Continuous Third-Party Risk Monitoring with Girish Redekar

Yeah.

Y-you know, uh, one of the things to understand about point-in-time compliance and, and the thing that I, uh, you know, often pointed out to s- uh, CISOs and, and other people is that the reason that point-in-time compliance fails isn't that people are lazy or dishonest.

Uh, you know, most of them are neither.

Uh, it, it actually fails for a structural reason.

Uh, and it's the fact that we built this entire system around a scheduled event.

Um, and, you know, anything that you schedule, uh, you prepare for, right?

Mm-hmm.

So the preparation is the contamination.

The, the vendor knows, uh, when the audit window is gonna open or, you know, the, the internal audit team knows when they're gonna do this.

Uh-

Mm-hmm.

They know, uh, uh...

So, so what you end up measuring isn't security, or you don't end up measuring the control.

You end up measuring their ability to get ready.

Um-

[chuckles]

You know? And, uh, y-you know, like, the, the funny anecdote I have about this is, like, health inspectors figured this out decades ago, right?

Yeah.

That's the reason why they show up unannounced, uh, you know, so.

That's right, yeah.

But, but the way we sort of do this, uh, this compliance, uh, and the reason it's called illusion and it looks a little performative is because, uh, you know, is, uh, y- you basically announce this whole thing and, um, so, so then, then it's, it's just about how ready can you get and how quickly you can get ready.

Yeah.

So I feel like the, the important thing to understand here is that the shift isn't going from annual to quarterly or from quarterly to monthly.

Uh, that's just, uh, y-you know, you're just taking the same thing and trying to do it faster.

Uh-