Third-Party Risk Management - SOC 2s, Security Questionnaires, and Psychosis

Learn practical approaches to third-party risk management beyond traditional "check-box" methodologies in this conference talk from BSidesSF 2025. Explore the distinct challenges within the TPRM (Third-Party Risk Management) space, including the limitations of standard SOC 2 reports and security questionnaires. Discover creative, actionable solutions designed to transform vendor risk assessment processes from compliance exercises into high-value security outcomes. Gain insights into moving past superficial risk evaluation practices toward more meaningful third-party security assessments that actually enhance organizational security posture.