Beyond The Security Rating: Building a Third-Party Risk Score You Can Defend (Nov. 5th)
Thursday, November 5th, 2026: 2:00 PM to 3:00 PM
This session shows how to build a third-party risk score that a security team can defend. We'll walk through a model that combines inside-out control data with outside-in signals from perimeter scanning, threat intelligence, and vulnerability monitoring, and weights each control by its mapping to Common Weakness Enumerations (CWEs).
Virtual
When a critical vulnerability is disclosed, most security teams can't quickly answer two questions: which third parties run the affected technology, and which of them have the controls to contain it? Questionnaires are months old by the time anyone reads them. External security ratings see a vendor's perimeter but not the controls behind it. Teams end up running a fire drill across the whole portfolio.
Then we'll show how to put that score to work: triaging vendors at onboarding, scoping assessments to the weakest control domains, and turning a newly published Common Vulnerabilities and Exposures (CVE) entry into a short, prioritized list of third parties to assess.
Attendees will learn:
- Where outside-in security ratings fall short, and what control-level data adds
- How CWE-weighted control scoring makes a risk score explainable and audit-ready
- How to map a newly published CVE to exposed, weakly controlled third parties at disclosure, not at the next review
- How one five-person team covers more than 4,000 third parties, and warned a partner about a breach before it happened
Hosted by Black Hat