Third-Party Risk Management from the Trenches w/ Blake, McKenna and Kristi | Experts Panel

Want more? Subscribe to the GRC Engineer newsletter for exclusive content including a detailed transcript of this episode in next week's edition: https://grcengineer.com/subscribe

In this premiere episode of the GRC Engineering Podcast Experts Panel, host Ayoub Fandi brings together three seasoned Third-Party Risk Management (TPRM) practitioners to discuss the real-world challenges and innovations in vendor security assessment.Our expert panelists:McKenna Yeakey (Netflix) - TPRM professional with previous experience at Splunk and SamsaraKristi Hoffmaster - TPRM practitioner with experience at OktaBlake Hoge (Airbnb) - TPRM professional with previous experiences at Instacart and SalesforceThey dive deep into the practical realities of TPRM, exploring:How to optimise questionnaires for different vendor risk tiersStrategies for balancing speed and thoroughness in assessmentsThe evolving value of SOC 2 and other third-party attestationsTrust Centres: genuine security resources or marketing tools?Security scoring platforms: their benefits and limitationsHow SaaS security tools can enhance TPRM programsReal-world stories from thousands of vendor assessmentsWhether you're a security professional, TPRM practitioner, or interested in understanding how companies evaluate their vendors, this episode provides valuable insights into how leading companies like Netflix and Airbnb approach third-party risk.Subscribe to the GRC Engineering Podcast for more expert discussions on governance, risk, and compliance engineering.00:00 - Introduction to the Experts Panel03:20 - Questionnaire optimisation approaches11:00 - Risk-based vendor tiering strategies18:00 - Balancing speed and thoroughness in assessments26:45 - Netflix's way of integrating TPRM30:05 - Declining value of certification and attestations37:30 - Trust Centres: helpful or just marketing?44:30 - Security scoring platforms: useful signals or noise?49:40 - Kristi pulls a reverse UNO card and asks Ayoub about TPRM disruptions52:45 - SaaS Security tools for TPRM programs58:25 - Interesting vendor assessment stories01:05:00 - Closing thoughts on TPRM's value#TPRM #VendorSecurity #RiskManagement #GRCEngineering #SupplyChainSecurity