Join us for the 9th Annual Summit on Security & Third-Party Risk! Brenda Albeño of @Loeb_LoebLLP and Ben Quam of @conveyor will present “How Loeb & Loeb rebuilt their TPRM program with an AI Agent.” Session abstract: Vendor risk assessments used to mean weeks of manual work: chasing documents across trust centers, reviewing security questionnaires, and tracking down compliance information. Loeb & Loeb's old tool promised automation, but it delivered neither speed nor completeness. Then they switched to AI agents. Now their vendor risk assessments are done in minutes. In this session, Brenda shares what changed: how AI agents actually work for TPRM, why she trusts Clear’s TPRM agent, and what you need to know before your team tries this. You'll see the agent in action: how it conducts real assessments, catches what the old tool missed, and actually helps your team assess vendor risk rather than chase down SOC 2’s. For TPRM & GRC teams tired of manual assessment work, learn how to rebuild your own TPRM program with AI. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026. *Note that the hotel room block closes on September 25th. #tprm #cybersecurity #riskmanagement #resilience #ai

Summit on Security & Third-Party Risk October 21-23, 2026 Loews Sapphire Falls Resort at Universal Orlando Read abstracts, view the agenda and register here: grf.org/summit2026. And book a room before the hotel block closes on September 25th and prices double/availability is no longer assured. Sessions include: •"Frontier Defense" Mike Aiello — @OpenAI •"Crafting Useful Scenarios to Forecast and Mitigate Geopolitical Risk" Sam Lichtenstein — @RANEnetwork •"The Glue That Connects Your Security Programs: How Effective CTI Enables More Than an IP Blocklist" Joshua Caldwell — @CovingtonLLP •"Data Resiliency in a High-Velocity Digital Economy" Prateek Agrawal — @Centene •"Deep Dive — Top 3 Observed Initial Access Tactics" Tyler Curry — @HealthISAC •"Evaluating and Transferring Risk Up and Down the Supply Chain" Christopher Keegan — @brownbrowninc •"Revolutionizing Cyber Third Party Risk: An Integrated Approach for the Future" Brenda Ferraro — @abbvie •"Risk and Dependency in the AI Era: Lessons from AI Interrupted and the Evolving AI Threat Landscape" Jim Routh — formerly Aetna, MassMutual, CVS; Byron Collie — Next Peak; Simon Chard — Pulsar Consulting; Mark Orsi — GRF; Brian Katula — GRF •"Escaping the Matrix: When AI Agents Run Your TPRM (And What Happens If Agent Smith Goes Rogue?)" Sagar Sudhir Behere — @circle •"Cascading AI: How Concentration and Interdependence Redefine Third-Party Risk" Bob Kolasky — @ExigerLLC •"Operationalizing AI in Third-Party Risk: Driving Speed, Scale, and Smarter Decisions" Aisha Sims — @Intuit, Inc. •"Vendor Questionnaires Can't Handle AI: Rebuilding Third-Party Risk Management for the Agent Era" Aakash Abhay Yadav — formerly Roblox •"The Next Generation for TPRM Built on Near Real-Time Data Sources" Jim Routh — formerly Aetna, MassMutual, CVS •"Quantum Threat Intel Meets Privacy Regulation: The Convergence Your Risk Program Isn't Ready For" Cory Missimore — @AIRInforms •"From Zero Trust to Third-Party Trust: Applying Modern Architecture to Vendor and Cloud Risk" Sanat Pattanaik — @ADP •"Assumed Breach: The Hidden Design Flaws Embedded in Conventional Emergency Communications Plans" Matt Calligan — @ArmorText; Jon Schlegel — @Clear •"A Dynamic Blueprint: Building and Developing an Information Security Program" Jeremiah Salamon — @ChoateLLP •"Third Party Risk — From Inception to Maturity" Jude Ejiobi — JB Poindexter & Co. •"Mitigating Threats to the Seabed: Cybersecurity Strategy for Subsea Critical Infrastructure" Lance Dubsky — @QuintillionNet •"TPRM 2.0: AI, Trust, & Operational Resilience" Julie Gaiaschi — Third Party Risk Association (TPRA) •"The New Front Line: Data Centers - Targets of War, Proxies & Extremists" Chris Denning — GRF •"AI Resilience and Collective Defense" GRF AI Working Group Join us in Orlando, October 21-23, 2026. Learn more: grf.org/summit2026

Join us for the 9th Annual Summit on Security & Third-Party Risk! Joshua Caldwell will present “The Glue That Connects Your Security Programs: How Effective CTI Enables More Than an IP Blocklist.” Session abstract: Cyber threat intelligence creates value when it reaches the teams positioned to act on it. Many organizations already have some form of CTI activity underway such as a threat feed subscription, an analyst monitoring alerts, participation in an ISAC, but that activity often stays siloed and never reaches vulnerability management, security awareness, or security operations in a way that changes what those teams do day-to-day. This session is for organizations in that position—CTI exists somewhere in the building, but it isn't connected to anything. This session makes the case for treating CTI as connective infrastructure rather than a standalone capability. Attendees will walk through how a functioning CTI lifecycle sharpens vulnerability prioritization beyond CVSS scoring, keeps security awareness content grounded in what threat actors are doing rather than generic best practices, and gives security operations teams something specific to hunt for instead of everything at once. Participants will see how this connective approach plays out in practice: cross-functional collaboration improves when intelligence flows between security operations, vulnerability management, and business units, proactive threat anticipation reduces incident response times, and contextualized intelligence supports risk-based decision-making across teams that otherwise operate in silos. Join us at the Loews Sapphire Falls Resort at Universal Orlando, October 21-23, 2026! Learn more and register here grf.org/summit2026 #cybersecurity #CTI #riskmanagement #tprm #resilience #isac #cvss

The Business Resilience Council will hold the 3rd Annual Virtual Summit on June 10, from 10am-4pm ET. The complimentary, multi-sector event features speakers discussing topics relevant to all-hazards threats. Sessions include: -The Iranian War & Energy Market Impacts on US Allies -Are We Already Behind? AI, Q-Day, and the Race for Resilience -Mythos: Risk, Reward, and Project Glasswing’s Scope -AI Interrupted and What to Do Next: a TTX After Action Review More sessions to come! Register here: grfbrc.org/virtual2026

Now available for download is the October issue of the GRF monthly newsletter. In this issue you will find info about an upcoming webinar on incident recovery, an announcement about a new tool for GRF-affiliated members, and the incorporation of the Operational Resilience Framework into the Shared Assessments SIG, among other exciting news: grf.org/newsletter-october-2…

Thank you to the LS-ISAO Annual Gathering Sponsors and our Seat Drop Sponsor of the Summit on Security & Third-Party Risk. Without the support of these organizations this event could not exist. In-person engagement is critical for developing trust, advancing relationships, and strengthening our mutual resilience through collaboration. Attendees, be sure to stop by their booths to say hello next week! Summit homepage: grf.org/summit2025

Join us for the 8th Annual Summit on Security & Third-Party Risk! Nick Panos of @googlecloud will present "Winning the Resilience Race: Outpacing Risk in the Age of AI and Automation." Session abstract: The modern digital risk landscape is not just evolving—it is accelerating. Fueled by AI-powered threats, sophisticated supply chain attack techniques, and significant geopolitical volatility, the critical questions now revolve around when, and how often, major disruptions will occur. Traditional approaches to business continuity and cybersecurity are not enough to keep pace. The new imperative is cyber resilience: the ability to anticipate, withstand, recover from, and adapt to adverse conditions. This session moves beyond the buzzwords and delivers an actionable framework for building and accelerating digital resilience within your organization. We will discuss the key pillars of a modern resilience strategy, from proactive threat anticipation and defensible architecture to rapid response and adaptive recovery. Drawing on real-world case studies, you will learn how to shift your organization's mindset from reactive defense to proactive readiness, ensuring your critical business functions remain fortified against the next major disruption. We hope to see you at the Palms in Las Vegas, November 3-5. Learn more and register here grf.org/summit2025

Listen to Jim Routh, a former CSO/CISO at multiple Fortune 500 companies, discuss the benefits of attending the annual Summit on Security & Third-Party Risk. Learn more and join us in Las Vegas from November 3-5, 2025: grf.org/summit2025 youtube.com/watch?v=D5um9_rP…

Summit on Security & Third-Party Risk Nov. 3-5  |  Las Vegas Why Now: Tighten third-party risk, resilience, and compliance before 2026 audits and board meetings Outcome: Peer-tested TPRM workflows and improvements & cybersecurity insights CPEs: Attendees self-report 10+ hours of education Who Attends: CISOs, CSOs, directors of cybersecurity and TPRM, compliance teams, risk managers, security analysts Urgency: Four weeks until the room block closes and you have to stay offsite Register: grf.org/summit2025