Third-party risk management: vendors, subprocessors and breaches

One responder's retrospective on serial downstream breaches: long-lived keys, log readiness and what security leaders can change this week.

A viral thread said banks were hit in 7 or 15 places at once. What Arkea, SinoPac, Korea, Belgium and Binance confirmed, and what does not hold up.

Twenty AIBOM questions for AI vendors in six groups: why each matters, the field that proves a good answer, the red flag, and contract clauses to ask for.

A practical explainer on the CSA Consensus Assessments Initiative Questionnaire (CAIQ): what it is, how it relates to the Cloud Controls Matrix (CCM) and the STAR registry, how it is used in cloud vendor assessment and third-party risk, and how CAIQ compares to the SIG questionnaire.

KrebsOnSecurity reports (19 October 2026) that U.S. federal investigators suspect an executive at a U.S. consulting firm helped run the ShinyHunters extortion site "shinywire[.]com," and that investigators identified executives at two ransomware-negotiation firms with "unusually close relations" to ShinyHunters. Nothing here is proven against any named individual, and the suspected site-operator is unnamed and uncharged. For CISOs and IR leaders the lesson is structural: the negotiators, IR vendors and "recovery" brokers you bring in mid-incident are themselves a trust boundary. An independent, attributed read on what is alleged versus proven, and how to run conflict-checked, sanctions-screened due diligence on anyone you let into a live ransomware response.

Deloitte was listed on The Gentlemen ransomware leak site on 11 Oct 2026, marked 'Data info - soon.' Unverified: no data published, no Deloitte confirmation.

A practical 5-step method for a SaaS security assessment, plus the questions and controls that separate real due diligence from a checkbox.

Dutch police arrested a ShinyHunters suspect; days later an Umbreon defacement hit the FBI jobs site, maybe a frame-up. Why attribution is adversarial.

Before a third-party tool gets access to Teams data, check four things: permissions vs need, publisher verification, data flow, and governance fit.

A practical vendor security assessment checklist: the areas to review before onboarding a third party, the evidence to ask for, and how to rank vendors by risk instead of treating them all the same.

Security questionnaires are the backbone of third-party risk management — when they are focused. What to include, how to avoid questionnaire fatigue, and how to turn answers into decisions.

A lean, tiered approach to vendor risk management for small security teams — how to triage, assess, and monitor vendors without a dedicated GRC hire.

Learn how to rank vendor security risk using data sensitivity, access level, and business criticality to focus reviews where they matter most.

A practical third-party vendor risk assessment checklist covering security, compliance, access, and offboarding for every vendor you onboard.

AU Small Finance Bank is probing a possible leak on a Salesforce-hosted platform after ScarlettGroup claimed KYC data. Confirmed vs claimed, and what to do.

16 of 36 companies breached in 2026 publicly held SOC 2 or ISO 27001. What the certificates covered, what they did not, and what to ask vendors.

Quest Diagnostics confirmed unauthorized access to patient records in its Quanum Lab Services Manager on 21 Oct 2026. What is known and what to do now.

PwC has confirmed a cybersecurity incident at a third-party vendor that hosts its employee learning records, after the Everest extortion group listed PwC and claimed ~590.69 GB of data. What PwC actually confirmed, what Everest claims (still unverified), and the third-party / LMS lessons for security leaders.