Dropping the S-BOM
Third Party Therapy Podcast — featuring Stephen Boyer, Co-Founder and Chief Innovation Officer, BitSight. Why Static Binary Analysis Is the Missing Piece in Software Supply Chain Risk
Cyber criminals don't operate on an annual review cycle — so why do so many third party risk management (TPRM) programmes still assess supplier cyber risk that way? In this episode of Third Party Therapy, host Mike Day speaks with Stephen Boyer, co-founder and Chief Innovation Officer at BitSight, about how the cyber threat landscape has evolved, and what that means practically for anyone managing supply chain risk.
From Clumsy to Military-Grade
Stephen opens with a striking frame, referencing a recent Wall Street Journal report on how certain nation-state cyber actors have "graduated from clumsy corporate thieves to military weapons." His broader point: sophisticated, nation-state-level attacks are no longer confined to government targets. Regional airports, water utilities, oil and gas processing facilities — ordinary commercial and civic infrastructure — now sit squarely in scope, because compromising them can serve broader geopolitical or military aims.
Editorial note: the specific claim about the origin and sophistication trajectory of any named nation-state actor reflects reporting Stephen Boyer referenced on the podcast rather than an independently verified assessment, and readers should treat attribution claims in this space with appropriate caution — attribution in cyber incidents is notoriously difficult to establish with certainty.
He also points to a documented pattern from the Russia-Ukraine conflict: cyber operations frequently preceding or accompanying physical ("kinetic") military action, often disabling communications infrastructure ahead of a battlefield advantage. Separately, attacks — often disguised as ransomware but functioning as "wiperware," designed purely to disrupt rather than extract payment — have hit organisations with no direct connection to the conflict theatre at all.
Are Breach Claims Sometimes Exaggerated?
Mike raises a sharp, practical question: does the scale of data breaches claimed on the dark web sometimes get inflated for reputational effect by the attackers themselves? Stephen's answer is nuanced — he acknowledges some exaggeration does occur, particularly where an organisation has refused to pay a ransom, but points to a countervailing dynamic: attackers have a commercial incentive not to publish stolen data if the ransom is paid, since publishing anyway would undermine trust in their "business model" for future victims. He cites the Medibank breach in Australia — where sensitive medical data on millions of Australians was ultimately linked, according to police, to more than 10,000 downstream crimes — as an example of how genuinely damaging under-reported breaches can be.
Third Parties: Strengthening Security and Concentrating Risk at the Same Time
Asked whether the growing use of cloud and SaaS third parties is increasing or decreasing organisational cyber risk, Stephen's answer is "a mix of both." Consolidating infrastructure with major, well-resourced cloud providers generally raises the baseline security bar compared to organisations running their own servers and mail systems. But it also concentrates risk: a single vulnerability at a widely-used provider can simultaneously expose thousands of downstream customers, some of whom may become collateral victims without ever being directly targeted. Even Microsoft itself, he notes, has repeatedly been a direct target of major attacks — scale is not the same as immunity.
The Shift From Point-in-Time to Continuous Monitoring
The heart of the episode is Stephen's case for continuous, data-driven monitoring over the traditional annual (or less frequent) due diligence questionnaire. His figure: BitSight's data suggests a major security event — a significant vendor vulnerability disclosure — occurs roughly twice a month across the vendor landscape it monitors. An annual assessment cycle is, by definition, incapable of catching most of these in a timely way.
Editorial note: the "twice a month" frequency of major security events is Stephen Boyer's own characterisation based on BitSight's observations and has not been independently verified by this publication — treat it as one vendor's stated experience rather than an industry-wide benchmark.
He illustrates the practical value of continuous, portfolio-wide visibility with two real incidents:
• MoveIt — a file transfer tool exploited via a serious vulnerability. Stephen's team identified roughly 1,200 instances of the software across the internet — a concentrated, identifiable footprint. Crucially, several further vulnerabilities in the same product followed the initial one, meaning organisations that believed they'd already patched could still have been exposed by a later flaw, or could have been compromised before their patch was even applied.
• CrowdStrike — the widely reported outage caused by a faulty update to an endpoint protection agent running on millions of devices. BitSight used network traffic analysis (observing devices "beaconing" to CrowdStrike's update servers, then going silent) to help customers work out, within hours rather than weeks, which of their suppliers were likely affected — a question that would otherwise require contacting every third party individually.
Editorial note: the specific figure of "around 1,200 instances" of the MoveIt vulnerability is Stephen Boyer's own stated figure from the podcast and has not been independently verified here.
The Case Study: NASA and a 50% Efficiency Gain
Stephen offers NASA as a concrete illustration of scale: the organisation must conduct cybersecurity due diligence across roughly 3,000 suppliers. Working with BitSight's tooling for visibility, workflow and reporting, Stephen states NASA achieved approximately a 50% efficiency gain in that process — allowing the same team to do meaningfully more with the same resources, including supporting statutory requirements such as Section 889 vendor-restriction checks.
Editorial note: the "50% efficiency gain" figure and the "3,000 suppliers" figure are both claims made by Stephen Boyer on the podcast, presumably drawn from BitSight's own case study material, and have not been independently verified — readers should treat them as the vendor's own reported outcome rather than a confirmed, audited statistic.
Fourth Parties Hiding in Plain Sight
One of the more practically useful threads in the conversation concerns fourth party risk — specifically, infrastructure-level products that would never appear on a typical "critical fourth party" register, because they're not a named subcontractor providing an obvious critical service. MoveIt and CrowdStrike are both good examples: neither would naturally show up if you asked a third party "who are your critical subcontractors?" — yet both created genuine, fast-moving exposure. Stephen's argument is that mapping every fourth party exhaustively is neither realistic nor the point; what matters is the ability to rapidly answer "am I exposed to this?" when an infrastructure-level event breaks, using technical and open-source signals rather than relying solely on what a supplier volunteers.
Detection, Response Time, and the Limits of Prevention
Asked directly whether solutions like BitSight can prevent cyberattacks, Stephen is candid: "no one can prevent an attack." The realistic goal is reducing time to detect and respond, and shrinking the attack surface before an incident occurs — for example, identifying six specific issues during a vendor's onboarding due diligence and getting them resolved before data sharing begins, or catching malware beaconing on a system before it escalates into a full ransomware event. None of this proves a prevented attack, but it demonstrably reduces the scope and cost of the ones that do occur.
Regulation Is Starting to Have Teeth
Looking at the regulatory direction of travel — DORA in EU financial services, NIS2 more broadly across the EU — Stephen highlights Belgium's Centre for Cybersecurity (CCB) as an instructive early model: a government body directly monitoring critical national infrastructure organisations for vulnerabilities and proactively notifying them, having been among the first EU countries to transpose NIS2 into domestic law via its "Cyber Fundamental Assessments" programme. His broader observation: known, previously-disclosed vulnerabilities — not exotic zero-days — accounted for the large majority of attacks referenced in the reporting he opened the conversation with. Yet BitSight's own analysis found it takes roughly six months, on average, for half of known exploited vulnerabilities (the US CISA's "KEV" list) to be remediated across the organisations and geographies studied.
Editorial note: the "roughly six months to remediate half of known exploited vulnerabilities" figure is a claim from BitSight's own research as described by Stephen Boyer, and has not been independently verified — treat it as the vendor's reported finding rather than a confirmed external statistic.
What Makes These Programmes Succeed or Fail
Asked for lessons learned, Stephen's answer is organisational rather than technical: buying monitoring software is the easy part. Programmes fail when the capability sits in a single, isolated team with no established path to procurement, legal or the relationship managers who actually own the connection to each third party — meaning an alert about a vulnerability has nowhere productive to go. Programmes succeed when those functions are deliberately brought together (Stephen describes running workshops where stakeholders from different parts of an organisation meet each other, in some cases, for the first time) and there's a clear, cross-functional process for escalating and acting on what the monitoring surfaces.
His practical starting advice for any TPRM team considering this shift: define the specific goal and risk appetite first, start with a realistic, bounded scope rather than an all-encompassing "big bang" programme, secure an early quick win to build organisational momentum, and only then scale the approach outward.
Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.
Tags
#ThirdPartyTherapy #TPRM #CyberSecurity #CyberRiskManagement #ContinuousMonitoring #VendorRiskManagement #FourthPartyRisk #ThirdPartyRiskManagement #DORA #NIS2 #CyberDueDiligence #SupplyChainSecurity #KnownExploitedVulnerabilities #RiskManagementPodcast #HowToMonitorThirdPartyCyberRisk #WhatIsContinuousCyberMonitoring #TPRMPodcast
