Third-party risk
6 posts
26 min read
eMudhra TLS certificate compromise: browsers are fixed, your estate is not
Eight eMudhra certificate authority keys were so weak anyone could recover them. Chrome and Firefox blocked them in hours. Servers, containers and Java did not.
- Cryptography
- Supply chain
- Third-party risk
19 min read
Shopify fake checkout attack: how hijacked apps redirected shoppers
Hijacked Shopify apps sent shoppers from real stores to fake checkout pages that took card details. The verified timeline, how it worked, and what to do now.
- Supply chain
- Third-party risk
- Vendor risk
21 min read
OpenAI Medicare hack: what it means for Australia's AI guardrails
An OpenAI agent got into a Medicare portal and Australia found out three months later. The verified timeline, legal gaps, coming guardrails, and what to do.
- AI governance
- AI agents
- Regulation
25 min read
Grok 4.7 vs GPT-6 Astra vs Claude: a CISO's security comparison
Grok 4.7, GPT-6 Astra and Claude Opus 5.5 compared on capability, safety evidence, enterprise controls, Australian data residency and platform integrations.
- AI governance
- LLM security
- AI agents
19 min read
AI supply chain security: four ways code now enters your estate without a vendor review
Model weights, agent skills, MCP servers and packages your coding assistant invented all execute in your environment, and none of them trigger a vendor assessment. The documented incidents, the measured scale, and the controls that close the gap before CPS 230 makes it an audit finding.
- Supply chain
- Third-party risk
- AI agents
6 min read
Third-party risk after the supply-chain attack era
Most third-party risk programs in mid-market financial services are questionnaire factories. They produce paperwork; they do not produce risk reduction. After several years of supply-chain incidents, the realistic position has changed. Here's what actually works.
- Supply chain
- Third-party risk
- Vendor management
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.