measure in the enterprise for cybersecurity, and how far autonomous security operations can go while still passing an audit under NIS2 and DORA.
The average e-crime breakout now takes 29 minutes, and the fastest on record took 27 seconds. Steinnon says the typical SOC leaves 28 per cent of its alerts uninvestigated, and one in four malicious breaches is now AI-enabled, at about $6 million per breach. To this number, Bossert said, "We've been continuously executing trade-offs and intuition-based security."
Workflows today have been deeply impacted by the decades of scarcity of experts in cybersecurity. “In a year, we’ll transition to a new dimension of security where enterprises will begin to grasp what is actually providing security rather than individual people,” says Bossert.
Key Takeaways
The average e-crime breakout is 29 minutes; the fastest recorded is 27 seconds.
Bossert's metric: the share of alerts that got a proper investigation.
A proper investigation covers network, endpoint, and other domains, at speed.
Large MSSPs still focus only on the top critical alerts.
Sekoia researchers found a Chinese APT intrusion by tracking its infrastructure.
Analysts dismissed the APT alerts as false positives after a quick triage.
Replayed with AI agents, the same intrusion gets fully identified.
A frontier model needs a harness, the company's own data and a learning loop.
Bossert rejects a fixed list of decisions agents may never make.
Rules of engagement set what agents and people may do on their own.
Human on the loop governs the rules; human in the loop follows playbooks.
When an operation goes wrong, fix the methodology and replay it.

Chapters
00:05 Welcome and the 28% problem
01:09 Measuring SOC outcomes
04:01 Can a SOC investigate 100% of alerts?
05:15 How MSSPs filter alerts
07:38 Attacker pace and the APT case
11:48 Build or buy an AI SOC
14:35 Which decisions agents make alone
18:27 Where tier one talent comes from
20:53 The one takeaway for executives

Full episode page:
More from The Security Strategist podcast: https://www.youtube.com/playlist?list=PLXoSlBGE35NooDaiZh9e1OtBCEpUfLfZ3
Sekoia: https://sekoia.ai
Richard Stiennon on LinkedIn: https://www.linkedin.com/in/stiennon
Georges Bossert on LinkedIn: https://fr.linkedin.com/in/georges-bossert-a0059018/en
Related reading from EM360Tech:
Autonomous SOCs: https://em360tech.com/tech-articles/autonomous-security-operations-centre AI cyber attacks and human decision time: https://em360tech.com/tech-articles/ai-cyber-attacks-human-decision-time
Alert fatigue in SOCs: https://em360tech.com/tech-articles/deep-dive-alert-fatigue-and-its-management-socs
SOC as a service: https://em360tech.com/tech-articles/soc-service-how-choose-right-managed-security-provider
NIS2 obligations: https://em360tech.com/tech-articles/nis2-directive-obligations-eu
AI agent governance: https://em360tech.com/tech-articles/ai-agents-enterprise-governance
Follow EM360Tech: X: https://x.com/EM360Tech
LinkedIn: https://uk.linkedin.com/company/em360
More podcasts: https://em360tech.com/podcasts
#AutonomousSOC #AgenticAI #Cybersecurity #SOC #AISecurity #SecurityOperations #NIS2 #DORA #Sekoia #EM360Tech autonomous SOC, agentic AI, AI agents, SOC, security operations, cybersecurity, alert fatigue, NIS2, DORA, APT, Sekoia, Georges Bossert, Richard Stiennon, The Security Strategist, EM360Tech

AI can flag thousands of suspicious events and create a clear summary of each one. But the bigger question is whether security teams can understand how AI reached its conclusions. In this episode of the Security Strategist Podcast, Dan Williams from Cambridge Intelligence joins John Tolbert, Principal Analyst and Director of Cybersecurity Research at KuppingerCole Analysts, to discuss how AI and visualisation are changing cybersecurity investigations.
They look at how graph visualisation, AI and automation can help security teams make sense of complex data. Williams explains how visualisation can turn machine output into something analysts can understand, investigate and act on, while also helping them see what AI is doing behind the scenes.
Why Use Graph Visualisation in Security?
Graph visualisation maps the links between accounts, devices, IP addresses, malware and vulnerabilities. Analysts can see how an attack connects instead of reading a list of isolated events. Williams traces the idea back to his company's roots. Before cybersecurity, Cambridge Intelligence served law enforcement, anti-fraud teams and intelligence agencies, who have long relied on link analysis. Picture the detective's wall of photos and string. It looks theatrical, but it works because mapping a problem is the natural way to get your head around it.
The approach has since been applied well beyond network mapping. Security teams now use graphs to connect threat intelligence, cloud infrastructure, industrial control systems and software bills of materials. Tolbert also points to identity, where graphs can expose links between devices, accounts and potential insider threats.
Williams cites a Wiz presentation that described a security graph containing roughly a trillion links. “Everything is a graph, really,” he says. Attackers are looking for a route from A to B, while security teams need to see those connections and understand where they lead. With a trillion links in the picture, that is not something an analyst can work through manually. AI can help sift through that volume, but it raises another question: if the system identifies a connection, can a security team see why it matters?
How Does AI Help Investigations?
AI is most useful when each approach is doing a specific job. Traditional machine learning can flag anomalies and classify activity, while generative AI can summarise the results and explain them in plain English. Visualisation then gives analysts a way to see what those findings represent.
Williams says the industry has moved beyond simply asking where AI can be added. The more practical question is whether the cost can now be justified. How much are organisations spending on tokens, and what are they getting back? He describes this as a move from exploration to explanation. Experienced investigators may still spend hours working through data without knowing exactly what they are looking for. But, he argues, there are many more people who need a clear account of what happened.
This now creates another problem because there is too much information. Machine learning can generate a long list of alerts, while large language models can add pages of text to explain them. Neither necessarily makes an incident easier to understand. Williams believes visualisation needs to be part of that process, giving analysts a way to follow the AI's reasoning and see where its findings came from.
He compared it to when you use a maps app; you are not trying to examine every road in a city. You have somewhere to go and need to get to your destination. This is what a junior analyst needs: something similar, a way through the relevant data rather than an overview of everything available. It could be a playbook, a timeline or a short interactive narrative.
Williams compares the ideal experience to watching a film, where the sequence follows an attacker from the initial entry point through to the exposed data and the misconfiguration that made it possible. If presenting an incident that way helps people understand what happened and retain the important details, he sees real value in it.
Can Analysts Trust AI Tools?
Trust depends on being able to follow how an answer was reached. That means traceability, sensible guardrails and a human being able to intervene when necessary. Tolbert points to one of the obvious problems with generative AI: a model can produce a detailed and convincing explanation that is simply wrong. Williams agrees, but points to another issue security teams will have to contend with. Investigators are accustomed to asking what filters were applied when reviewing a finding. With AI, the equivalent question becomes: what prompt produced this result? Even then, the same prompt may not return the same answer twice.
That makes a record of the process important. Teams need to be able to see what the system did, retrace the steps, repeat the analysis and share the results with others. Williams compares it to saving a query rather than relying on someone to remember exactly how they reached a finding. The need for control becomes more complicated when several visual views are connected. A network graph, timeline and map might all respond to the same request, but an AI system could apply different filters or handle the information differently in each view. A high-risk node might stand out in one representation and be overlooked in another. For Williams, that changes the question vendors need to answer. It is no longer only about how a visualisation looks, but about how reliably an analyst can control the system behind it.
His advice to CISOs is to try to draw what the AI-enabled security tool did during the previous week. If that is difficult, ask the vendor to show you. The same applies to value. If the system can demonstrate its impact visually rather than producing another lengthy report, that gives security teams something they can actually work with.
AI is likely to take on more detection and drafting, with some routine analysis running outside normal working hours. People will still need to step in when something is unusual, consequential or unclear. The useful systems will be those that can surface what matters without taking away the analyst's ability to investigate further when needed.
If you would like to learn more, listen to the full episode on The Security Strategist podcast, follow Dan Williams on LinkedIn, and find out more at cambridge-intelligence.com.
Takeaways
The evolution of graph visualisation in cybersecurity.
How AI enhances security investigations.
The role of visualisation in understanding complex data.
Challenges of trust and explainability in AI tools.
The shift from exploration to explanation in security analysis.
The impact of generative AI on incident narratives.
Balancing automation with human oversight in investigations.

Chapters
00:00 Introduction to cybersecurity visualisation and AI
02:48 Graph visualisation in cybersecurity and threat intelligence
05:37 The importance of visualisation in identity and fraud prevention
07:42 From exploration to explanation in AI-assisted security analysis
09:38 Combining AI with visualisation for better understanding
10:34 Generative AI and creating narratives for analysts
14:45 The importance of trust and explainability in AI tools
15:32 Grounding AI answers with visualisation and graph context
16:52 The need for traceability and control in AI applications
18:13 Data modelling guardrails for trustworthy AI in investigations
19:00 Multimodal visualisations for complex security data
20:19 Controlling AI visualisation outputs to ensure trust
21:43 The human analyst's role in AI-driven investigations
22:11 Balancing automation and human oversight in security analysis
23:29 Narrative storytelling and interactive visualisations
24:50 The evolution of user-friendly cybersecurity visualisation tools
25:26 Using visualisation to focus analyst attention
26:23 Hollywood's depiction of cybersecurity and its lessons
26:46 Advice for CISOs on integrating AI and visualisation
28:26 Final thoughts and key takeaways for security leaders

Imagine a customer logged in to your online portal. Their token is valid, and so is their session. Then one number at the end of an API call changes, and the response comes back with a different customer's account. The WAF sees a well-formed request from an authenticated user. The schema check passes. Nothing in the log says attack.
That is an abuse of business logic; cybersecurity analyst Jonathan Care refers to it as a series of "perfectly valid calls in a sequence you never anticipated, doing something you never intended."
In this episode of The Security Strategist podcast, Jonathan Care, lead analyst at KuppingerCole, sat down with Uri Dorot, Senior Product Marketing Manager at Radware, to talk about possibilities and impossibilities of API tooling, how detection can tell the difference between an attacker and an unusual customer, and the steps a CISO can take when working with a limited budget.
Also Watch: Can Runtime Security Keep Autonomous AI Under Control?
Key Takeaways
Majority of enterprises fail to detect more than 90% of their APIs.
Developers are familiar with Shadow APIs, whereas zombie APIs are not.
Endpoint tools can be located cheaply via AI tools and crawlers.
Attacks based on business logic make use of valid calls; schema checks can’t detect them.
Business logic attacks use valid calls, so schema checks miss them.
Response inspection catches reused tokens and PII leaving.
Identity alone is insufficient; behaviour and context also matter.
A gateway does not replace an API security platform.
Every discovered API needs a named owner.

Chapters
00:01 Business logic abuse and the 90% figure
05:34 Shadow, zombie and deprecated APIs
11:18 Telling abuse from legitimate use
22:20 AI agents and behavioural detection
42:35 Budget and ownership

Connect with Jonathan Care on LinkedIn
Connect with Uri Dorot on LinkedIn
Explore more episodes on The Security Strategist podcast
#APISecurity #Cybersecurity #Radware #TechPodcast #CloudSecurity #Infosec #ArtificialIntelligence #businesslogic #APIGateway #AITraffic #AIBotTraffic #GuardrailsforAI

In the recent episode of The Security Strategist podcast, host Shubhangi Dua, podcast host and producer at EM360Tech, sits down with Chenxi Wang, Managing General Partner at Rain Capital, a cybersecurity veteran of more than two decades, a Fortune 500 board member and a VentureBeat Women in AI Award winner. They talk about self-improving AI agents (SIA) and their more advanced cousin, recursive self-improving agents (RSIA), from what they are, why they're suddenly dominating research conferences, and why most enterprises, especially regulated ones, aren't remotely ready to run them without a human in the loop.
Key Takeaways
RSIA updates the mechanism that improves the agent, not just the agent
Sandbox "no" feedback pushes agents toward workarounds, not compliance
Governance depends on evidence chains and observability, not approval gates
Self-improving agents haven't reached production at scale
Regulated industries aren't ready for zero-human-in-the-loop agents
C-suites should focus on adoption pressure and provable policy enforcement

Chapters
00:00 Introduction to Self-Improving AI Agents and Security Risks
02:30 What Are Self-Improving AI Agents and Their Current State
05:15 Challenges and Risks of Recursive Self-Improving AI
08:38 Real-World Use Cases and Deployment in Enterprises
11:08 Security and Governance Challenges of Autonomous AI
15:50 Case Study: Hugging Face Cyber Attack and AI Behavior
21:25 Future Outlook and Risks of Self-Improving AI in Business
22:12 Key Takeaways for C-Suite Leaders