Cyber Risk Is Moving at AI Speed. Business Resilience Has to Keep Up.
How AI is changing third-party risk, supply chain security, cyber threat intelligence, and the speed businesses need to defend themselves.
AI is changing cybersecurity because attackers can now perform reconnaissance, identify vulnerable third parties, develop attack pathways, and customize attacks at a speed and scale that were previously impossible.
For enterprises, especially retailers and consumer brands with complex supply chains, this creates a fundamental problem: traditional third-party risk management was designed to assess whether vendors have appropriate security controls. It was not designed to continuously determine whether an adversary is actively targeting a supplier right now.
The next generation of cyber defense requires organizations to:
• Continuously monitor third parties for active adversary targeting.
• Determine whether observed threat activity is relevant to the enterprise.
• Connect threat intelligence to specific evidence and business risk.
• Move from periodic assessment to continuous third-party risk determination.
• Use AI-native defensive capabilities to keep pace with AI-enabled attackers.
• Reduce the time between identifying a threat and taking action.
The core issue is speed. Attackers are increasingly operating at machine speed. Defenders cannot rely exclusively on human-speed processes to keep up.
Watch: AI-Driven Cyber Threats to Retail, Brands, and Global Supply Chains
John Watters, Chairman and CEO of iCOUNTER, joins Optimal Advisory co founders David Schick and Jonathan Feeney for a discussion about AI, third-party risk, supply chain cybersecurity, and business resilience.
The conversation explores how supply chain attacks have evolved, how artificial intelligence is changing the economics of cyber offense, why traditional third-party risk practices are struggling to keep pace, and what security and business leaders need to change as attackers operate faster.
Third-Party Risk Has Become a Front-Line Cybersecurity Issue
Supply chain attacks are not new.
What has changed is how attractive the supply chain has become to attackers.
The 2013 Target breach became one of the defining examples of third-party cyber risk. Attackers compromised credentials connected to an HVAC provider and used that relationship as an entry point into Target's environment.
The lesson was straightforward:
An enterprise can invest heavily in protecting its own environment while still being exposed through the organizations connected to it.
Supply chains have only become more interconnected since then.
Retailers, consumer brands, manufacturers, financial institutions, healthcare organizations, and other large enterprises increasingly depend on extensive networks of:
• Technology providers
• Cloud platforms
• Software suppliers
• Manufacturers
• Logistics companies
• Contractors
• Data providers
• Professional services firms
• Outsourcers
• Fourth parties and nth parties
That connectivity creates efficiency.
It also creates attack paths.
As enterprises improve the security of their own environments, attackers naturally search for another way in.
The question from the adversary's perspective is simple:
Where is the weakest link?
Increasingly, that link may exist somewhere in the third-party ecosystem.
What Is the Difference Between Third-Party Risk Assessment and Third-Party Risk Determination?
Traditional third-party risk management, or TPRM, generally focuses on assessing a vendor's security posture.
Organizations ask questions such as:
• Does the vendor use multifactor authentication?
• Does the vendor have appropriate policies?
• Are systems patched?
• Does it encrypt sensitive information?
• Does it comply with required security standards?
Those are important questions.
But they answer a different question from the one security teams increasingly need answered.
Traditional TPRM asks:
Is this vendor appropriately secured?
Intelligence-led third-party risk determination asks:
Is an adversary actively targeting this vendor, does that activity create risk for my organization, and what should I do about it?
That distinction matters.
A third party can meet your security requirements and still become a target tomorrow. A questionnaire cannot tell you whether stolen credentials appeared today.
A point-in-time assessment cannot tell you whether an adversary has begun reconnaissance against one of your critical suppliers.
A compliance score does not necessarily tell you whether a threat is already in motion.
Traditional TPRM vs. Intelligence-Led Third-Party Risk Determination
.avif)