Cisco | Your Vendor Passed the Questionnaire. Now What? Rethinking Third-Party Risk for the AI Era

Cisco | Your Vendor Passed the Questionnaire. Now What? Rethinking Third-Party Risk for the AI Era

by Danielle Lawrence · View the channel on PSI

Humanities, Social Sciences & Thought Economics & Finance KJMVManagement of specific areasKJMV8Purchasing and supply management
🎙 Danielle Lawrence 👥 3K 📅 October 16, 2026 ⏱ 48 min 👁 0 📄 expert opinion 🧭 2026-10-16
Available in: English (current) Français

Keywords

questionnaireAI-assisted assessmentrisk-basedSOC 2continuous monitoring

Summary

Danielle Lawrence, who leads vendor security at Cisco, discusses the pitfalls of traditional third-party risk assessments based on questionnaires. She argues that a completed questionnaire only indicates that answers were provided, not that controls are effective. The webinar covers how AI can assist in analyzing vendor documents, extracting evidence, and drafting preliminary findings, while emphasizing that human judgment remains essential for verification and interpretation. She introduces the concept of continuous monitoring using external intelligence tools like Black Kite to detect changes between formal assessments. The talk highlights the importance of context, such as product usage and data access, in determining risk, and advocates for event-driven reassessments rather than solely calendar-based ones. She outlines a workflow where AI accelerates document review but humans retain accountability, ensuring traceability and auditability. The presentation includes practical examples and a scenario about responding to a flagged exposure, concluding that vendor approvals should be dynamic and risk-based.

151 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value lies in shifting from a checkbox compliance mindset to a risk-based approach that leverages AI for evidence analysis while preserving human oversight. The argument is well-supported with concrete examples, such as the difference between a policy and its operational effectiveness, and the scenario of the same vendor in different use cases. The speaker acknowledges limitations of AI, including hallucination, and emphasizes the need for human verification. The continuous monitoring concept is presented as an additional intelligence layer rather than a replacement for assessments.

Scientific Rigor, Source Quality, Title Accuracy

The rigor is moderate; the presentation is based on the speaker’s professional experience and not on academic sources. No external sources are cited, but the content is coherent and practical. The title accurately reflects the content, and the talk avoids excessive product promotion, despite being by Cisco.

147 words

Title / Content Match

The title accurately reflects the content, focusing on the limitations of traditional vendor questionnaires and the shift toward risk-based, AI-assisted continuous monitoring in the AI era.

Quality & Reliability

7/10

The presenter is a vendor security professional with relevant experience. The webinar provides practical insights but is not peer-reviewed and may have a promotional angle, though the speaker explicitly avoids product promotion. The content is well-structured and grounded in real-world examples.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Contribution & Novelties

The video offers a practical perspective on integrating AI into vendor risk assessments, emphasizing human-in-the-loop. It also highlights the need for continuous monitoring and event-driven reassessment. The ‘Pour aller plus loin’ section suggests exploring SOC 2, NIST AI Risk Management Framework, and ISO 27001 for further understanding.

Pour aller plus loin :

  • SOC 2 — Overview of SOC 2 reports referenced in the talk.
  • NIST AI Risk Management Framework — Framework for managing AI risks relevant to AI-enabled vendor features.
  • ISO/IEC 27001 — International standard for information security management, often referenced in vendor assessments.

94 words

Radar Profile

The scores indicate a balanced profile with relatively high quantity and quality of information, moderate technical depth, and reliable content. The radar would show a strong 'quantity' and 'quality' dimension, with lower 'technical' and 'fiability' slightly lower, reflecting the webinar format.

Reliability 7/10