When the Storm Hits Everyone at Once: Geopolitics, Shared Dependencies, and Collective Digital Resilience - Wednesday, October 28 at 2pm ET Please join the GRF Business Resilience Council for a panel discussion featuring Next Peak's Greg Rattray and other authors of the new book "Understanding Digital Resilience: Foresight and Navigation through Cyber Heavy Weather" as they discuss the journey towards digital resilience in a geopolitically charged environment. Register here for the complimentary webinar: us02web.zoom.us/webinar/regi… The most critical digital disruptions of the past year weren’t attacks on one company. They were attacks on shared dependencies that rippled across sectors and borders. In 2025, a single cyber-attack shut down a car maker’s plants in five countries, cost the UK economy an estimated £1.9 billion, and pulled the British government into an unprecedented loan guarantee to protect suppliers and customers. A cyber incident caused a similar impact in the aviation industry: check-in, bag drop, and gate assignments across Europe were consolidated onto shared MUSE software, creating heavy concentration risk, and when software was targeted by ransomware, the disruption contributed to at least 217 flight cancelations. Both examples illustrate the dangers that exist when layered threats are brought to bear by geopolitically motivated threat actors.

Thank you to our Gold Sponsors of the 9th Annual Summit on Security & Third-Party Risk! We're grateful for their support of this year's summit. If you’re not already registered, join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026

Thank you to our Booth Sponsors of the 9th Annual Summit on Security & Third-Party Risk! Without the support of these organizations this event could not exist. In-person engagement is critical for developing trust, advancing relationships, and strengthening our mutual resilience through collaboration. Attendees, be sure to stop by their booths to say hello next week! Learn more and register here grf.org/summit2026

Join us for the 9th Annual Summit on Security & Third-Party Risk! Emma Stevens and Scott Simpson of @Bitsight will present “The Threats You Inherit: AI, Adversaries, and the Future of TPRM.” Session abstract: Organizations do not choose every cyber threat they face. A supplier caught in geopolitical conflict, a partner targeted by ransomware, or a vendor with privileged access can bring new threats into your organization. As AI accelerates attacks across connected supply chains, this session explores how third-party risk and threat intelligence can reveal the adversaries targeting your ecosystem, what motivates them, and where your vendors’ exposure could become your own. - Spot geopolitical, ransomware, and access risks across your vendors. - See how AI accelerates supply chain threats. - Combine third-party risk and threat intelligence to identify adversaries and prioritize exposure. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. #tprm #cybersecurity #riskmanagement #resilience #ai

Thank you to our Platinum Sponsors of the 9th Annual Summit on Security & Third-Party Risk! Your partnership helps bring together security and risk leaders from across industries to share expertise and best practices. If you’re not already registered, join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026

Thank you to our Diamond Sponsor of the 9th Annual Summit on Security & Third-Party Risk! Your support helps strengthen defense across sectors through third-party risk and cybersecurity education. If you’re not already registered, join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026

Now available for download is the September issue of the GRF monthly newsletter. In this issue you will find info about the @K12SIX call for speakers, webinars on CMMC and quantum cryptography, an ISSA event on resilience, and joint @FSISAC and @LS_ISAO guidance for law firms, among other news: grf.org/newsletter

Join us for the 9th Annual Summit on Security & Third-Party Risk! Anil Karmel will present “The Evolution of Mythos and Next-Gen Cyber Threats.” Session abstract: AI-assisted cyber operations used to be a theoretical worry. In 2026 they became a practical one. Anthropic's Claude Mythos showed that a frontier AI model can find and exploit software vulnerabilities on its own, at a speed and scale that used to take skilled human teams. This session will briefly cover Mythos developed, from early capability evaluations to its restricted, defense-first release, and will ask what it means for the threat landscape. We'll look at how AI-driven vulnerability discovery shrinks the time between disclosure and exploitation, why patching cycles and traditional defenses are under new strain, and what happens as similar capabilities spread to less careful actors. Attendees will leave with a clear picture of the next generation of AI-enabled threats and practical priorities for adapting: faster remediation, AI-augmented defense, and rethinking risk models for an environment where machines attack and defend at intense speed. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. #tprm #cybersecurity #riskmanagement #resilience #ai

Join us for the 9th Annual Summit on Security & Third-Party Risk! Ryan Patrick of @HITRUST will present “Rethinking Vendor Due Diligence: When Cyber Threats Outpace Traditional Assurance.” Session abstract: Cyber threats are evolving faster than traditional vendor assurance models can keep pace. As organizations become increasingly dependent on complex digital ecosystems, cloud platforms, AI-enabled technologies, and interconnected third-party relationships, many risk programs still rely on static questionnaires, point-in-time assessments, and compliance-driven reviews that provide limited visibility into real-world risk. This session explores why conventional approaches to vendor due diligence are becoming less effective in a rapidly changing threat landscape and examines how organizations can adopt risk-centric, continuous assurance models that better reflect current conditions. Attendees will gain practical insight into managing ecosystem risk across healthcare and digital environments, understanding where compliance ends and resilience begins, and leveraging modern assurance approaches to deliver decision-ready insights. The result: greater confidence, stronger resilience, and the ability to support innovation without increasing organizational exposure. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. #tprm #cybersecurity #riskmanagement #resilience #ai

We are 3 weeks out from the Summit on Security & Third-Party Risk. We hope you’ll join us in sunny Orlando for a few days of networking, education and vendor demonstrations as we work together to strengthen resilience in the face of emerging cyberthreats. Join us to see how your peers are managing third-parties, integrating AI, and preparing for future attacks. Read more about the conference here: grf.org/summit2026

GRF partner @ISSAINTL is hosting the Cyber Resilience Awareness Day Virtual Summit on October 14, 2026. This free event will deliver clear, actionable insights on what being cyber resilient really means and how to move beyond buzzwords or regulatory requirements to build it into your systems from the start. Learn more and register here: issa.brighttalk.com/summit/8…

Join us for the 9th Annual Summit on Security & Third-Party Risk! Tushar Badlani of Figma will present “Stop Repeating Yourself: Building a Pooled Audit Program That Regulators and Customers Both Trust.” Session abstract: Regulated financial services firms are required to assess their critical outsourced technology providers under frameworks including DORA, APRA CPS 230 and 234, NYDFS 500, RBI Outsourcing Guidelines, and OSFI B-10. Yet the traditional approach is one customer, one audit—leading to repeated reviews, duplicated effort, and a growing burden for both sides. What if multiple regulated customers could audit the same control environment together? This session explores how to build a pooled audit program: a structured, multi-day audit in which multiple customers participate simultaneously. This is not a trust portal or a webinar, but a real audit designed to satisfy regulatory requirements. We’ll cover what it takes to gain regulatory acceptance, which controls matter across frameworks, how to navigate legal and confidentiality challenges, and what separates a regulator-accepted audit from one that simply provides information. Attendees will leave with a practical framework for designing, piloting, and scaling a pooled audit model, based on real-world experience across DORA, APRA, NYDFS, and multiple customer groups. No vendor pitch here! Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. #tprm #cybersecurity #riskmanagement #resilience #ai

Agentic Attack A virtual tabletop exercise Wednesday, September 30 at 1:00 PM ET Agentic Attack is a decision-driven exercise tackling a fast-moving, AI-enabled cyber threat campaign. The exercise prioritizes operational resilience and organization decision-making. Attendees will engage an adaptive scenario where their selections change the outcome of the attack, live. A panel of seasoned security and resilience practitioners will examine the results and provide their thoughts and expertise. All participants will receive an After-Action Report with key findings and recommended actions. Exercise experts include: -Charles Blauner of Crosspoint Capital Partners -Gadi Evron of @cloudsa -JD Denning of @FSISAC -Adriana Stephan of @fmf_org -Kristy Hornland of KPMG -Mark Orsi of Global Resilience Federation *Technical detail creates pressure in the scenario, however it is not the subject of the exercise. Participants will work with incomplete information, competing business priorities, and an adversary that changes its approach as the incident develops. Learn more about the complimentary event: grfbrc.org/aattx

Join us for the 9th Annual Summit on Security & Third-Party Risk! Jeff Zingler of @magnitude_hq will present “Seeing Isn't Solving: The Case for Agentic Risk Reduction.” Session abstract: The third-party risk industry has spent a decade getting really good at one thing: producing information. Faster questionnaires. Deeper software bills of materials. Richer runtime telemetry. And yet breaches keep coming from the same place they always have, vendors and vendors' vendors nobody ever really assessed, findings nobody ever really fixed. This talk argues that TPRM has an action problem, not a visibility problem, and shows what happens when AI agents stop stopping at the report and actually remediate threats autonomously. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. *Note that the hotel room block closes tonight at 11:59 PM ET. #tprm #cybersecurity #riskmanagement #resilience #ai

9th Annual Summit on Security & Third-Party Risk October 21-23, 2026 Loews Sapphire Falls Resort Join us in Orlando for sessions on TPRM, supply chain security, geopolitical threats, managing AI risk, incorporating AI, and cyberthreat intelligence best practices. Read abstracts, view the agenda and register here: grf.org/summit2026. And book a room before the hotel block closes tomorrow, September 25th, at 11:59 PM.

Join us for the 9th Annual Summit on Security & Third-Party Risk! Brenda Albeño of @Loeb_LoebLLP and Ben Quam of @conveyor will present “How Loeb & Loeb rebuilt their TPRM program with an AI Agent.” Session abstract: Vendor risk assessments used to mean weeks of manual work: chasing documents across trust centers, reviewing security questionnaires, and tracking down compliance information. Loeb & Loeb's old tool promised automation, but it delivered neither speed nor completeness. Then they switched to AI agents. Now their vendor risk assessments are done in minutes. In this session, Brenda shares what changed: how AI agents actually work for TPRM, why she trusts Clear’s TPRM agent, and what you need to know before your team tries this. You'll see the agent in action: how it conducts real assessments, catches what the old tool missed, and actually helps your team assess vendor risk rather than chase down SOC 2’s. For TPRM & GRC teams tired of manual assessment work, learn how to rebuild your own TPRM program with AI. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. *Note that the hotel room block closes on September 25th. #tprm #cybersecurity #riskmanagement #resilience #ai

Join us for the 9th Annual Summit on Security & Third-Party Risk! Andrew Moyad of @SA_Program will present “How Does Your TPRM Program Stack Up?” Session abstract: This is a facilitated session where attendees can identify the material program areas that reflect their level program maturity and where they can focus their next efforts — remediation SLAs, assessment frequency, board reporting, AI governance, concentration risk visibility, etc. Results will be discussed as a group in this live interactive session. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. *Note that the hotel room block closes on September 25th. #tprm #cybersecurity #riskmanagement #resilience #ai