Sierra: What can third parties do to cut down on the number of requests they get for security questionnaires?
Anders: Great question.
I can mention my sort of business. This was my pain point.
I was a vendor. I was getting inundated with these requests, and it felt like death by 1000 cuts, where it's just one more, one more, one more event. You just end up dying, right?
The goal of ThirdPartyTrust was always not just to help the enterprise do it more efficiently, but also can we add value? Can we solve the vendor use case? Which is, “I keep providing the same data over and over again.”
The approach that we took with ThirdPartyTrust is the application itself; it’s almost like LinkedIn, but for B2B. The idea being companies have security profiles inside ThirdPartyTrust. Vendors build a profile that has answers to standardized questionnaires. It has SOC reports, HITRUST certification, cyber liability insurance, their pen test, etc. All these different artifacts explain to an outside party what your security posture is.
Of course, all the things I mentioned, all the other rating providers, are part of that package, too.
What we encourage our vendors to do is now that you've completed an assessment for one customer, get some mileage out of the work you do.
In ThirdPartyTrust, you can build that profile, and you can start sharing it out with other customers.
So when they send you maybe that one-off Excel spreadsheet that doesn't pertain, you can say: “ThirdPartyTrust this is great, let me first share what I have built already. It has up-to-date information around our security posture; it’s very detailed, check that out; if there are any questions, let me know.”
What we found is that it works in the majority of cases, not all cases. It's not a silver bullet, some companies will say, come hell or high water, you better fill out my custom questionnaire, and that's okay. If that happens, you're kind of back to where you started.
When companies do accept it, alright, you just saved yourself a tremendous amount of time, and it's so much more of an efficient way of going about it.
The critical thing that we always talk about too, is that as they build this profile, the vendors can maintain it over time as things change.
They can update it, just like your LinkedIn profile. “I got a job with Paubox!” boom, and you update it, everyone can see it, everyone can give you a thumbs up or congratulations.
Again, the core of what we thought was why we couldn’t take the same concept applied to third-party risk management that will help the vendors. It will help them with the initial onboarding and again, security review, and the ongoing thing that happens typically yearly where you have to update the information and provide it back to your customers.
Sierra: Okay, great. Outside of assigning the questionnaires and performing on-site audits, what are other services or technology that allow organizations to digest third-party risk?
Anders: Yeah, so I kind of mentioned a few of them.
On sites, I think this will not happen for a very long time because of COVID. I don't think anyone wants to be liable for sending employees on site. I don't think the vendors want that liability either having people come in. I think on-sites are mainly in the past, we'll see.
Then you're talking about remote assessments. Again, I mentioned this because questionnaires are useful. They're self-attestations, and they're not always appropriate. Why? Because a questionnaire can produce a lot of information.
We’d like to take what we preach, this risk-based approach to third-party risk management. The idea being first, measure inherent risk. What that means is how critical this vendor is to us? What if there was a breach? What would the impact be beyond the business?
We always stress that it should be quantified.
You should look at that vendor and say, how much data? What type of data? Is there any regulation around this relationship that we have?
Quantify impact first. Then based on that, make a decision. How deep do I want to go?
If it's a low impact vendor, use our partners’ data sources to make an assessment. If that information looks good, then maybe that's enough.
Maybe you take that data and say, “Based on the posture of the impact to this vendor, and what BitSight is telling us, this data is enough. I feel I've made an assessment or risk-based decision that I’m not going any deeper based on the impact.”
In another case, maybe the bits of data don't look that great. Then you send out a questionnaire to go deeper.
No matter what, you want to do that deep dive for your really critical vendors, and you want to understand much more detail around how they're securing their infrastructure, their processes, and procedures.
Sierra: Anders, I know you mentioned that your platform does remove some of the administrative tasks such as spreadsheeting. Does your platform help information security teams eliminate administrative tasks associated with third-party risk management?
Anders: A key problem in the industry, or how this happens, is a lot of the data gathering, it's kind of put on the infosec team.
So infosec teams at enterprises spend a tremendous amount of time just gathering data. Well, data gathering is a very low-value activity. It's necessary for a proper TPRM process. To run, you need data. Without data, you can't run the TPRM process. The act itself is a very low value add.
A critical thing that we've always thought about is how do we make it easier for vendors to do the deck data gathering? How do we enable vendors to build and maintain these profiles? How do we enable them to bring in the entire team at that vendor site quickly?
A critical thing that we try to do is the low-value activities of gathering data, what needs to live with the vendor anyway.
If you move that away from the enterprise, now all of a sudden, the employees have a lot more time to spend on high-value activities. What we mean by that is reviewing the information in detail, opening, and discussing findings with your third party, then driving those findings to remediation.
That's really where we want these highly skilled folks to be working on. We don't want them working on gathering data or sending follow up emails or checking in. All those things can be automated.
Every day what we're thinking about is taking each of those administrative tasks and building automation around it and intelligence. We know that there's always a follow-up or people asking, “What's my due date?”
The platform can do that for you. It can tell the vendor when it's due; it can remind them. It can provide training on how to use a tool or what's not needed. The platform can easily do that. You don't need a person.
So, with a lot of these low-value activities, what we're looking to do is to say, “How do we take that off the hands of the infosec team?” and “Has the tool automated the task?” or “How do we enable the vendor to do more on their own without being directed by the infosec team at the enterprise company?”
Sierra: Okay, great. Thanks so much for sharing that. Anders, what sets your platform apart from your competitors?
Anders: Sure.
Nine times out of 10, when we are in the sales cycles, we're competing with a homegrown solution. We're competing with manual spreadsheets and emails. All the things I just said, we're leaps and bounds ahead of anything like that.
When I look at other tools out there, many are the same players that, when I started five years ago, were already there. The big GRC providers: Archer, Rsam/Galvanize, and a few others.
A lot of the same players I saw when I started are still in business, and the main issue with their solution is still there. The number one differentiator that we do is how we approach this whole problem.
A GRC tool like Archer or Galvanize is what we call silo.
A silo means that the enterprise has to gather all this information on their own, put it in the tool for producing value reports, etc.
Well, that's really difficult. It's very time consuming, and it's hard for enterprises to do that.
So with ThirdPartyTrust, our main differentiator is that we are built more like LinkedIn for B2B. It's a network-based approach to third-party risk management.
Now that we bring on customers, they ask, “how many of my vendors do you have in your network?” In most cases, we already have half of them on the platform. So, data for half of their vendors is readily available using ThirdPartyTrust instead of starting from scratch.
That's the main difference between what you'll get with these other tools out there versus what we provide.
Our goal is actually to crowdsource this information in some way across all our enterprise customers. That helps them.
It helps the vendors because they can standardize, maintain a golden source of data they can share with all their customer base. Again, that has all these network effects because now it's even better for the enterprise, which makes it better for the vendor and so forth.
The network is our primary differentiation.
Other than that, you go to the other secondary things that we look at, making it easy to use. Making it seamless, no training required, anyone should be able to pick it up and start using it.
The other difference would be how we integrate data, how that data drives the process, and helps to speed up and provide intelligence.
In this space, our integrations are the strongest. They're the most well defined, they're the deepest, and they're the easiest to use.
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
