Overshadowed: Approved Isn't Safe: The Attack Surface After the Security Review

Most third-party risk programs are built around one moment: a vendor is reviewed, approved, and filed. The attack surface doesn't stay filed. Within weeks, employees invite collaborators, connect the app to other systems, and switch on AI features, while the vendor changes sub-processors, policies, and products on its own schedule. Work now creates the attack surface faster than any review process can describe it. Russ Spitler and Ed Amoroso, founder and CEO of TAG Cyber, take on the question of what "approved" should mean when the thing you approved keeps changing, and what security leaders should measure instead. Attendees will leave with a sharper test for which vendors deserve ongoing scrutiny and a way to explain post-approval risk to the business.