Session 15 · ERQI Global Virtual Risk Summit
Beyond the number: CRQ operating models and the integration of TPRM
Julien Chamonal & Bob Maley, moderated by Andrew Shea
Overview
Third-party risk management (TPRM) has long ranked vendors by spend and run them through questionnaires, and Bob Maley and Julien Chamonal argue that neither supports a real decision. Quantifying the loss a supplier could cause, tied to the business process it supports, gives the business owner something to decide on. In this session, moderated by Andrew Shea, they worked through scenarios, data access, concentration and AI.
Session 15 recording, ERQI Global Virtual Risk Summit 2026
Start from the decision
Maley framed the work through OODA (observe, orient, decide, act), which he describes as a strategic decision process rather than a loop. Assessments and continuous monitoring are observation. Quantification belongs in orientation, where a team may find it lacks enough information and goes back to collect more. In TPRM, he said, the riskiest third parties have usually been defined by spend, rarely by real business impact. Chamonal agreed from the buyer's side. Questionnaires are now often filled by AI or copied from last year, and no one can decide on them. The person who decides whether to keep a supplier owns the process that relies on it, not the CISO, and "the business owner will never understand cyber. They will understand money." He added that the decision framework should be set before the analysis, so the quantified result can go forward for sign-off.
Scenarios and data
Shea pressed on a gap in first-party analysis. A ransomware scenario against a financial system changes once that system turns out to be a SaaS application. Chamonal treats third parties as assets and entry points, simulating whether an attack would succeed against a supplier's posture and how it could propagate into the client's systems. Maley said automated FAIR scenarios tend to be static, and that AI changed his approach this year. He now drafts scenarios in Claude, building on the FAIR-CAM files Jack Jones made public. Both said internal control data is hard to get, since CISOs and their attorneys rarely allow it. Chamonal described European banks using the Digital Operational Resilience Act (DORA) to request security policies, penetration test results and business impact analyses from critical vendors, which are parsed to pre-fill questionnaires and feed an attack-and-defense model. Maley called external ratings a "temperature," useful for telling vendors apart at onboarding but of limited value for ongoing risk. He described a ransomware algorithm built on the roughly 25 to 30 controls attackers repeatedly target, checked against four years of real incidents.
They differed on threat intelligence. Citalid's founders were threat intelligence analysts and built their own team to feed quantification, because Chamonal sees a number without trusted frequency inputs as hard to defend to a board. Maley advised most organizations not to build, but to find a strong provider and compare it honestly. For those without budget, he pointed to free sources such as Black Kite's Focus Friday and CISA, and Chamonal recommended insurance claims reports, which reflect real breaches and real losses.
Concentration, accumulation and AI
Chamonal said concentration cannot be automated. It takes conversations with the people who know the process, because spend as a proxy can rank the coffee machine supplier above an inexpensive invoicing system the company depends on for revenue. Maley worries more about vendors' vendors and cascading failure, citing an AWS DNS configuration failure earlier this year that reached his own company through its bank. Chamonal introduced accumulation, the reinsurance view built on catastrophic scenarios, and judged it early for most enterprises. His advice was to triage third parties and model the critical ones first. On AI, neither claimed an answer. Without control data, Chamonal said, modeling is guesswork that defaults to the worst case. Maley assumes every vendor uses AI: "I don't ask anymore, 'Do you have AI?' I go, 'What AI?'" He advised against sending the NIST AI RMF questionnaire in favor of a shorter set of questions.
“The business owner will never understand cyber. They will understand money.”
Julien Chamonal, on who decides whether to keep a supplier
Key takeaways
1
Map suppliers to business processes
Rank third parties by the process they support and the loss if they fail, not by spend. Agree the decision framework before the analysis so the result can go forward for sign-off.
Watch at 14:042
Put the decision in front of the business owner
The process owner, not the CISO, decides whether to keep a supplier, and money is the language that owner understands.
Watch at 8:303
Write third parties into scenarios
Treat suppliers as entry points from which an attack can propagate into your own systems and cause losses.
Watch at 21:464
Use the data you can obtain
Regulation such as DORA can open access to internal documents from critical suppliers. External scans still help, mainly at onboarding.
Watch at 29:005
Count scenarios per vendor
Shea suggested asking how many of your top ten risk scenarios a third party touches, as a way to prioritize vendors.
Watch at 1:00:45
