Day Two | October 15
Here is the latest edition of the agenda. As we approach the event, we will be adding speakers and sessions to enhance your experience. To stay informed, please register your interest
 | Brian Shaw,GTM Leader,Coverbase |
Key topics
- How to design or update a criticality and tiering model that matches current realities
- Ways to connect criticality to assessment depth, monitoring, and testing requirements
- Examples of how revising tiers shifted program focus toward higher-risk relationships
 | Fusako Nitta (Menna),Director, Operational Risk and TPRM,Daiwa Capital Markets |
In this session, we introduce Hyper TPRM — a modern approach to third-party risk management built for scale. Hyper TPRM moves beyond questionnaire-driven processes by combining data-first intelligence, workflow, community-powered exchange models, and AI acceleration, with human confirmation where it matters most.
Join us to learn how organizations are evolving their TPRM programs to:
Key topics
- Prioritize vendors using dynamic, explainable risk insights
- Leverage shared, validated assessment data to reduce friction for vendors and internal teams
- Apply AI to accelerate assessments, validate evidence, and expand portfolio coverage
- Shift from point-in-time reviews to continuous, risk-based monitoring
If you’re looking to modernize your TPRM program without compromising rigor, this session will show how Hyper TPRM enables faster decisions, broader coverage, and greater confidence across the entire third-party lifecycle.
 | Ed Thomas Jr,Senior Vice President,ProcessUnity |
Key topics
- How to identify where third-party services intersect with critical infrastructure
- Additional resilience testing, documentation, and oversight that are used in these contexts
- Examples of coordination with regulators or sector bodies on critical third-party resilience
 | Brian Katula,Director of Operational Resilience,Global Resilience Federation / Business Resilience Council |
Key topics
- Typical sources of downstream risk behind primary third-party services
- Tactics for gaining useful visibility through contracts, questionnaires, and data sources
- Ways to determine where deeper fourth-party analysis is warranted
 | Daniel Philemon,Product Marketing Manager,Aravo |
 | Harvey Brice,Senior TPRM Advisory Consultant,Aravo |
.
TBC..
 | Brain Shaw,GTM Lead,Coverbase |
Key topics
- Examples of resilience metrics linked to readiness and performance
- Ways to keep resilience reporting focused while providing sufficient detail
- Approaches for tailoring resilience metrics for senior leaders and operational teams
 | Laura Arnott,Director,Vigilant LLC |
Key topics
- How to identify and map cloud related dependencies across a vendor portfolio
- Questions and evidence to request around resilience, failover, and incident management
- Ways to frame cloud concentration risk and potential mitigations for internal stakeholders
 | Mark Carroll,Founder – Graduate ERM Program,Boston University |
Key topics
- Where automated decision-making commonly appears in vendor offerings
- Types of risk that arise when automated decisions are not transparent or well controlled
- Practical evaluation and oversight steps for automated decision engines
 | Jude Ejiobi,Cybersecurity Risk and Resilience Manager,J.B Poindexter & CO |
Continuous monitoring improved visibility, but often made alerts arrive faster without improving action. This session examines how AI can turn risk policies into executable rules, interpret vendor signals and respond consistently. Attendees will explore where automation creates value, where human judgement must remain and how to measure programme maturity by what AI can act on—not only what it monitors.
Takeaways:
-
Ingestion is commoditized
-
Policy is the asset
-
Actionability beats visibility
-
Human judgment moves up, not out
 | Ken Liao,VP of Product,Magnitude |
Key topics
- Techniques for summarizing complex risk information in a clear and concise way
- Ways to frame options and recommendations so leadership can decide more quickly
- Examples of how improved framing led to different decisions on vendors, controls, or investments
 | Francesco De Lucia Dattolo,TPRM Program Manager,SLB |
 | Narahari (Hari) Rao,Global Supply Risk and Resilience Director,SLB |
Key topics
- Concrete AI use cases already in play in TPRM, what they delivered, and where automation alone was sufficient
- Common pitfalls tied to data quality, messy processes, and unclear ownership, and how human-in-the-loop controls help keep outcomes reliable
- Simple criteria practitioners can use to decide which AI ideas are worth piloting or scaling, and how to set realistic expectations with stakeholders
 | Johnathan Bald,SVP Global Sales Lead,Black Kite |
 | Matthew Ridenhour,Senior Manager, Compliance Operations,UKG |
 | Kaci Johnson,Director, Risk Managemet,Nelnet |
Key topics
- Key governance elements regulators and standards bodies expect to see in mature TPRM programs
- How to define and document roles, decision rights, and escalation paths so governance works in day-to-day operations
- Practical steps for shoring up TPRM governance, even in developing programs, to reduce compliance risk and close gaps between policy and practice
 | Tamara Culler,Risk Executive and Former OCC Director of Governance and Operational Risk Policy,Independent |
- Extended networking lunch
- Meetings with peers, speakers and sponsors
- Networking lounge and exhibition area
- Limited to 30 attendees per room
- Advance sign-up required
- Interactive peer-to-peer discussion format
Magnolia 3 – 4
Trust is the fundamental bedrock of society, historically anchored in personal reputation and face-to-face interaction. However, the rapid acceleration of artificial intelligence and distributed technology is necessitating a critical paradigm shift from human-centric trust to digital trust. While digital trust requires more rigorous management, it is not inherently riskier than human trust; in fact, Zero Trust principles mitigate the dangers of misplaced human trust by replacing implicit assumptions with continuous verification.
This discussion, led by Dr. Jayne Suess, will explore the evolution of zero trust leading to the June 4, 2026, approval of the landmark IEEE Zero Trust Framework Security Standard. Participants will learn how the industry experts collaboratively developed eight specific domains of Zero Trust to counter escalating nation-state and hacktivist threats, shifting the global security landscape from a traditional perimeter mindset to a formalized, resilient architecture. A detailed view into key expected implementations within each domain and applicability to third party risk will be shared.
 | Dr. Jayne Suess,Consultant,Independent Consultant |
Magnolia 5 – 6
Many vendors are now adding AI features to existing services, sometimes faster than TPRM practices evolve. This session looks at how TPRM teams are adapting due diligence, contracts, and monitoring to address AI use by third parties. It focuses on practical changes to existing processes that help identify, evaluate, and oversee AI-related risks without starting from scratch.
- Key risk considerations when vendors incorporate AI into their services
- Updates to due diligence content and contract language that cover AI topics
- Approaches for monitoring AI-related aspects of a vendor relationship over time
 | Ryan Patrick,EVP, TPRM Customer Solutions,HITRUST |
Oak 1
Growing assessment volumes are prompting interest in automation, but many teams are concerned about maintaining governance and judgment.
This session looks at where automation has been effective in managing assessment workload and where human review remains essential. It provides examples of assessment designs that use automation for efficiency while preserving clear ownership of key risk decisions.
- Parts of the assessment process that are well suited for automation
- Guardrails and checkpoints that keep governance and accountability clear
- Example workflows showing how automation changed both speed and overall quality
 | Freshta Atiqi,TPRM Leader,Independent Consultant |
Oak 3
- Explore practical methods to map vendor interdependencies and uncover hidden risk concentrations across the enterprise.
- Apply a structured framework to rank and tier vendors by criticality, enabling smarter prioritization of oversight and mitigation efforts.
- Analyze high-risk vendor scenarios and design actionable contingency and escalation strategies aligned to executive decision-making.
- Incorporate workshop outputs into dashboards and reporting frameworks that enhance board-level visibility and governance effectiveness.
 | Julie Gaiaschi,CEO & Co-Founder,TPRA |
Key topics
- Identify hidden third-, fourth-, and nth-party dependencies within agentic AI ecosystems.
- Recognize emerging operational and concentration risks that traditional TPRM processes may overlook.
- Explore practical approaches to strengthen resilience and governance across AI-enabled third-party environments.
- Understand how evolving regulatory expectations are shaping oversight of AI-supported services.
 | Naresh Raheja,Former OCC, Senior Risk Specialist,Independent |
Leveraging Threat Intelligence to Reduce Cyber Risk from Third Parties
In this interactive learning session, Scott Schneider will explore ideas to reduce this negative trend. Attendees will learn a practical framework for moving from focusing primarily on third party posture management (using self-assessments, security ratings, SOC II, etc.) and strategies to incorporate cyber threat intelligence data. Schneider will also explore ways to act before a third-party event becomes your incident.
Using a real-world scenario, the session will examine how threat intelligence can be combined with third party posture management tools toidentify a critical third party that is being actively targeted by an AI enabled cybercriminal.
Key topics
- If 48% of my incidents and breaches involve a third party, what strategies can we use to reverse this trend?
- How can observing threat signals a helping security teams distinguish noise from meaningful adversary activity, determine organizational exposure, establish response ownership, and act before a third-party event becomes their incident.
- How does incorporating cyber threat intelligence into our third-party ecosystem work from an operational perspective? Where does it fit in our current TPRM process?
- How do we quantify the value of incorporating cyber threat intelligence into our TPRM program?
 | Scott Schneider,Partner,iCOUNTER |
In this session, you’ll discover practical strategies for building stronger supplier partnerships while leveraging Artificial Intelligence to identify emerging risks, analyze contracts, monitor supplier performance, and uncover opportunities for innovation and continuous improvement. You’ll leave with actionable ideas to strengthen governance, enhance decision making, and build trusted supplier relationships that deliver measurable business value and reduce risk.
Key topics
- What differentiates a truly strategic supplier relationship from a transactional one, and how can AI help strengthen that relationship?
- How can organizations leverage AI to identify supplier risks earlier while maintaining trust, transparency, and accountability with their suppliers?
- If AI could eliminate one manual activity in your supplier management process tomorrow, what would create the greatest business value for your organization?
- Where do you see the greatest opportunity for AI within Supplier Relationship Management over the next three years?
 | Mariano Rivera,Technology and Business Transformation Leader,Enterprise initiatives across large retail and financial service organization |
 | (Moderator) Matthew Langlois,VCLM Advisor,Gatekeeper |
 | Elizabeth Blosh-Myers,VP/Director Third Party Risk Management,Thread Bank |
 | Ryan Hesser, VP TPRM & Legal Counsel,VyStar Credit Union |
 | Kristen Thomas,Director,ComplyIQ, Former JP Morgan Chase |
 | Tim Harvey,Procurement Director,CompSource Mutual Insurance Company |
Key topics
- How AI and automation will redefine third-party ecosystems
- The rise of systemic and cross-industry risk exposure
- Preparing for risks that cannot yet be fully quantified
- What organisations need to build now to remain resilient in the future
 | (Moderator) Andreas Simou,Managing Director,CeFPro |
| Julie Gaiaschi,CEO & Co-Founder,Third Party Risk Association (TPRA) |
 | Malcolm Smith,VP, Global Lead of TPRM Office,Goldman Sachs |
| Daniel Philemon,Product Marketing Manager,Aravo |