When Did Slack Become Riskier Than Your Cloud Provider?

Most vendor approvals are treated as permanent, yet the vendor you signed off on last year may have since shipped AI features, added a data processor, and quietly expanded its access with a single click from one of your employees. In "Hacking the Third-Party Risk Management Assumptions that AI Broke: An hour of critical thinking about what's changed in how we assess who we do business with," we talked about how AI capabilities are spinning up in your environment all the time.

HUGE thanks to our sponsor, Nudge Security Watch the full video here Watch the demo video here Join us next Friday, November 6th, 2026, for “Hacking AI FOMO” Super Cyber Friday will be back Friday, November 6, 2026, for our discussion “Hacking AI FOMO: An hour of critical thinking about what it costs to say yes before security has answers.” It all starts at 1 PM ET/10 AM PT.

SUBSCRIBE FOR THE WHOLE SERIES: Or register once for every upcoming Super Cyber Friday event. No need to sign up week to week. Couldn't join us live on Friday?

We saved the best parts for you. Super Cyber Friday Express is the podcast version. It’s only 20 minutes and ready on Fridays after our live show.

The shortened version of the show gets you the key points on demand, but the full experience only happens LIVE in the room. Subscribe to Super Cyber Friday Express You can subscribe to Super Cyber Friday Express and all the CISO Series shows at cisoseries.com/subscribe . Did you know that we have an events calendar?

Visit our events page to subscribe (look at the dropdown in the upper right) so you can stay up to date on Super Cyber Friday and other CISO Series content. Best quotes from our guests “When you take a step back and look at the TPRM process, it’s for de-risking rubber suppliers in Brazil.

It’s a static point-in-time assessment with an assumption of a static supply chain. But when we get into this modern era, we’re literally delegating huge chunks of our business out to some SaaS app or some AI tool.” - Russell Spitler, Nudge Security “People do try to explain, ‘Hey, we’ve updated this,’ but what’s not always obvious is did I use that new fun thing in my environment?

Did it change what I was doing? Maybe the product didn’t change, but my use case changed. I think that’s the part that really gets missed.” - Jack Leidecker, Gainsight “People think about Slack as a chat app, but the modern Slack ecosystem is probably hooked into your HR system, is probably hooked into your GitHub system, is probably hooked into some IT service desk system to support password changes.

This is a very connected app with a lot of proxied access to very sensitive data across your organization.” - Russell Spitler, Nudge Security “There’s not a good way to say AI is not in something anymore. If it’s SaaS, I can tell you it is. Pretty much everything’s gonna have some form of AI at this point, so I think the challenge is that was kind of the stopgap we had a couple years ago.” - Jack Leidecker, Gainsight “The vision that I look at in questionnaires is it shouldn’t be how you start the conversation.

Get their information. Everybody’s got a lot of public information about their security program. Take a look at their history, take a look at what their app does, take a look at those questionnaires, and figure out what five to 10 questions you should be asking them given that context.” - Russell Spitler, Nudge Security “Just because they got the checkbox into the trust center, it doesn’t talk about how you’re integrating with it, what access you’re giving them, what’s the business gonna be doing with it, how do you monitor what’s going on with it?

So yeah, I do think that has been a big false sense of security from my perspective.” - Jack Leidecker, Gainsight Quotes from the chatroom "SalesForce did this recently - they introduced AI into their Slack platform to 'train' their response models. The opt-out method was buried into the Terms & Conditions...

It was a general e-mail address!" - Aman S. , Centrica Energy "I'd wager that MCP could be easier to secure than generic filesystem and network access to the same tool calls." - Gary Longsine , illumineX "We have let the genie out of the bottle and now it's giving us what we asked for over what we wanted🧞" - James S. , Sr.

DevSecOps Engineer "There is no false sense of security. Any experienced security profession or CISO sees TPRM for what it is and how badly it is broken." - Steve Gentry , Cognate Cyber "Would be great if those in charge of regulation and governance, actually understood what they were regulating and governing,,, just sayin' We could start there." - Jim L. , Spectrotel #ARG”: What’s your gripes about TPRM assumptions?

"Business thinks it only take a few minutes to do the assessment so we get the request on today (Last Day of the Month)" - Dr. Dustin Sachs DCS, CISSP, CCISO , PsyberCog Labs "My biggest frustration is when security gets involved after the vendor decision has effectively been made.

At that point, we’re working backward to understand what data the vendor needs, what access is appropriate, and who owns the ongoing risk" - Jim L. , Spectrotel "Most TPRM questionnaires are a rehash of SOC2 or ISO controls and not about asking the questions to understand risk." - Steve Gentry , Cognate Cyber