Vendor risk without the theater.
Third Party treats third-party cyber risk as a business problem with technical consequences. Its conversations move from vendor lists, AI agents, audits, and breach blame to the harder question of who can actually see, own, and explain the risk.
PRESS PLAY
Third Party is a panel-style cybersecurity show focused on the rough edges of third-party risk management. Its center of gravity is not tool selection or compliance theater, but the practical question of how organizations understand risk when their operations depend on vendors, cloud services, AI systems, and other people's infrastructure. The conversations are measured, but they are not detached. They often begin with a simple question, then keep pressing until the convenient answer stops working. Vendor sprawl is treated as more than a procurement nuisance. It becomes a visibility problem, a redundancy problem, and, with AI agents in the mix, a problem of unknown downstream vendors and non-human identities. Automation gets similar scrutiny. The panel distinguishes sensible process support from blind automation that strips out traceability, human review, and accountable signoff. AI in risk management is discussed with practical restraint: models can help, but expectations, assumptions, ranges, and evidence matter more than a falsely precise number. Regulation is handled as a genuine tension. It can push security forward, yet it can also turn attention away from the underlying risk and toward fear of audit failure. Breach responsibility is not reduced to finger-pointing. The show keeps returning to shared responsibility, contracts, consumer harm, vendor chains, and the cultural habits that shape blame. Accountability is one of its recurring obsessions. Who owns the risk, who accepts it, who explains it, and who gets blamed when the answer was never clear? Bob and Farhad give the show much of its recurring texture, with dry skepticism, analogies, and practical pushback. The tone can be blunt, but the purpose is clarification rather than drama. It is best for security, risk, governance, and business leaders who live with third-party exposure and want a sharper way to reason about it. The show does not pretend the next year of cyber risk will be simple. It is more interested in making the uncertainty visible enough to manage.
Made for: For cybersecurity, risk, compliance, procurement, and business leaders responsible for third-party exposure. It works best for listeners who already understand the basics and want sharper judgment about ownership, automation, AI, regulation, and vendor ecosystems.
What sets it apart: The show stands out by testing fashionable answers against operational reality: audits, signoffs, hidden vendors, and breach fallout. It is skeptical without being cynical, and practical without flattening the complexity.
If you manage third-party cyber risk, you’ve seen it all: meaningless scorecards, black-box tools, and endless frameworks that never quite connect to business impact. Third-Party is the podcast built for the people behind the dashboards. The ones managing 5,000 vendors with a team of three. Hosted by Jeffrey Wheatman, Ferhat Dikbiyik, and Bob Maley, this show unpacks what actually works (and what doesn’t) in TPRM. No fear tactics. No buzzwords. Just unfiltered conversations, sharp insights, and the occasional roast of a really bad SIG questionnaire. If you’ve ever had to explain cyber vendor r
Based on 5 episodes we listened to · September 2026
Third Party turns vendor cyber risk into candid arguments about accountability, automation, hidden dependencies, and the limits of confident-looking models.
Third Party treats vendor cyber risk as an operating problem, with Jeffrey Wheatman, Ferhat Dikbiyik, and Bob Maley testing each other's assumptions in lively roundtable discussions.
A risk model says $1,319,331.12, and Third Party invites you to distrust the cents.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
Vendor sprawl is framed as a visibility problem once agents and shadow IT expand the vendor chain.
Vendor sprawl comes into focus here as a visibility problem with real operational cost, from the 36-vendor example to the harder case of agents drawing on outside models and data sources.
A practical case for keeping humans in the loop when automation starts outrunning judgment.
Third Party treats automation as a governance question, not a novelty. It opens with the windup-toy metaphor and then settles into third-party risk management, asking what should be automated and where a human still needs to sign off when the stakes are high.
A sharp look at who owns cyber risk once blame starts moving.
The episode centers on accountability for cyber risk, beginning with the blunt point that a CISO does not carry the company’s general risk alone.
AI risk is reduced to a number, but the discussion keeps pulling it back to assumptions, distributions, and judgment.
The episode lands on a basic point that is easy to miss: models are wrong, so the people using them still have to return to assumptions, expectations, and what the model is meant to show.
Ransomware fatigue meets the vendor problem that never stopped being real.
The episode frames ransomware fatigue through the hard math of third-party exposure. It starts with the blunt contrast between about 61 active ransomware groups in May 2023, more than 100 now, and another hit on a vendor, which turns the issue into a familiar question about what…
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
Black Kite's Jeffrey, Bob May, John Den and guest Rock Lambros of Zenity debate whether AI will end humanity or resemble Y2K, with Jeffrey admitting he is "a little bit of an AI pessimist." Bob May compares current warnings to Three Mile Island in the late 1970s, when he was a policeman less than five miles away, and to the 1999 Y2K war room at the hospital association.
Vendor sprawl is the opening problem.
Third Party opens with a wind-up toy.
A discussion on whether cybersecurity regulation improves security or merely creates a checkbox compliance culture that may be dangerous.
This episode discusses the significance of the 'C' in TPCRM, emphasizing how cyber risk impacts all other risk aspects in third-party risk management.
A panel discusses who is at fault when a vendor breach leaks customer data, exploring blame, accountability, and the impact on consumers.
Who owns cyber risk?
Third Party starts bluntly.
Cybersecurity experts discuss predictions for 2026, focusing on the rise of agentic AI in attacks and the expectation that things will get worse.
The hosts dig into ransomware fatigue.
A panel discusses the transformative impact of AI on third-party risk management and cybersecurity.
A discussion on why cybersecurity metrics presented to boards often fail and how to align them with business priorities.
This episode debunks the myth that arbitrary letter-based cyber risk scores are effective for third-party risk management, arguing they lack business context and lead to poor decisions.