How AI Agents Will Negotiate Your Vendor Contracts

Value of the Information & Strength of the Argument

The episode provides valuable insights into the practical application of AI in TPRM, drawing from the speakers’ direct experiences. Igor and Jasper offer concrete examples of how AI can automate tedious tasks like vendor assessments and questionnaires, and they discuss the challenges of shadow AI and the need for governance. Their argumentation is coherent and grounded in real-world scenarios, though some claims about future trends are speculative. The discussion on build vs. buy is particularly useful, highlighting the hidden costs of maintaining in-house tools. The speakers also address the importance of balancing autonomy and human oversight, which is a nuanced perspective. However, the lack of quantitative data or case studies weakens the overall argumentation.

Scientific Rigor, Source Quality, Title Accuracy

The episode maintains a high level of scientific rigor in the sense that the speakers are experienced professionals who provide practical insights. However, they do not cite specific studies or external sources, relying instead on anecdotal evidence. The title accurately reflects the content, focusing on AI agents in vendor contract negotiations. The discussion is well-structured, with clear chapters, and the speakers stay on topic. The lack of citations is a minor weakness, but the practical expertise compensates. The title is slightly broader than the content, as the episode covers more than just negotiations, but it is still appropriate.

The title accurately reflects the core theme of the episode, which focuses on the future role of AI agents in vendor contract negotiations, though the discussion covers broader aspects of TPRM.

7/10

The episode features two experienced security professionals (CISO and CEO) discussing practical applications of AI in third-party risk management. They provide concrete examples and acknowledge limitations, but the discussion is largely anecdotal and lacks rigorous data or peer-reviewed sources. The claims about future trends (e.g., agent-to-agent negotiations) are speculative.

• 00:00Introduction
• 02:00Jasper and Igor's Backgrounds (Ethira and Lovable)
• 04:00Why Traditional Third-Party Risk Management is Abysmal
• 06:20DORA Regulations and the Collision of AI and Compliance
• 11:30Using AI to Automate Vendor Assessments and Questionnaires
• 16:30The Build vs. Buy Debate for AI TPRM Tools
• 22:30Shadow AI: "Giving a Kindergarten a Nuclear Bomb"
• 25:30Using AI Agents for Automated Vendor Discovery and Inventory
• 28:302027: The Future of Agent-to-Agent Negotiations
• 30:40Treating AI Agents Like a Contracted Workforce
• 34:10Enforcing Contractual Accountability through AI Guardrails

• Cloud Security Podcast Website — Official website of the podcast, providing additional resources and episodes.
• Cloud Security Bootcamp — Training program for cloud security professionals, mentioned in the description.
• Cloud Security Newsletter — Newsletter for cloud security updates, mentioned in the description.
• Cloud Security Podcast LinkedIn — LinkedIn page for the podcast, mentioned in the description.

• DORA Regulation Overview — Official EU page on DORA, aligning with the regulatory discussion in the episode.
• AI Agent Security Best Practices — OWASP project on LLM security, relevant to the governance of AI agents.

• Critique of AI in Risk Management — Some experts argue that AI cannot fully replace human judgment in risk assessment, which contrasts with the episode's optimistic view.