Machine Insights, Human Decisions: How AI Is Changing Third Party Risk Assessment

Mike Day • 14 September 2026

Third Party Therapy Podcast — featuring Aki Eldar, co-founder of Mirato

Artificial intelligence is either the biggest opportunity or the biggest risk in third party risk management (TPRM), depending on who you ask. In this episode of Third Party Therapy, host Mike Day speaks with Aki Eldar, entrepreneur and co-founder of Mirato, about where AI genuinely moves the needle in TPRM today — and where the industry needs to temper its expectations.

From Data Protection to TPRM

Aki's route into TPRM AI is not a straight line. He founded his first company, Secure Islands, in 2006, focused on classifying and protecting unstructured data — years before the concept of protecting the data itself, rather than the network perimeter, became mainstream. Secure Islands was acquired by Microsoft, and its technology now underpins what is broadly known as Microsoft's information protection capability. Five and a half years ago, Aki and co-founder Itay Hochman founded Mirato, bringing that same data and AI background to a discipline he describes as still "stuck ten years ago" — a world where workflow has been automated, but the actual work of assessment has not.

Where AI Fits Today: Subjective and Objective Data

Aki frames Mirato's value proposition around two categories of data:

•     Subjective data — the evidence documents a third party supplies, sometimes running to thousands of pages, which must be manually mined for evidence against hundreds of controls.

•     Objective data — external data sources (some paid, some free) that enrich and cross-check what the third party has provided.

Rather than requiring organisations to hire more assessors to increase either the volume or quality of assessment, Mirato's model trains the technology once and then scales it indefinitely — reading documents automatically, finding supporting evidence for controls, and pulling in external data sources without needing to add subject-matter experts for every domain.

The accuracy claim is notable: Aki cites Mirato's own accuracy at "a little bit more than 90%", against what he says published studies put human assessor accuracy at around 60%. He is careful to frame this as augmentation, not replacement, of human judgement — Mirato's slogan is "machine insights, human decision."

Editorial note: the specific accuracy figures cited above are Aki Eldar's own claims made on the podcast and have not been independently verified — readers should treat them as one vendor's stated position rather than a confirmed industry benchmark.

Killing the Questionnaire

One of the more concrete products discussed is MQK — Mirato Questionnaire Killer — which flips the traditional due diligence questionnaire on its head. Instead of a vendor manually answering hundreds of questions, they upload their evidence documents and the system answers the majority of the questions automatically, based on what's actually written in that evidence. The vendor still attests to the answers, preserving accountability, and can request clarifications where needed.

Both this tool and Mirato's core control-assessment product provide a full audit trail: every finding links back to the specific document, page and highlighted paragraph that supports it.

Why Auditability Matters More in TPRM Than Almost Anywhere Else

Auditability isn't a nice-to-have here — it's existential. Aki is direct about the risk of "black box" AI in a regulated space: if you can't explain why a decision was reached, neither can the regulator, and that is simply unacceptable in most TPRM contexts. This is also Mirato's answer to one of generative AI's best-known weaknesses — hallucination and inconsistency. Because Mirato's assessments are fully explainable and evidence-linked rather than generative, Aki says the same inputs reliably produce the same outputs, run after run — something he notes is not guaranteed with off-the-shelf generative AI, and is often not true of human assessors either.

Beyond Assessment: Aggregation, Fourth Parties and Continuous Assessment

The conversation moves into territory relevant to concentration risk and extended supply chain visibility, an increasingly urgent regulatory concern under frameworks like DORA. Aki describes a "risk hunter" capability that automatically maps relationships between products, software packages, locations and departments to expose cascading and aggregation risk — including fourth parties.

He also draws a sharp and useful distinction between two terms often used interchangeably:

•     Continuous monitoring — data changes continuously, but still requires a human to review it before it can be acted on.

•     Continuous assessment — the system itself detects when a change crosses a meaningful threshold and alerts the organisation automatically.

Aki is candid that true predictive capability — anticipating incidents before they happen — isn't realistic yet. His view is deliberately incremental: get the assessment fast and accurate first, then build continuous assessment, and only then start thinking about prediction. "I don't believe in revolutions," he says, "I believe it's incremental."

The Risk of AI Assessing AI-Generated Data

Mike raises a sharper question: as AI-generated content proliferates, is there a risk that the data organisations feed into AI-driven assessment tools is itself increasingly AI-generated — creating a feedback loop that erodes reliability over time? Aki's answer circles back to design principles: as long as a system remains fully explainable and provides a complete audit trail, the ability to control and interrogate outputs is retained regardless of the provenance of the underlying data.

The Two Warnings for TPRM Leaders Considering AI

Asked what mistakes he's already seeing, Aki offers two clear warnings:

1.   Don't try to solve everything at once. Bring value quickly with a narrow, well-defined use case, then expand — the classic minimum viable product approach.

2.   Don't build AI capability in-house just because it's fashionable. TPRM, in Aki's view, is not the most strategic function in which to build proprietary AI, because the resulting models don't transfer to other parts of the business — you'd be paying, by his estimate, roughly ten times more to build and retrain a capability that specialist vendors already offer.

Practical First Steps

For any organisation starting this journey, the recommended approach is: define a specific use case with real value, define clear success metrics and KPIs, compare a small number of vendors solving a similar problem rather than chasing "best overall", start with a narrow scope (one or two risk domains, not the entire assessment), and start standalone before integrating into your broader IRM and workflow stack.

The direction of travel Aki describes mirrors the automotive industry's own evolution — from fully manual assembly to a process still run on the same workflow "assembly line," but where machines now do roughly 80% of the work, freeing people to focus on judgement rather than administration. His ambition for TPRM: flip today's roughly 80% data administration / 20% risk and mitigation split into its inverse.


Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list.


Tags

#ThirdPartyTherapy #TPRM #ArtificialIntelligence #AIinTPRM #VendorRiskManagement #DueDiligence #ContinuousMonitoring #ContinuousAssessment #RegTech #ThirdPartyRisk #GenerativeAI #ExplainableAI #DORA #FourthPartyRisk #RiskManagementPodcast #HowIsAIUsedInThirdPartyRiskManagement #AIVendorDueDiligence #TPRMPodcast

From Annual Assessment to Continuous Monitoring: Rethinking Cyber Risk in Your Supply Chain

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Stephen Boyer, Co-Founder and Chief Innovation Officer, BitSight

The Startup's-Eye View of TPRM: Why Your Due Diligence Process Might Be Costing You the Best Suppliers

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Ian Ellis, emerging technology adviser and angel investor

Concentration Risk: It's All About the Data

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Gemma Stewart, Global Head of Vendor Management, Zurich Insurance

What Does Community Due Diligence Actually Deliver?

by Mike Day • 14 September 2026
Third Party Therapy Podcast — Series 1, Episode 1 — featuring Paul Huggett, Managing Director, Helios For the very first episode of Third Party Therapy, host Mike Day speaks with Paul Huggett, Managing Director at Helios and a former head of third party risk management (TPRM) at Lloyds Banking Group, Bank of Ireland and Nationwide Building Society. Having sat on both sides of the fence — as a buyer of pooled due diligence for over a decade, and now as a provider of it — Paul offers a rare, grounded view of what community due diligence really delivers, and where its limits are. From "Poacher" to "Gamekeeper" to Provider Paul's career path is itself a neat illustration of how TPRM as a discipline emerged almost by accident. Starting in operational and IT project management in the early 1990s, he moved into outsourcing project delivery — describing himself at the time as a "poacher," someone focused purely on moving functions quickly, for whom procurement was simply an obstacle. A move into internal audit at Lloyds Banking Group — auditing the sourcing and property functions — turned him into a "gamekeeper," and from there he spent a decade running third party risk functions across three major financial institutions, all of which were customers of Helios's FSQS scheme, before joining Helios itself roughly 18 months ago. Ten Years of Change in TPRM Paul's account of how far the discipline has moved is stark. His first supplier management audit revealed that "due diligence" at the time amounted to a signed letter from the supplier saying "everything's fine, thank you." The regulatory framework consisted of a handful of bullet points essentially saying "you can't outsource the risk." The period from roughly 2015 to 2018 — driven by GDPR, the growth of cloud outsourcing, and European regulators waking up to the risk — triggered rapid change, followed by growing UK regulatory focus (SS2/21 and PS7/21) on operational resilience, conduct risk, and more recently ESG, which Paul says has moved from "almost at the bottom of the pile" to near the top of the risk league table. What Pooled Due Diligence Actually Is Paul's explanation is refreshingly plain: the traditional model is a "many-to-many mesh" — every buyer individually asking every one of their suppliers largely the same questions, repeatedly. Pooled or community due diligence flips this into a one-to-many model: a supplier answers a shared, standardised question set once, and that data is made available (with the supplier's consent and quality-checked) to every buyer in the community who needs it. The win is symmetric. Suppliers spend less time repeatedly answering near-identical questionnaires from dozens of buyers. Buyers get a faster start, a broader pool of pre-assessed suppliers, and — critically — a question set that reflects a decade of collective input from the buying community, not just their own risk team's best guess. As Paul puts it, being able to tell your board "this is good enough for [named peer firms], therefore we believe it's good enough for us" is valuable air cover for a new entrant to the model. From Niche to Mainstream When Lloyds Banking Group first adopted the model, it was the only buying firm in the community — making it a hard sell to suppliers. Today, Helios's UK community includes just under 70 buying firms, plus roughly 20 more across Europe, spanning tiny building societies through to major international investment banks. Paul attributes the shift to sustained pressure on TPRM budgets and headcount ("you never get, as a TPR person, someone come to you and say... would you like some more people?"), combined with a regulatory turning point around 2018-2019 when European regulation first explicitly acknowledged shared assurance as acceptable — provided the buyer using it still applies its own risk appetite to the results, rather than simply outsourcing the decision. Confidentiality and Competition Law Two objections come up repeatedly with pooled models, and Paul addresses both directly. On confidentiality, where a supplier is unwilling to upload a sensitive document (such as a full cybersecurity policy) directly, Helios instead asks granular, structured yes/no questions about the specific controls contained within that document — meaning a buyer's risk specialist can still assess control coverage without the underlying document ever being shared. On competition law, Helios never discloses which buyers work with which suppliers to other buyers in the community, never comments on individual suppliers as a collective, and never directs buyers to take action against a specific supplier — all of which would risk anti-competitive behaviour. Not a Silver Bullet — Part of an Ecosystem Paul is careful to position pooled due diligence as one part of a wider TPRM toolkit, not a replacement for the buyer's own risk judgement. Helios provides primary, source-verified data (rather than scraped or blended third-party data), but the buyer still has to decide what matters to them and act on it. His framing: "we give you the information, but your job is to decide what to do with it." Real-World Stress Testing: Russia-Ukraine One of the clearest illustrations of the model's value came with the outbreak of the Russia-Ukraine conflict. Because Helios already held country of registration, operating location and fourth party data for its supplier community, buyer firms could establish their exposure "within about half an hour" of the event breaking — rather than manually cross-referencing finance systems to work out who they'd been paying, and where. Helios then issued a bespoke follow-up questionnaire to roughly 10,000 suppliers within about ten days, with an 80% response rate — giving buyers not just a static exposure map, but live intelligence on downstream impact. The same approach was repeated for the Israel-Gaza conflict and rolling energy blackouts. Where AI Fits — and Where Helios Is Deliberately Cautious Asked about AI, Paul draws a pointed comparison to cloud computing circa 2017-2018: a lot of noise, real underlying risk, but limited clarity on exactly where the exposure sits. Helios is building a new question set specifically to assess suppliers' use of AI, aligned to the EU AI Act's risk-based, proportionate approach. But Paul is candid that Helios itself is deliberately slow to deploy AI at scale in its own data pipeline, given its core value proposition rests on primary, verified data rather than scraped or AI-generated content — and flags the emerging industry concern that large language models may increasingly be trained on data that itself originated from other AI systems, creating a quality-degradation risk over time. Editorial note: the discussion of AI training data and model quality reflects Paul Huggett's own views and industry commentary referenced on the podcast, not an independently verified technical claim. Concentration Risk and the Regulator's Blind Spot Paul also touches on Critical Third Party (CTP) regulation and the new, more detailed outsourcing and DORA registers now required by UK and EU regulators — designed to help regulators identify concentration risk across the financial sector. He's candid that Helios, precisely because of the same competition and confidentiality constraints discussed earlier, cannot fill this gap entirely: it knows what a supplier does, but not what each buyer considers critical about that relationship, since criticality varies hugely between an insurer, a reinsurer, a building society and an investment manager. The Direction of Travel: From Data to Assurance Looking ahead, Paul sees the community model extending from data-gathering into genuine assurance — Helios has already introduced ESG benchmarking that lets suppliers see how they compare to peers, and has launched pooled, supplier-funded virtual site visits testing controls across the top operational risk domains. Notably, he observes that resistance to pooled assurance has historically come more from buyers wanting to "do things their way" than from suppliers, who are generally keen to spend less time on duplicate assurance requests. A Practical Starting Point For any organisation considering this path, Paul's advice is to look at your own organisation from the supplier's point of view: how many different, overlapping data requests are you sending out? Are you actually using everything you collect, or gathering data you never act on? And do you genuinely understand your broader (not just your most critical) supplier population — because, as Paul notes pointedly, "Covid did not care that it was taking out your workforce from a whole swathe of your medium risk suppliers." His clearest warning, drawn from watching organisations invest heavily in shiny new source-to-pay platforms: the technology is rarely the problem. "Systems and technology are not going to solve your problems. They're just going to give you a shinier problem to grapple with," unless matched with the cultural change and data discipline to actually populate and use them. Listen to the full episode of Third Party Therapy, produced in association with CeFPro, on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list. Tags #ThirdPartyTherapy #TPRM #CommunityDueDiligence #PooledDueDiligence #VendorRiskManagement #ThirdPartyRiskManagement #FSQS #SharedAssurance #DueDiligence #FinancialServicesRegulation #ConcentrationRisk #CriticalThirdParty #DORA #SupplierRiskManagement #RiskManagementPodcast #WhatIsPooledDueDiligence #HowDoesCommunityDueDiligenceWork #TPRMPodcast

Modern Slavery in Your Supply Chain: Why Box-Ticking Won't Protect Your Third Parties (or Their Victims)

by Mike Day • 14 September 2026
Third Party Therapy Podcast — featuring Shayne Tyler, supply chain modern slavery expert Modern slavery rarely makes the same headlines as a cyber breach or a data leak, yet its human cost is far greater — and, as this episode of Third Party Therapy makes clear, it is far closer to the corporate world than most third party risk management (TPRM) professionals assume. Host Mike Day sat down with Shayne Tyler, a supply chain modern slavery expert with over 20 years of first-hand experience tackling worker exploitation. Shayne's involvement in this space began in the most direct way possible: as an operations manager whose own factory was exposed on the BBC's Panorama in 2000 for the illegal employment of more than 200 staff. That experience — engaging afterwards with the victims themselves — set the course for the rest of his career. What Modern Slavery Actually Is Shayne's central message is that "modern slavery" is a broad umbrella covering forced labour, organ harvesting, forced criminality and prostitution, but that in the corporate world, forced labour driven by human trafficking dominates. Crucially, he stresses that human trafficking does not require crossing a border: moving someone from one field, or one office, to another for the purpose of exploitation is enough. He breaks trafficking down into three legal components that must all be present: • Action — the transportation, harbouring or receipt of a person • Means — control and power exercised over them • Purpose — for financial gain Without all three, it is a different crime entirely — smuggling, or extortion. That distinction is part of why modern slavery is so notoriously difficult to prosecute: the "chains" are usually psychological, built through debt, fear, pride or hope rather than physical restraint. The UK Is Not Immune — and Neither Is Finance A common assumption in TPRM circles is that modern slavery is confined to agriculture, food production or other manual, low-skill sectors overseas. Shayne dismantles this. Citing Pew Research Centre estimates of 800,000 to 1.2 million people in the UK without the right to live and work — roughly one in fifty people — he argues that any organisation interacting with more than fifty people is statistically likely to encounter someone in that position. He points to worker substitution (the person who turns up to do the job is not the person who was vetted) as a pervasive and largely unpoliced gap, and highlights how visa routes — Tier 2 skilled worker sponsorship, the Tier 5 seasonal worker scheme, EU Settled Status, and student visas — all carry their own distinct exploitation risks, from debt bondage arranged in the worker's home country to fee-payment scams tied to fraudulent immigration paperwork. For financial services specifically, Shayne draws a direct parallel to anti-money laundering controls: a pattern such as a victim's bank account being emptied every Friday night at a cash point is exactly the kind of anomaly that existing AML infrastructure could be adapted to flag — if TPRM, fraud and financial crime teams collaborated on it. Why Policies Don't Stop Exploiters — Processes Do Perhaps the sharpest insight in the episode: in 24 years of this work, Shayne says he has "not met an exploiter yet that has cared one iota about a company's policy." Exploiters study and infiltrate processes, not statements. His own audits have generated close to 30 critical non-compliances in a single afternoon by testing a labour provider's systems with deliberately falsified information — precisely the same technique an exploiter would use. This is a direct challenge to the "modern slavery statement" as a compliance artefact. As he puts it, no statement has ever prevented a victim. The Four Ps: A Practical Due Diligence Framework Rather than defaulting to a checklist, Shayne recommends corporates adopt a four-stage approach: 1. Pursue — assume exploitation is present in your supply chain and actively look for it, rather than assuming the absence of evidence means the absence of a problem. 2. Prevent — use what you find to close gaps for the next case, even if you can't undo the last one. 3. Prepare — share learnings across your business, supply chain and even competitors, and train staff to recognise the signs. 4. Protect — not only the victim, but the brand, the business, the systems and the staff. Protecting everyone matters, because "there is no point in being the most ethical business on the planet if you're out of business." Look for the Absence of Normal, Not the Presence of Abnormal One of the episode's most striking reframes: conventional guidance tells people to look for visible signs of exploitation (houses of multiple occupancy, signs of abuse, isolation). But if a sign is visible, Shayne argues, exploiters already know to hide it. The more reliable indicator is the absence of normal — the person who never mentions weekend plans, who never has an ordinary conversation about ordinary life. And when a potential victim is identified, the instinct to escalate immediately can be dangerous. Shayne recounts a case in which acting too fast caused 53 people connected to a single victim to disappear. His guidance: de-escalate, gather information quietly, and hand a complete picture to the authorities rather than attempting to investigate or "rescue" directly. The Takeaway for TPRM Teams This conversation is a reminder that third party risk management's toolkit — due diligence, escalation, ongoing monitoring — has direct relevance to one of the most serious human rights issues in modern business, but only if it moves beyond box-ticking. Real progress means testing processes the way an exploiter would, watching for the absence of the ordinary, and building cross-functional collaboration between TPRM, procurement, HR and financial crime teams. As Shayne puts it, using a health and safety analogy: don't jump straight to the high-vis vest. Eliminate the risk first, substitute it, segregate it, administrate it — and only then rely on the last line of defence. Listen to the full episode of Third Party Therapy on Apple Podcasts, Spotify, Amazon Music, Audacy and YouTube, or visit thirdpartytherapy.com to subscribe to the mailing list. Tags #ThirdPartyTherapy #TPRM #ModernSlavery #SupplyChainRisk #HumanTrafficking #VendorRiskManagement #DueDiligence #ForcedLabour #EthicalSupplyChain #ESG #FinancialServicesRegulation #SupplierRisk #CorporateResponsibility #RiskManagementPodcast #ModernSlaveryAct #WhatIsModernSlaveryInTheSupplyChain #HowToSpotModernSlaveryInBusiness #TPRMPodcast